ADW_INSTALLMONSTER

To delete the registry key this malware/grayware created:

1. Open Registry Editor.
   » For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run, type regedit in the text box provided, and then press Enter.
   » For Windows Vista, Windows 7, and Windows Server 2008 users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, and Windows Server 2012 users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_CLASSES_ROOT>CLSID
3. Still in the left panel, locate and delete the key:
   {C379EAD1-CB34-4B09-AF6B-7E587F8BCD80}
4. In the left panel, double-click the following:
   HKEY_CLASSES_ROOT>CLSID>{C379EAD1-CB34-4B09-AF6B-7E587F8BCD80}
5. Still in the left panel, locate and delete the key:
   LocalServer32
6. In the left panel, double-click the following:
   hkey_classes_root
7. Still in the left panel, locate and delete the key:
   {malware file name}.dynamicns
8. In the left panel, double-click the following:
   hkey_classes_root>{malware file name}.dynamicns
9. Still in the left panel, locate and delete the key:
   clsid
10. Again Still in the left panel, locate and delete the key:
    ProgID
11. In the left panel, double-click the following:
    hkey_local_machine>software>microsoft>esent>process
12. Still in the left panel, locate and delete the key:
    {malware file name}
13. In the left panel, double-click the following:
    hkey_local_machine>software>microsoft>esent>process>{malware file name}
14. Still in the left panel, locate and delete the key:
    debug
15. Close Registry Editor.

To restore registry values this malware/grayware modified:

1. Open Registry Editor. To do this:
   
   • On Windows 2000, XP, and Server 2003:
     Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
   • On Windows Vista, 7, and Server 2008:
     Click the Start button, type REGEDIT in the Search input field then press Enter.
   • On Windows 8, 8.1, and Server 2012:
     Right-click on the lower left corner of the screen and click Run, type REGEDIT in the Run input field, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>Services>Eventlog>Application>ESENT
3. In the right panel, locate the registry value:
   EventMessageFile = "%System%\ESENT.dll"
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   EventMessageFile = "{random values}"
5. Again In the right panel, locate the registry value:
   CategoryMessageFile = "%System%\ESENT.dll"
6. Right-click on the value name and choose Modify. Change the value data of this entry to:
   CategoryMessageFile = "{random values}"
7. Again In the right panel, locate the registry value:
   CategoryCount = "1"
8. Right-click on the value name and choose Modify. Change the value data of this entry to:
   CategoryCount = "10"
9. Again In the right panel, locate the registry value:
   TypesSupported = "7"
10. Right-click on the value name and choose Modify. Change the value data of this entry to:
    TypesSupported = "7"
11. Close Registry Editor.