TROJ_JOYDLOAD.A

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>entrusted
3. Still in the left panel, locate and delete the key:
   toolbar
4. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Conduit>ISM
5. Still in the left panel, locate and delete the key:
   IE
6. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>entrusted
7. Still in the left panel, locate and delete the key:
   toolbar
8. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>entrusted>toolbar
9. Still in the left panel, locate and delete the key:
   IE5
10. Again Still in the left panel, locate and delete the key:
    Settings
11. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>entrusted>toolbar>Settings
12. Still in the left panel, locate and delete the key:
    FeatureProtector
13. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>entrusted>toolbar>Settings>FeatureProtector
14. Still in the left panel, locate and delete the key:
    HomePage
15. Again Still in the left panel, locate and delete the key:
    BrowserSearch
16. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>entrusted>toolbar>settings
17. Still in the left panel, locate and delete the key:
    MyStuff
18. Again Still in the left panel, locate and delete the key:
    Monitored
19. Again Still in the left panel, locate and delete the key:
    RadioPlayer
20. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>entrusted>toolbar>Search
21. Still in the left panel, locate and delete the key:
    Settings
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Conduit
23. Still in the left panel, locate and delete the key:
    InstallationGlobalKeys
24. Again Still in the left panel, locate and delete the key:
    Communicator
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Conduit>Platforms
26. Still in the left panel, locate and delete the key:
    {e44a1809-4d10-4ab8-b343-3326b64c7cdd}
27. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>SearchScopes
28. Still in the left panel, locate and delete the key:
    {afdbddaa-5d3f-42ee-b79c-185a7020515b}
29. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software
30. Still in the left panel, locate and delete the key:
    ConduitSearchScopes
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Conduit
32. Still in the left panel, locate and delete the key:
    HomePage
33. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Conduit
34. Still in the left panel, locate and delete the key:
    RevertSettings
35. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall
36. Still in the left panel, locate and delete the key:
    IECT3281675
37. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Conduit>IE
38. Still in the left panel, locate and delete the key:
    Hook
39. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Conduit>IE>Hook
40. Still in the left panel, locate and delete the key:
    entrusted
41. Again Still in the left panel, locate and delete the key:
    Log
42. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID
43. Still in the left panel, locate and delete the key:
    {E44A1809-4D10-4AB8-B343-3326B64C7CDD}
44. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID>{E44A1809-4D10-4AB8-B343-3326B64C7CDD}
45. Still in the left panel, locate and delete the key:
    InprocServer32
46. Again Still in the left panel, locate and delete the key:
    Smartbar
47. Again Still in the left panel, locate and delete the key:
    Toolbars
48. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>entrusted>toolbar>Repository>conduit_CT3281675
49. Still in the left panel, locate and delete the key:
    Coordinator
50. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Microsoft>Internet Explorer>Low Rights>ElevationPolicy
51. Still in the left panel, locate and delete the key:
    {F9389F6B-8DDF-45D1-9743-FE6264ABEB65}
52. Again Still in the left panel, locate and delete the key:
    {CCA4E328-8C78-4D90-866E-6DC3C9C17CE7}
53. Again Still in the left panel, locate and delete the key:
    {01335480-2AED-4070-AFF3-B4C8BC22FF35}
54. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID>{01335480-2AED-4070-AFF3-B4C8BC22FF35}
55. Still in the left panel, locate and delete the key:
    InprocServer32
56. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID>{01335480-2aed-4070-aff3-b4c8bc22ff35}
57. Still in the left panel, locate and delete the key:
    ProgID
58. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
59. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT
60. Still in the left panel, locate and delete the key:
    Toolbar.CT3281675
61. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>Toolbar.CT3281675
62. Still in the left panel, locate and delete the key:
    CLSID
63. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext>PreApproved
64. Still in the left panel, locate and delete the key:
    {01335480-2aed-4070-aff3-b4c8bc22ff35}
65. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Conduit>Platforms
66. Still in the left panel, locate and delete the key:
    {01335480-2aed-4070-aff3-b4c8bc22ff35}
67. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Toolbar
68. Still in the left panel, locate and delete the key:
    RegisteredSources
69. Again Still in the left panel, locate and delete the key:
    {F45AB5EB-4700-4745-AD30-7592EAB1C986}
70. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID>{F45AB5EB-4700-4745-AD30-7592EAB1C986}
71. Still in the left panel, locate and delete the key:
    InprocServer32
72. Again Still in the left panel, locate and delete the key:
    {f45ab5eb-4700-4745-ad30-7592eab1c986}
73. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>entrusted>toolbar>settings>BackHandStorage
74. Still in the left panel, locate and delete the key:
    GlobalKeys
75. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>entrusted>toolbar
76. Still in the left panel, locate and delete the key:
    InstalledApps
77. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Conduit>Community Alerts
78. Still in the left panel, locate and delete the key:
    Settings
79. Again Still in the left panel, locate and delete the key:
    Community Alerts
80. Again Still in the left panel, locate and delete the key:
    {3c471948-f874-49f5-b338-4f214a2ee0b1}
81. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID>{3c471948-f874-49f5-b338-4f214a2ee0b1}
82. Still in the left panel, locate and delete the key:
    InprocServer32
83. Again Still in the left panel, locate and delete the key:
    Tips
84. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>entrusted>toolbar
3. In the right panel, locate and delete the entry:
   MarkOldApps = "FALSE"
4. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Conduit>ISM>IE
5. In the right panel, locate and delete the entry:
   _ALIGNMODE_ = "0"
6. Again In the right panel, locate and delete the entry:
   _ALLOW_SILENT_INSTALLATION_ = "TRUE"
7. Again In the right panel, locate and delete the entry:
   _AUTOUPDATE_URL_ = "{random characters}"
8. Again In the right panel, locate and delete the entry:
   _BHO_COMID_ = "{41578b15-ffa2-47f6-8fe1-1f0bf8a3317e}"
9. Again In the right panel, locate and delete the entry:
   _BRANDDLLNAME_ = "tbentr.dll"
10. Again In the right panel, locate and delete the entry:
    _BRANDTOOLBARNAME_ = "entrusted"
11. Again In the right panel, locate and delete the entry:
    _BRANDTOOLBARSETUPFILENAME_ = "entrusted.exe"
12. Again In the right panel, locate and delete the entry:
    _BRANDTOOLBARSPONSORID_ = "CT3281675"
13. Again In the right panel, locate and delete the entry:
    _BRANDTOOLBARTITLE_ = "entrusted Toolbar"
14. Again In the right panel, locate and delete the entry:
    _BUILDER_SERVER_ = "VM2254"
15. Again In the right panel, locate and delete the entry:
    _CFGFILEPATH_ = "{random characters}"
16. Again In the right panel, locate and delete the entry:
    _CHROME25_FIX_ = "FALSE"
17. Again In the right panel, locate and delete the entry:
    _COMID_ = "{e44a1809-4d10-4ab8-b343-3326b64c7cdd}"
18. Again In the right panel, locate and delete the entry:
    _COUNTRY_CODE_ = "US"
19. Again In the right panel, locate and delete the entry:
    _CRE_MODE_ = "1"
20. Again In the right panel, locate and delete the entry:
    _DEFAULT_BROWSER_INSTALLATION_ = "FALSE"
21. Again In the right panel, locate and delete the entry:
    _DISPLAY_TRUSTE_SEAL_ = "TRUE"
22. Again In the right panel, locate and delete the entry:
    _EMAIL_NOTIFY_SHOW_STATE_ = "TRUE"
23. Again In the right panel, locate and delete the entry:
    _ENABLE_ALERTS_ = "True"
24. Again In the right panel, locate and delete the entry:
    _ENABLE_GROUPING_ = "FALSE"
25. Again In the right panel, locate and delete the entry:
    _ENABLE_SEARCH_FROM_ADDRESS_ = "True"
26. Again In the right panel, locate and delete the entry:
    _ENABLE_SEARCH_SUGGEST_FROM_ADDRESS_ = "TRUE"
27. Again In the right panel, locate and delete the entry:
    _ENABLE_SEARCH_SUGGEST_FROM_ADDRESS_IE_ = "TRUE"
28. Again In the right panel, locate and delete the entry:
    _ENABLE_SEARCH_SUGGEST_FROM_SEARCH_BOX_ = "TRUE"
29. Again In the right panel, locate and delete the entry:
    _ENVIRONMENT_ = "conduit"
30. Again In the right panel, locate and delete the entry:
    _FF_AUTOUPDATE_URL_ = "{random characters}"
31. Again In the right panel, locate and delete the entry:
    _FINDBAR_COMID_ = "{f45ab5eb-4700-4745-ad30-7592eab1c986}"
32. Again In the right panel, locate and delete the entry:
    _IE_EXE_MODE_ = "1"
33. Again In the right panel, locate and delete the entry:
    _INSTALATIONDIRECTORY_ = "entrusted"
34. Again In the right panel, locate and delete the entry:
    _INSTALL_SP_ = "TRUE"
35. Again In the right panel, locate and delete the entry:
    _INSTALL_TOOLBAR_ = "TRUE"
36. Again In the right panel, locate and delete the entry:
    _IS_MOZILLA_RETENTION_DIALOG_ = "TRUE"
37. Again In the right panel, locate and delete the entry:
    _LINKWRITEUS_ = "anders@opencandy.com"
38. Again In the right panel, locate and delete the entry:
    _MAM_ENABLED_ = "TRUE"
39. Again In the right panel, locate and delete the entry:
    _MULTI_COMMUNITY_ENABLED_ = "FALSE"
40. Again In the right panel, locate and delete the entry:
    _MULTI_UNINSTALLER_ = "FALSE"
41. Again In the right panel, locate and delete the entry:
    _MY_STUFF_ENABLED_ = "TRUE"
42. Again In the right panel, locate and delete the entry:
    _MYWEBSERVERURL_ = "http://entrusted.OurToolbar.com"
43. Again In the right panel, locate and delete the entry:
    _POPUP_SHOW_STATE_ = "FALSE"
44. Again In the right panel, locate and delete the entry:
    _PRODUCT_ID_ = "10"
45. Again In the right panel, locate and delete the entry:
    _RADIO_SHOW_STATE_ = "TRUE"
46. Again In the right panel, locate and delete the entry:
    _REALTOOLBARNAME_ = "entrusted"
47. Again In the right panel, locate and delete the entry:
    _REGMAINKEY_ = "entrusted"
48. Again In the right panel, locate and delete the entry:
    _REGSUBKEY_ = "toolbar"
49. Again In the right panel, locate and delete the entry:
    _SEARCH_FROM_ADDRESS_URL_ = "{random characters}"
50. Again In the right panel, locate and delete the entry:
    _SEARCH_PROVIDER_ = "CUSTOMIZED"
51. Again In the right panel, locate and delete the entry:
    _SEARCH_PROVIDER_ID_ = "2"
52. Again In the right panel, locate and delete the entry:
    _SEARCH_PROVIDER_NAME_ = "Bing"
53. Again In the right panel, locate and delete the entry:
    _SEARCH_REVERT_ = "FALSE"
54. Again In the right panel, locate and delete the entry:
    _SERVER_ = "users.conduit.com"
55. Again In the right panel, locate and delete the entry:
    _SET_DEFAULT_SEARCH_ = "TRUE"
56. Again In the right panel, locate and delete the entry:
    _SETUP_FIX_404_CHK_BOX_VAL_ = "TRUE"
57. Again In the right panel, locate and delete the entry:
    _SETUP_PUBLISHER_LOGO_IMG_PATH_ = "{random characters}"
58. Again In the right panel, locate and delete the entry:
    _SETUP_SHOW_FIX_404_ = "TRUE"
59. Again In the right panel, locate and delete the entry:
    _SETUPICONPATH_ = "{random characters}"
60. Again In the right panel, locate and delete the entry:
    _SETUPPATH_ = "{random characters}"
61. Again In the right panel, locate and delete the entry:
    _SETUPSOURCESPATH_ = "\{BLOCKED}8.17.111\clients\SetupSource\ChromeWebToolbar\10.23.0.822"
62. Again In the right panel, locate and delete the entry:
    _SHOWUNINSTALLPAGE_ = "True"
63. Again In the right panel, locate and delete the entry:
    _SP_CHP_URL_ = "http://www.{BLOCKED}t.com/privacy/search-protect-description.aspx"
64. Again In the right panel, locate and delete the entry:
    _SSO_ID_ = "CB48B495-F878-40EA-AA03-196C985E13C3"
65. Again In the right panel, locate and delete the entry:
    _START_PAGE_ = "TRUE"
66. Again In the right panel, locate and delete the entry:
    _TOOLBAR_API_COMID_ = "{01335480-2aed-4070-aff3-b4c8bc22ff35}"
67. Again In the right panel, locate and delete the entry:
    _TOOLBAR_LANGUAGE_ = "EN"
68. Again In the right panel, locate and delete the entry:
    _TRUSTE_SEAL_URL_ = "http://trust.{BLOCKED}t.com/CT3281675"
69. Again In the right panel, locate and delete the entry:
    _TWITTER_SHOW_STATE_ = "TRUE"
70. Again In the right panel, locate and delete the entry:
    _UM_ = "2"
71. Again In the right panel, locate and delete the entry:
    _UNINSTALL_FROM_ADD_REMOVE_ENABLED_ = "False"
72. Again In the right panel, locate and delete the entry:
    _WEATHER_SHOW_STATE_ = "TRUE"
73. Again In the right panel, locate and delete the entry:
    _WEBSERVERURL_ = "http://entrusted.OurToolbar.com"
74. Again In the right panel, locate and delete the entry:
    _XPE_MODE_ = "1"
75. Again In the right panel, locate and delete the entry:
    TOOLBARNAME = "entrusted"
76. Again In the right panel, locate and delete the entry:
    TimeStamp = "2235d"
77. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>entrusted>toolbar
78. In the right panel, locate and delete the entry:
    GroupingServerURL = "http://grouping.{BLOCKED}es.conduit.com"
79. Again In the right panel, locate and delete the entry:
    SearchServerUrl = "http://search.{BLOCKED}t.com"
80. Again In the right panel, locate and delete the entry:
    Server = "users.conduit.com"
81. Again In the right panel, locate and delete the entry:
    ShouldPerformGroupByOS = "TRUE"
82. Again In the right panel, locate and delete the entry:
    UsageURL = "http://usage.{BLOCKED}s.conduit.com/UsersWebService.asmx/UsersRequests"
83. Again In the right panel, locate and delete the entry:
    WebServerUrl = "http://entrusted.OurToolbar.com"
84. Again In the right panel, locate and delete the entry:
    Write us link = "anders@opencandy.com"
85. Again In the right panel, locate and delete the entry:
    ShouldCheckEnableAlerts = "TRUE"
86. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>entrusted>toolbar>IE5
87. In the right panel, locate and delete the entry:
    CabinetVisible = "FALSE"
88. Again In the right panel, locate and delete the entry:
    ExplorerVisible = "FALSE"
89. Again In the right panel, locate and delete the entry:
    FirstTime = "TRUE"
90. Again In the right panel, locate and delete the entry:
    Visible = "TRUE"
91. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>entrusted>toolbar>Settings
92. In the right panel, locate and delete the entry:
    EnableSearchFromAddress = "true"
93. Again In the right panel, locate and delete the entry:
    SearchFromAddressUrl = "{random characters}"
94. Again In the right panel, locate and delete the entry:
    OpenSetupFinishPage = "FALSE"
95. Again In the right panel, locate and delete the entry:
    ShouldSendReferalCookie = "TRUE"
96. Again In the right panel, locate and delete the entry:
    SaveRevertSettingsData = "false"
97. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>entrusted>toolbar>Settings>FeatureProtector
98. In the right panel, locate and delete the entry:
    NotifyOfSettingsChange = "TRUE"
99. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>entrusted>toolbar>Settings>FeatureProtector>HomePage
100. In the right panel, locate and delete the entry:
     HPProtectCount = "0"
101. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>entrusted>toolbar>Settings>FeatureProtector>BrowserSearch
102. In the right panel, locate and delete the entry:
     DSProtectCount = "0"
103. Again In the right panel, locate and delete the entry:
     SendProtectorDataViaLogin = "TRUE"
104. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Main
105. In the right panel, locate and delete the entry:
     Enable Browser Extensions = "yes"
106. Again In the right panel, locate and delete the entry:
     Use Search Asst = "no"
107. Again In the right panel, locate and delete the entry:
     LoginRequestsNum = "0"
108. Again In the right panel, locate and delete the entry:
     AUTOUPDATE = "1"
109. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>entrusted>toolbar>Settings>MyStuff
110. In the right panel, locate and delete the entry:
     StagingEnable = "TRUE"
111. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>entrusted>toolbar>Monitored
112. In the right panel, locate and delete the entry:
     SHRINK_TOOLBAR = "0"
113. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>entrusted>toolbar>Settings>RadioPlayer
114. In the right panel, locate and delete the entry:
     ShrinkState = "FALSE"
115. Again In the right panel, locate and delete the entry:
     UserMode = "2"
116. Again In the right panel, locate and delete the entry:
     ContextMenuUserMode = "2"
117. Again In the right panel, locate and delete the entry:
     SessionID = "{22809240-35D6-4815-BCE1-7EB1256D2C59}"
118. Again In the right panel, locate and delete the entry:
     UninstallType = "IE"
119. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>entrusted>toolbar>Settings>Search>Settings
120. In the right panel, locate and delete the entry:
     ShowSearchSuggestions = "1"
121. Again In the right panel, locate and delete the entry:
     ComId = "{e44a1809-4d10-4ab8-b343-3326b64c7cdd}"
122. Again In the right panel, locate and delete the entry:
     ToolbarAPIComId = "{01335480-2aed-4070-aff3-b4c8bc22ff35}"
123. Again In the right panel, locate and delete the entry:
     FindBarComId = "{f45ab5eb-4700-4745-ad30-7592eab1c986}"
124. Again In the right panel, locate and delete the entry:
     DisplayName = "entrusted"
125. Again In the right panel, locate and delete the entry:
     DisplayTitle = "entrusted Toolbar"
126. Again In the right panel, locate and delete the entry:
     GroupingEnabled = "FALSE"
127. Again In the right panel, locate and delete the entry:
     InstallationType = "ConduitNSISIntegration"
128. Again In the right panel, locate and delete the entry:
     MultiCommunityEnabled = "FALSE"
129. Again In the right panel, locate and delete the entry:
     Path = "%Program Files%\entrusted"
130. Again In the right panel, locate and delete the entry:
     Server = "users.conduit.com"
131. Again In the right panel, locate and delete the entry:
     ShouldPerformGroupByOS = "TRUE"
132. Again In the right panel, locate and delete the entry:
     ShouldShowPersonalComponentDlg = "false"
133. Again In the right panel, locate and delete the entry:
     SponsorId = "CT3281675"
134. Again In the right panel, locate and delete the entry:
     ToolbarHelperFileName = "%Program Files%\entrusted\entrustedToolbarHelper.exe"
135. Again In the right panel, locate and delete the entry:
     PlatformType = "ConduitToolbarMyStuff"
136. Again In the right panel, locate and delete the entry:
     IsEngineHost = "FALSE"
137. Again In the right panel, locate and delete the entry:
     AllowToUninstallFromEngine = "FALSE"
138. Again In the right panel, locate and delete the entry:
     ToolbarDllName = "tbentr.dll"
139. Again In the right panel, locate and delete the entry:
     LoaderDllName = "ldrtbentr.dll"
140. Again In the right panel, locate and delete the entry:
     HookDllName = "hktbentr.dll"
141. Again In the right panel, locate and delete the entry:
     Hook64DllName = "hk64tbentr.dll"
142. Again In the right panel, locate and delete the entry:
     AutoUpdateHelperPath = "%Application Data%\Conduit\CT3281675\entrustedAutoUpdateHelper.exe"
143. Again In the right panel, locate and delete the entry:
     AllowUntrustedApps = "FALSE"
144. Again In the right panel, locate and delete the entry:
     ProtectHomePage = "true"
145. Again In the right panel, locate and delete the entry:
     ProtectBrowserSearch = "true"
146. Again In the right panel, locate and delete the entry:
     PublisherProtectHomePage = "true"
147. Again In the right panel, locate and delete the entry:
     PublisherProtectBrowserSearch = "true"
148. Again In the right panel, locate and delete the entry:
     IsConduitAppsToolbar = "FALSE"
149. Again In the right panel, locate and delete the entry:
     ImportMyStuffApps = "FALSE"
150. Again In the right panel, locate and delete the entry:
     EnableAlertsFromInstallation = "true"
151. Again In the right panel, locate and delete the entry:
     NavigateToUrlOnSearch = "FALSE"
152. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Conduit>InstallationGlobalKeys
153. In the right panel, locate and delete the entry:
     CT3281675 = "{mam_gk_installer_preapproved:0}"
154. Again In the right panel, locate and delete the entry:
     ShouldSendToolbarAge = "TRUE"
155. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>entrusted>Communicator
156. In the right panel, locate and delete the entry:
     Url = "http://servicemap.{BLOCKED}t-services.com/Toolbar/?ownerId
157. Again In the right panel, locate and delete the entry:
     UsageUrl = "http://usage.{BLOCKED}r.conduit-services.com/ToolbarUsage.ashx"
158. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Conduit>Platforms>{e44a1809-4d10-4ab8-b343-3326b64c7cdd}
159. In the right panel, locate and delete the entry:
     Name = "entrusted"
160. Again In the right panel, locate and delete the entry:
     ForceEngineUninstall = "TRUE"
161. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Toolbar
162. In the right panel, locate and delete the entry:
     {e44a1809-4d10-4ab8-b343-3326b64c7cdd} = "entrusted Toolbar"
163. Again In the right panel, locate and delete the entry:
     SocialDomains = "http://apps.conduit.com; http://social.conduit.com"
164. Again In the right panel, locate and delete the entry:
     BrowserSearchURL = "{random characters}"
165. Again In the right panel, locate and delete the entry:
     BrowserSearchDisplayName = "entrusted Customized Web Search"
166. Again In the right panel, locate and delete the entry:
     BrowserSuggestionsURL = "{random characters}"
167. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>SearchScopes>{afdbddaa-5d3f-42ee-b79c-185a7020515b}
168. In the right panel, locate and delete the entry:
     DisplayName = "entrusted Customized Web Search"
169. Again In the right panel, locate and delete the entry:
     URL = "{random characters}"
170. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>SearchScopes
171. In the right panel, locate and delete the entry:
     DefaultScope = "{afdbddaa-5d3f-42ee-b79c-185a7020515b}"
172. Again In the right panel, locate and delete the entry:
     DSInstall = "TRUE"
173. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Conduit>HomePage
174. In the right panel, locate and delete the entry:
     {e44a1809-4d10-4ab8-b343-3326b64c7cdd} = "{random characters}"
175. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Conduit>RevertSettings
176. In the right panel, locate and delete the entry:
     ConduitLatestHomePage = "{random characters}"
177. Again In the right panel, locate and delete the entry:
     HPInstall = "TRUE"
178. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>IECT3281675
179. In the right panel, locate and delete the entry:
     DisplayName = "entrusted Toolbar for IE"
180. Again In the right panel, locate and delete the entry:
     DisplayVersion = "6.17.2.8"
181. Again In the right panel, locate and delete the entry:
     HelpLink = "http://entrusted.OurToolbar.com/help"
182. Again In the right panel, locate and delete the entry:
     Publisher = "entrusted"
183. Again In the right panel, locate and delete the entry:
     URLInfoAbout = "http://entrusted.OurToolbar.com"
184. Again In the right panel, locate and delete the entry:
     DisplayIcon = "%User Profile%\CT3281675\SetupIcon.ico"
185. Again In the right panel, locate and delete the entry:
     EstimatedSize = "294"
186. Again In the right panel, locate and delete the entry:
     UninstallString = "{random characters}"
187. Again In the right panel, locate and delete the entry:
     LoaderDllName = "ldrtbentr.dll"
188. Again In the right panel, locate and delete the entry:
     ToolbarDllName = "tbentr.dll"
189. Again In the right panel, locate and delete the entry:
     HookDllName = "hktbentr.dll"
190. Again In the right panel, locate and delete the entry:
     Hook64DllName = "hk64tbentr.dll"
191. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Conduit>IE>Hook
192. In the right panel, locate and delete the entry:
     ActiveHookToolbarName = "entrusted"
193. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Conduit>IE>Hook>entrusted
194. In the right panel, locate and delete the entry:
     HookDllPath = "%Application Data%\entrusted"
195. Again In the right panel, locate and delete the entry:
     HookDllVersion = "6.17.2.8"
196. Again In the right panel, locate and delete the entry:
     HookDllName = "hktbentr.dll"
197. Again In the right panel, locate and delete the entry:
     Hook64DllName = "hk64tbentr.dll"
198. Again In the right panel, locate and delete the entry:
     ProxyDllPath = "%Program Files%\entrusted\prxtbentr.dll"
199. Again In the right panel, locate and delete the entry:
     DisplayName = "entrusted"
200. Again In the right panel, locate and delete the entry:
     ToolbarInstallTime = "52ab3f61"
201. Again In the right panel, locate and delete the entry:
     version = "6.17.2.8"
202. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{E44A1809-4D10-4AB8-B343-3326B64C7CDD}>InprocServer32
203. In the right panel, locate and delete the entry:
     ThreadingModel = "Apartment"
204. Again In the right panel, locate and delete the entry:
     {E44A1809-4D10-4AB8-B343-3326B64C7CDD} = "entrusted Toolbar"
205. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Smartbar
206. In the right panel, locate and delete the entry:
     GlobalUserId = "9F7CC2C6-93F9-4DBE-8E4E-7D095A3E7E24"
207. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Conduit>Toolbars
208. In the right panel, locate and delete the entry:
     entrusted Toolbar = "{E44A1809-4D10-4AB8-B343-3326B64C7CDD}"
209. Again In the right panel, locate and delete the entry:
     ToolbarRunFirstTimeAfterInstall = "TRUE"
210. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>entrusted>toolbar>Repository>conduit_CT3281675>Coordinator
211. In the right panel, locate and delete the entry:
     ResetServiceMap = "1"
212. Again In the right panel, locate and delete the entry:
     VistaElevationComId = "{F9389F6B-8DDF-45D1-9743-FE6264ABEB65}"
213. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Low Rights>ElevationPolicy>{F9389F6B-8DDF-45D1-9743-FE6264ABEB65}
214. In the right panel, locate and delete the entry:
     AppPath = "%Program Files%\entrusted"
215. Again In the right panel, locate and delete the entry:
     AppName = "entrustedToolbarHelper.exe"
216. Again In the right panel, locate and delete the entry:
     Policy = "3"
217. Again In the right panel, locate and delete the entry:
     AutoupdateElevationComId = "{CCA4E328-8C78-4D90-866E-6DC3C9C17CE7}"
218. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Low Rights>ElevationPolicy>{CCA4E328-8C78-4D90-866E-6DC3C9C17CE7}
219. In the right panel, locate and delete the entry:
     AppPath = "%Application Data%\Conduit\CT3281675"
220. Again In the right panel, locate and delete the entry:
     AppName = "entrustedAutoUpdateHelper.exe"
221. Again In the right panel, locate and delete the entry:
     Policy = "3"
222. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{01335480-2AED-4070-AFF3-B4C8BC22FF35}>InprocServer32
223. In the right panel, locate and delete the entry:
     ThreadingModel = "Apartment"
224. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Conduit>Platforms>{01335480-2aed-4070-aff3-b4c8bc22ff35}
225. In the right panel, locate and delete the entry:
     HostID = "{e44a1809-4d10-4ab8-b343-3326b64c7cdd}"
226. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Browser Helper Objects>{e44a1809-4d10-4ab8-b343-3326b64c7cdd}
227. In the right panel, locate and delete the entry:
     NoExplorer = "1"
228. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Toolbar>RegisteredSources
229. In the right panel, locate and delete the entry:
     CT3281675 = "0"
230. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>Control>Session Manager
231. In the right panel, locate and delete the entry:
     PendingFileRenameOperations = "\??\%User Temp%\nsn3.tmp\nsisdl.dll"
232. Again In the right panel, locate and delete the entry:
     ToolbarHeight = "1c"
233. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{F45AB5EB-4700-4745-AD30-7592EAB1C986}>InprocServer32
234. In the right panel, locate and delete the entry:
     ThreadingModel = "Apartment"
235. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Conduit>Platforms>{f45ab5eb-4700-4745-ad30-7592eab1c986}
236. In the right panel, locate and delete the entry:
     HostID = "{e44a1809-4d10-4ab8-b343-3326b64c7cdd}"
237. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>entrusted>toolbar>Settings>BackHandStorage>GlobalKeys
238. In the right panel, locate and delete the entry:
     mam_gk_installer_preapproved = "{random values}"
239. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Conduit>Community Alerts>Settings
240. In the right panel, locate and delete the entry:
     AutoUpdateEnabled = "TRUE"
241. Again In the right panel, locate and delete the entry:
     ALPClientsServerName = "http://alert.{BLOCKED}t.conduit.com"
242. Again In the right panel, locate and delete the entry:
     ALPServicesServerName = "http://alert.{BLOCKED}es.conduit.com"
243. Again In the right panel, locate and delete the entry:
     ShowAlerts = "true"
244. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Conduit>Community Alerts
245. In the right panel, locate and delete the entry:
     Path = "%Program Files%\Conduit\Community Alerts\Alert.dll"
246. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{3c471948-f874-49f5-b338-4f214a2ee0b1}>InprocServer32
247. In the right panel, locate and delete the entry:
     ThreadingModel = "Apartment"
248. Again In the right panel, locate and delete the entry:
     UserID = "238740DB-7F8F-4E32-8BB4-F75DBF2A7004"
249. Again In the right panel, locate and delete the entry:
     FirstTimeMessageDisplayed = "FALSE"
250. Again In the right panel, locate and delete the entry:
     SampleAlertWasShown = "FALSE"
251. Again In the right panel, locate and delete the entry:
     LoginMessageLastCheckTime = "0"
252. Again In the right panel, locate and delete the entry:
     LoginMessageLastUpdateTime = "0"
253. Again In the right panel, locate and delete the entry:
     OpenUninstallPage = "true"
254. Again In the right panel, locate and delete the entry:
     MultiCommunityEnabled = "FALSE"
255. Again In the right panel, locate and delete the entry:
     MultiCommunityEnabled = "FALSE"
256. Again In the right panel, locate and delete the entry:
     GroupingEnabled = "FALSE"
257. Again In the right panel, locate and delete the entry:
     GroupingEnabled = "FALSE"
258. Again In the right panel, locate and delete the entry:
     MultiCommunityID = "CT3281675"
259. Again In the right panel, locate and delete the entry:
     UserID = "UN40667011881295725"
260. Again In the right panel, locate and delete the entry:
     UserID = "UN40667011881295725"
261. Again In the right panel, locate and delete the entry:
     MachineID = "SB_E0VDZWGTSPEIPGHO6ECYLKWRJ2E"
262. Again In the right panel, locate and delete the entry:
     SendUsageReport = "TRUE"
263. Again In the right panel, locate and delete the entry:
     LastRequestTime = "52ab3f6b"
264. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>2796BAE63F1801E277261BA0D77770028F20EEE4
265. In the right panel, locate and delete the entry:
     Blob = "{random values}"
266. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>entrusted>toolbar>Settings>Tips
267. In the right panel, locate and delete the entry:
     UsageIndication = "1"
268. Close Registry Editor.

To restore registry values this malware/grayware modified:

1. Open Registry Editor. To do this:
   
   • On Windows 2000, XP, and Server 2003:
     Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
   • On Windows Vista and 7:
     Click the Start button, type REGEDIT in the Search input field then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Main
3. In the right panel, locate the registry value:
   Start Page = "{random characters}"
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   Start Page = "http://www.microsoft.com/isapi/redir.dll?prd
5. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4EFCED9C6BDD0C985CA3C7D253063C5BE6FC620C
6. In the right panel, locate the registry value:
   Blob = "{random values}"
7. Right-click on the value name and choose Modify. Change the value data of this entry to:
   Blob = "{random values}"
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4EF2E6670AC9B5091FE06BE0E5483EAAD6BA32D9
9. In the right panel, locate the registry value:
   Blob = "{random values}"
10. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4C95A9902ABE0777CED18D6ACCC3372D2748381E
12. In the right panel, locate the registry value:
    Blob = "{random values}"
13. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4BA7B9DDD68788E12FF852E1A024204BF286A8F6
15. In the right panel, locate the registry value:
    Blob = "{random values}"
16. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4B421F7515F6AE8A6ECEF97F6982A400A4D9224E
18. In the right panel, locate the registry value:
    Blob = "{random values}"
19. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>47AFB915CDA26D82467B97FA42914468726138DD
21. In the right panel, locate the registry value:
    Blob = "{random values}"
22. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
23. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4463C531D7CCC1006794612BB656D3BF8257846F
24. In the right panel, locate the registry value:
    Blob = "{random values}"
25. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
26. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>43F9B110D5BAFD48225231B0D0082B372FEF9A54
27. In the right panel, locate the registry value:
    Blob = "{random values}"
28. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
29. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>43DDB1FFF3B49B73831407F6BC8B975023D07C50
30. In the right panel, locate the registry value:
    Blob = "{random values}"
31. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>40E78C1D523D1CD9954FAC1A1AB3BD3CBAA15BFC
33. In the right panel, locate the registry value:
    Blob = "{random values}"
34. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
35. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4072BA31FEC351438480F62E6CB95508461EAB2F
36. In the right panel, locate the registry value:
    Blob = "{random values}"
37. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
38. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>3F85F2BB4A62B0B58BE1614ABB0D4631B4BEF8BA
39. In the right panel, locate the registry value:
    Blob = "{random values}"
40. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
41. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>394FF6850B06BE52E51856CC10E180E882B385CC
42. In the right panel, locate the registry value:
    Blob = "{random values}"
43. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>36863563FD5128C7BEA6F005CFE9B43668086CCE
45. In the right panel, locate the registry value:
    Blob = "{random values}"
46. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
47. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6
48. In the right panel, locate the registry value:
    Blob = "{random values}"
49. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
50. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>2F173F7DE99667AFA57AF80AA2D1B12FAC830338
51. In the right panel, locate the registry value:
    Blob = "{random values}"
52. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
53. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>284F55C41A1A7A3F8328D4C262FB376ED6096F24
54. In the right panel, locate the registry value:
    Blob = "{random values}"
55. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
56. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>273EE12457FDC4F90C55E82B56167F62F532E547
57. In the right panel, locate the registry value:
    Blob = "{random values}"
58. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
59. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>24BA6D6C8A5B5837A48DB5FAE919EA675C94D217
60. In the right panel, locate the registry value:
    Blob = "{random values}"
61. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
62. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>24A40A1F573643A67F0A4B0749F6A22BF28ABB6B
63. In the right panel, locate the registry value:
    Blob = "{random values}"
64. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
65. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>23E594945195F2414803B4D564D2A3A3F5D88B8C
66. In the right panel, locate the registry value:
    Blob = "{random values}"
67. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
68. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>216B2A29E62A00CE820146D8244141B92511B279
69. In the right panel, locate the registry value:
    Blob = "{random values}"
70. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
71. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>209900B63D955728140CD13622D8C687A4EB0085
72. In the right panel, locate the registry value:
    Blob = "{random values}"
73. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
74. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>1F55E8839BAC30728BE7108EDE7B0BB0D3298224
75. In the right panel, locate the registry value:
    Blob = "{random values}"
76. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
77. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>1331F48A5DA8E01DAACA1BB0C17044ACFEF755BB
78. In the right panel, locate the registry value:
    Blob = "{random values}"
79. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
80. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>0B77BEBBCB7AA24705DECC0FBD6A02FC7ABD9B52
81. In the right panel, locate the registry value:
    Blob = "{random values}"
82. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
83. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>049811056AFE9FD0F5BE01685AACE6A5D1C4454C
84. In the right panel, locate the registry value:
    Blob = "{random values}"
85. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
86. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>0483ED3399AC3608058722EDBC5E4600E3BEF9D7
87. In the right panel, locate the registry value:
    Blob = "{random values}"
88. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
89. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>00EA522C8A9C06AA3ECCE0B4FA6CDC21D92E8099
90. In the right panel, locate the registry value:
    Blob = "{random values}"
91. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
92. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>0048F8D37B153F6EA2798C323EF4F318A5624A9E
93. In the right panel, locate the registry value:
    Blob = "{random values}"
94. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
95. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %User Temp%\nsn3.tmp\button.bmp
   • %User Temp%\nsn3.tmp\System.dll
   • %User Temp%\nsn3.tmp\OCSetupHlp.dll
   • %User Temp%\nsn3.tmp\skinnedbutton.dll
   • %User Temp%\nsn3.tmp\nsDialogs.dll
   • %User Temp%\nsn3.tmp\nsisdl.dll
   • %User Temp%\rmi/download-install_flash_player.exe
   • %User Temp%\nsn3.tmp\statistic.dll
   • %User Profile%\BB23B09C45224A2B959897BFAD6D4DB2\B8DCC36F-4F05-445F-B1EE-FD8FC38CBBDA
   • %User Profile%\BB23B09C45224A2B959897BFAD6D4DB2\47A647BD-4905-48C7-9539-A95F199019A4
   • %User Profile%\BB23B09C45224A2B959897BFAD6D4DB2\5254.ico
   • %User Profile%\BB23B09C45224A2B959897BFAD6D4DB2\RAWinstaller.exe
   • %User Temp%\nsd2D.tmp\System.dll
   • %User Profile%\BB23B09C45224A2B959897BFAD6D4DB2\mconduitinstaller.exe
   • %User Temp%\nsd2D.tmp\inetc.dll
   • %User Temp%\nss110.tmp
   • %User Temp%\nsh34.tmp\InetC.dll
   • /END
   • %User Temp%\ct3281675\stub.exe
   • %User Temp%\nsh34.tmp\nsExec.dll
   • %User Temp%\nsl46.tmp\System.dll
   • %User Temp%\nsl46.tmp\inetc.dll
   • %User Temp%\nsl46.tmp\t.txt
   • %User Temp%\nsf50.tmp
   • %User Temp%\ct3281675\ctbe.exe
   • %User Temp%\nsl46.tmp\nsExec.dll
   • %User Temp%\ct3281675\ieLogic.exe
   • %User Temp%\ct3281675\statisticsStub.exe
   • %User Temp%\nsg5D.tmp\inetc.dll
   • %User Temp%\ct3281675\setup.ini.txt
   • %User Temp%\nsa6B.tmp\inetc.dll
   • %User Temp%\ct3281675\chromeid.txt
   • %User Temp%\nsi88.tmp
   • %User Temp%\nsn8A.tmp\PublisherLogoDefault.bmp
   • %User Temp%\nsn8A.tmp\setup_top.bmp
   • %User Temp%\nsn8A.tmp\alerts_icon.bmp
   • %User Temp%\nsn8A.tmp\truste_setup.bmp
   • %User Temp%\nsn8A.tmp\search_icon.bmp
   • %User Temp%\nsn8A.tmp\home_icon.bmp
   • %User Temp%\nsn8A.tmp\revert_icon.bmp
   • %User Temp%\nsn8A.tmp\nsUtils.dll
   • %User Temp%\nsl95.tmp.tbentr.dll
   • %User Temp%\toolbar.cfg
   • %User Temp%\nsn8A.tmp\System.dll
   • %User Temp%\nsn8A.tmp\license.txt
   • %Program Files%\entrusted\toolbar.cfg
   • %Program Files%\entrusted\entrustedToolbarHelper.exe
   • %Application Data%\Conduit\CT3281675\entrustedAutoUpdateHelper.exe
   • %Program Files%\entrusted\tbentr.dll
   • %Program Files%\entrusted\prxtbentr.dll
   • %Program Files%\entrusted\ldrtbentr.dll
   • %Program Files%\entrusted\hktbentr.dll
   • %Program Files%\entrusted\hk64tbentr.dll
   • %Program Files%\entrusted\GottenAppsContextMenu.xml
   • %Program Files%\entrusted\OtherAppsContextMenu.xml
   • %Program Files%\entrusted\SharedAppsContextMenu.xml
   • %Program Files%\entrusted\ToolbarContextMenu.xml
   • %User Profile%\CT3281675\UninstallerUI.exe
   • %User Profile%\CT3281675\SetupIcon.ico
   • %Program Files%\Conduit\Community Alerts\Alert.dll
   • %User Profile%\CT3281675\configutaion.json
   • %User Temp%\nsn8A.tmp\nsJSON_2_0_1_1.dll
   • %User Temp%\SPStub.exe
   • %User Temp%\nsaCA.tmp\inetc.dll
   • %User Profile%\Res\SPSetup.exe
   • %User Profile%\MetaData\2BF68F4714092295550497DD56F57004
   • %User Profile%\Content\2BF68F4714092295550497DD56F57004
   • %User Profile%\MetaData\94308059B57B3142E455B38A6EB92015
   • %User Profile%\Content\94308059B57B3142E455B38A6EB92015
   • %User Temp%\CabDD.tmp
   • %User Temp%\TarDF.tmp
   • %User Temp%\nsf106.tmp\InetC.dll
   • 1
   • %User Temp%\nsh34.tmp\ns41.tmp
   • %User Temp%\nsl46.tmp\ns58.tmp
   • %User Temp%\nsl46.tmp\ns66.tmp
   • %User Temp%\nsl46.tmp\ns74.tmp
   • %User Temp%\nsl46.tmp\ns83.tmp
   • %User Temp%\nsl46.tmp\nsE9.tmp
   • %User Temp%\nsl46.tmp\nsF0.tmp
   • %User Temp%\nsl46.tmp\nsF7.tmp
   • %User Temp%\nsl46.tmp\ns101.tmp
   • %Application Data%\entrusted\ldrtbentr.dll
   • %Application Data%\entrusted\tbentr.dll
   • %Application Data%\entrusted\hktbentr.dll
   • %Application Data%\entrusted\hk64tbentr.dll
   • %Application Data%\entrusted\toolbar.cfg
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %User Temp%\nsn3.tmp\button.bmp
   • %User Temp%\nsn3.tmp\System.dll
   • %User Temp%\nsn3.tmp\OCSetupHlp.dll
   • %User Temp%\nsn3.tmp\skinnedbutton.dll
   • %User Temp%\nsn3.tmp\nsDialogs.dll
   • %User Temp%\nsn3.tmp\nsisdl.dll
   • %User Temp%\rmi/download-install_flash_player.exe
   • %User Temp%\nsn3.tmp\statistic.dll
   • %User Profile%\BB23B09C45224A2B959897BFAD6D4DB2\B8DCC36F-4F05-445F-B1EE-FD8FC38CBBDA
   • %User Profile%\BB23B09C45224A2B959897BFAD6D4DB2\47A647BD-4905-48C7-9539-A95F199019A4
   • %User Profile%\BB23B09C45224A2B959897BFAD6D4DB2\5254.ico
   • %User Profile%\BB23B09C45224A2B959897BFAD6D4DB2\RAWinstaller.exe
   • %User Temp%\nsd2D.tmp\System.dll
   • %User Profile%\BB23B09C45224A2B959897BFAD6D4DB2\mconduitinstaller.exe
   • %User Temp%\nsd2D.tmp\inetc.dll
   • %User Temp%\nss110.tmp
   • %User Temp%\nsh34.tmp\InetC.dll
   • /END
   • %User Temp%\ct3281675\stub.exe
   • %User Temp%\nsh34.tmp\nsExec.dll
   • %User Temp%\nsl46.tmp\System.dll
   • %User Temp%\nsl46.tmp\inetc.dll
   • %User Temp%\nsl46.tmp\t.txt
   • %User Temp%\nsf50.tmp
   • %User Temp%\ct3281675\ctbe.exe
   • %User Temp%\nsl46.tmp\nsExec.dll
   • %User Temp%\ct3281675\ieLogic.exe
   • %User Temp%\ct3281675\statisticsStub.exe
   • %User Temp%\nsg5D.tmp\inetc.dll
   • %User Temp%\ct3281675\setup.ini.txt
   • %User Temp%\nsa6B.tmp\inetc.dll
   • %User Temp%\ct3281675\chromeid.txt
   • %User Temp%\nsi88.tmp
   • %User Temp%\nsn8A.tmp\PublisherLogoDefault.bmp
   • %User Temp%\nsn8A.tmp\setup_top.bmp
   • %User Temp%\nsn8A.tmp\alerts_icon.bmp
   • %User Temp%\nsn8A.tmp\truste_setup.bmp
   • %User Temp%\nsn8A.tmp\search_icon.bmp
   • %User Temp%\nsn8A.tmp\home_icon.bmp
   • %User Temp%\nsn8A.tmp\revert_icon.bmp
   • %User Temp%\nsn8A.tmp\nsUtils.dll
   • %User Temp%\nsl95.tmp.tbentr.dll
   • %User Temp%\toolbar.cfg
   • %User Temp%\nsn8A.tmp\System.dll
   • %User Temp%\nsn8A.tmp\license.txt
   • %Program Files%\entrusted\toolbar.cfg
   • %Program Files%\entrusted\entrustedToolbarHelper.exe
   • %Application Data%\Conduit\CT3281675\entrustedAutoUpdateHelper.exe
   • %Program Files%\entrusted\tbentr.dll
   • %Program Files%\entrusted\prxtbentr.dll
   • %Program Files%\entrusted\ldrtbentr.dll
   • %Program Files%\entrusted\hktbentr.dll
   • %Program Files%\entrusted\hk64tbentr.dll
   • %Program Files%\entrusted\GottenAppsContextMenu.xml
   • %Program Files%\entrusted\OtherAppsContextMenu.xml
   • %Program Files%\entrusted\SharedAppsContextMenu.xml
   • %Program Files%\entrusted\ToolbarContextMenu.xml
   • %User Profile%\CT3281675\UninstallerUI.exe
   • %User Profile%\CT3281675\SetupIcon.ico
   • %Program Files%\Conduit\Community Alerts\Alert.dll
   • %User Profile%\CT3281675\configutaion.json
   • %User Temp%\nsn8A.tmp\nsJSON_2_0_1_1.dll
   • %User Temp%\SPStub.exe
   • %User Temp%\nsaCA.tmp\inetc.dll
   • %User Profile%\Res\SPSetup.exe
   • %User Profile%\MetaData\2BF68F4714092295550497DD56F57004
   • %User Profile%\Content\2BF68F4714092295550497DD56F57004
   • %User Profile%\MetaData\94308059B57B3142E455B38A6EB92015
   • %User Profile%\Content\94308059B57B3142E455B38A6EB92015
   • %User Temp%\CabDD.tmp
   • %User Temp%\TarDF.tmp
   • %User Temp%\nsf106.tmp\InetC.dll
   • 1
   • %User Temp%\nsh34.tmp\ns41.tmp
   • %User Temp%\nsl46.tmp\ns58.tmp
   • %User Temp%\nsl46.tmp\ns66.tmp
   • %User Temp%\nsl46.tmp\ns74.tmp
   • %User Temp%\nsl46.tmp\ns83.tmp
   • %User Temp%\nsl46.tmp\nsE9.tmp
   • %User Temp%\nsl46.tmp\nsF0.tmp
   • %User Temp%\nsl46.tmp\nsF7.tmp
   • %User Temp%\nsl46.tmp\ns101.tmp
   • %Application Data%\entrusted\ldrtbentr.dll
   • %Application Data%\entrusted\tbentr.dll
   • %Application Data%\entrusted\hktbentr.dll
   • %Application Data%\entrusted\hk64tbentr.dll
   • %Application Data%\entrusted\toolbar.cfg
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\Wilbert
   • %User Profile%\LOCALS~1
   • %User Temp%\nsn3.tmp
   • %User Temp%\rmi
   • %User Profile%\Application Data\OpenCandy
   • %User Profile%\OpenCandy\BB23B09C45224A2B959897BFAD6D4DB2
   • %System Root%\Documents and Settings\Wilbert
   • %User Temp%\nsd2D.tmp
   • %User Temp%\nsh34.tmp
   • %User Temp%\ct3281675
   • %User Temp%\nsl46.tmp
   • %User Temp%\nsg5D.tmp
   • %User Temp%\nsa6B.tmp
   • %User Temp%\nsn8A.tmp
   • %Program Files%\entrusted
   • %Application Data%\Conduit
   • %Application Data%\Conduit\CT3281675
   • %User Profile%\Application Data\Conduit
   • %User Profile%\Conduit\IE
   • %User Profile%\IE\CT3281675
   • %User Profile%\Conduit\Multi
   • %User Profile%\Multi\CT3281675
   • %Program Files%\Conduit
   • %Program Files%\Conduit\Community Alerts
   • %User Temp%\nsaCA.tmp
   • %User Profile%\Application Data\SearchProtect
   • %User Profile%\SearchProtect\Res
   • %User Profile%\CryptnetUrlCache\MetaData
   • %User Profile%\Microsoft\CryptnetUrlCache
   • %User Profile%\CryptnetUrlCache\Content
   • %User Temp%\nsf106.tmp
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\Wilbert
   • %User Profile%\LOCALS~1
   • %User Temp%\nsn3.tmp
   • %User Temp%\rmi
   • %User Profile%\Application Data\OpenCandy
   • %User Profile%\OpenCandy\BB23B09C45224A2B959897BFAD6D4DB2
   • %System Root%\Documents and Settings\Wilbert
   • %User Temp%\nsd2D.tmp
   • %User Temp%\nsh34.tmp
   • %User Temp%\ct3281675
   • %User Temp%\nsl46.tmp
   • %User Temp%\nsg5D.tmp
   • %User Temp%\nsa6B.tmp
   • %User Temp%\nsn8A.tmp
   • %Program Files%\entrusted
   • %Application Data%\Conduit
   • %Application Data%\Conduit\CT3281675
   • %User Profile%\Application Data\Conduit
   • %User Profile%\Conduit\IE
   • %User Profile%\IE\CT3281675
   • %User Profile%\Conduit\Multi
   • %User Profile%\Multi\CT3281675
   • %Program Files%\Conduit
   • %Program Files%\Conduit\Community Alerts
   • %User Temp%\nsaCA.tmp
   • %User Profile%\Application Data\SearchProtect
   • %User Profile%\SearchProtect\Res
   • %User Profile%\CryptnetUrlCache\MetaData
   • %User Profile%\Microsoft\CryptnetUrlCache
   • %User Profile%\CryptnetUrlCache\Content
   • %User Temp%\nsf106.tmp