TROJ_CLIBGOB.SMI

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CLASSES_ROOT>CLSID>{1f4de370-d627-11d1-ba4f-00a0c91eedba}
3. Still in the left panel, locate and delete the key:
   shellex
4. In the left panel, double-click the following:
   HKEY_CLASSES_ROOT>CLSID>{1f4de370-d627-11d1-ba4f-00a0c91eedba}>shellex
5. Still in the left panel, locate and delete the key:
   ContextMenuHandlers
6. In the left panel, double-click the following:
   HKEY_CLASSES_ROOT>CLSID>{1f4de370-d627-11d1-ba4f-00a0c91eedba}>shellex>ContextMenuHandlers
7. Still in the left panel, locate and delete the key:
   ieframe
8. In the left panel, double-click the following:
   HKEY_CLASSES_ROOT>CLSID
9. Still in the left panel, locate and delete the key:
   {1f4de370-ba4f-11d1-d627-00a0c91eedba}
10. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID>{1f4de370-ba4f-11d1-d627-00a0c91eedba}
11. Still in the left panel, locate and delete the key:
    InProcServer32
12. Again Still in the left panel, locate and delete the key:
    Instance
13. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID>{1f4de370-ba4f-11d1-d627-00a0c91eedba}>Instance
14. Still in the left panel, locate and delete the key:
    InitPropertyBag
15. Again Still in the left panel, locate and delete the key:
    shellex
16. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID>{1f4de370-ba4f-11d1-d627-00a0c91eedba}>shellex
17. Still in the left panel, locate and delete the key:
    ContextMenuHandlers
18. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID>shellex>ContextMenuHandlers
19. Still in the left panel, locate and delete the key:
    {1f4de370-ba4f-11d1-d627-00a0c91eedba}
20. Again Still in the left panel, locate and delete the key:
    MayChangeDefaultMenu
21. Again Still in the left panel, locate and delete the key:
    {C42EB5A1-0EED-E549-91B0-775852013521}
22. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID>{C42EB5A1-0EED-E549-91B0-775852013521}
23. Still in the left panel, locate and delete the key:
    DefaultIcon
24. Again Still in the left panel, locate and delete the key:
    Shell
25. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID>{C42EB5A1-0EED-E549-91B0-775852013521}>Shell
26. Still in the left panel, locate and delete the key:
    Open(&O)
27. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID>{C42EB5A1-0EED-E549-91B0-775852013521}>Shell>Open(&O)
28. Still in the left panel, locate and delete the key:
    Command
29. Again Still in the left panel, locate and delete the key:
    ÊôÐÔ(&R)
30. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID>{C42EB5A1-0EED-E549-91B0-775852013521}>Shell>ÊôÐÔ(&R)
31. Still in the left panel, locate and delete the key:
    Command
32. Again Still in the left panel, locate and delete the key:
    ShellFolder
33. In the left panel, double-click the following:
    HKEY_CURRENT_USER>SOFTWARE>Classes>CLSID
34. Still in the left panel, locate and delete the key:
    {C42EB5A1-0EED-E549-91B0-775852013521}
35. In the left panel, double-click the following:
    HKEY_CURRENT_USER>SOFTWARE>Classes>CLSID>{C42EB5A1-0EED-E549-91B0-775852013521}
36. Still in the left panel, locate and delete the key:
    DefaultIcon
37. Again Still in the left panel, locate and delete the key:
    Shell
38. In the left panel, double-click the following:
    HKEY_CURRENT_USER>SOFTWARE>Classes>CLSID>{C42EB5A1-0EED-E549-91B0-775852013521}>Shell
39. Still in the left panel, locate and delete the key:
    Open(&O)
40. In the left panel, double-click the following:
    HKEY_CURRENT_USER>SOFTWARE>Classes>CLSID>{C42EB5A1-0EED-E549-91B0-775852013521}>Shell>Open(&O)
41. Still in the left panel, locate and delete the key:
    Command
42. Again Still in the left panel, locate and delete the key:
    ÊôÐÔ(&R)
43. In the left panel, double-click the following:
    HKEY_CURRENT_USER>SOFTWARE>Classes>CLSID>{C42EB5A1-0EED-E549-91B0-775852013521}>Shell>ÊôÐÔ(&R)
44. Still in the left panel, locate and delete the key:
    Command
45. Again Still in the left panel, locate and delete the key:
    ShellFolder
46. In the left panel, double-click the following:
    HKEY_CURRENT_USER>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Desktop>NameSpace
47. Still in the left panel, locate and delete the key:
    {C42EB5A1-0EED-E549-91B0-775852013521}
48. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Toolbar>WebBrowser
3. In the right panel, locate and delete the entry:
   ITBar7Layout = {random values}
4. Again In the right panel, locate and delete the entry:
   ITBarLayout = {random values}
5. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{1f4de370-d627-11d1-ba4f-00a0c91eedba}
6. In the right panel, locate and delete the entry:
   InfoTip = "ÌØÂô"
7. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{1f4de370-ba4f-11d1-d627-00a0c91eedba}>InProcServer32
8. In the right panel, locate and delete the entry:
   ThreadingModel = "Apartment"
9. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{1f4de370-ba4f-11d1-d627-00a0c91eedba}>Instance
10. In the right panel, locate and delete the entry:
    CLSID = "{3f454f0e-42ae-4d7c-8ea3-328250d6e272}"
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{1f4de370-ba4f-11d1-d627-00a0c91eedba}>Instance>InitPropertyBag
12. In the right panel, locate and delete the entry:
    CLSID = "{13709620-C279-11CE-A49E-444553540000}"
13. Again In the right panel, locate and delete the entry:
    command = "´ò¿ª(&O)"
14. Again In the right panel, locate and delete the entry:
    method = "ShellExecute"
15. Again In the right panel, locate and delete the entry:
    Param1 = "http://%77%77%77%2e%31%39%38%33%30%39%2e%63%6f%6d"
16. Again In the right panel, locate and delete the entry:
    Param2 = "%ProgramFiles%\Internet Explorer\iexplore.exe"
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{C42EB5A1-0EED-E549-91B0-775852013521}>ShellFolder
18. In the right panel, locate and delete the entry:
    Attributes = a
19. In the left panel, double-click the following:
    HKEY_CURRENT_USER>CLSID>{C42EB5A1-0EED-E549-91B0-775852013521}>ShellFolder
20. In the right panel, locate and delete the entry:
    Attributes = a
21. Close Registry Editor.

To restore registry values this malware/grayware modified:

1. Open Registry Editor. To do this:
   
   • On Windows 2000, XP, and Server 2003:
     Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
   • On Windows Vista and 7:
     Click the Start button, type REGEDIT in the Search input field then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{1f4de370-d627-11d1-ba4f-00a0c91eedba}
3. In the right panel, locate the registry value:
   LocalizedString = "Internet Explorer"
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   LocalizedString = @%SystemRoot%\system32\SHELL32.dll,-30521
5. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{1f4de370-d627-11d1-ba4f-00a0c91eedba}>InProcServer32
6. In the right panel, locate the registry value:
   ThreadingModel = "Apartment"
7. Right-click on the value name and choose Modify. Change the value data of this entry to:
   ThreadingModel = Apartment
8. Close Registry Editor.

To manually delete a malware/grayware file from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the left panel, click All Files.
3. In the Named input box, type the following:
   %User Temp%\360safe.vbs
4. In the Look In drop-down list, select My Computer then press Enter.
5. Once located, select the file then press SHIFT+DELETE to delete it.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type the following:
   %User Temp%\360safe.vbs
3. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.