TROJ_DLOADER.MPL

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CLASSES_ROOT
3. Still in the left panel, locate and delete the key:
   SoduiSearch.DataCenter.1
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>SoduiSearch.DataCenter.1
5. Still in the left panel, locate and delete the key:
   CLSID
6. Again Still in the left panel, locate and delete the key:
   SoduiSearch.DataCenter
7. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>SoduiSearch.DataCenter
8. Still in the left panel, locate and delete the key:
   CLSID
9. Again Still in the left panel, locate and delete the key:
   CurVer
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
11. Still in the left panel, locate and delete the key:
    {35EC0410-555E-4402-B372-D9A6E0BF6795}
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{35EC0410-555E-4402-B372-D9A6E0BF6795}
13. Still in the left panel, locate and delete the key:
    ProgID
14. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
15. Again Still in the left panel, locate and delete the key:
    Programmable
16. Again Still in the left panel, locate and delete the key:
    InprocServer32
17. Again Still in the left panel, locate and delete the key:
    TypeLib
18. Again Still in the left panel, locate and delete the key:
    SoduiSearch.Sodui.1
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>SoduiSearch.Sodui.1
20. Still in the left panel, locate and delete the key:
    CLSID
21. Again Still in the left panel, locate and delete the key:
    SoduiSearch.Sodui
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>SoduiSearch.Sodui
23. Still in the left panel, locate and delete the key:
    CLSID
24. Again Still in the left panel, locate and delete the key:
    CurVer
25. Again Still in the left panel, locate and delete the key:
    {43E40178-0298-4789-B74C-388340A3BE6B}
26. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{43E40178-0298-4789-B74C-388340A3BE6B}
27. Still in the left panel, locate and delete the key:
    ProgID
28. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
29. Again Still in the left panel, locate and delete the key:
    Programmable
30. Again Still in the left panel, locate and delete the key:
    InprocServer32
31. Again Still in the left panel, locate and delete the key:
    TypeLib
32. Again Still in the left panel, locate and delete the key:
    SoduiSearch.SoduiContainer.1
33. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>SoduiSearch.SoduiContainer.1
34. Still in the left panel, locate and delete the key:
    CLSID
35. Again Still in the left panel, locate and delete the key:
    SoduiSearch.SoduiContainer
36. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>SoduiSearch.SoduiContainer
37. Still in the left panel, locate and delete the key:
    CLSID
38. Again Still in the left panel, locate and delete the key:
    CurVer
39. Again Still in the left panel, locate and delete the key:
    {F57F0570-4EEB-4AF5-930D-97A35796AE82}
40. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{F57F0570-4EEB-4AF5-930D-97A35796AE82}
41. Still in the left panel, locate and delete the key:
    ProgID
42. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
43. Again Still in the left panel, locate and delete the key:
    Programmable
44. Again Still in the left panel, locate and delete the key:
    InprocServer32
45. Again Still in the left panel, locate and delete the key:
    TypeLib
46. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
47. Still in the left panel, locate and delete the key:
    {AF63FF93-7AD3-48F3-A06A-13EBF3C4DDDE}
48. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{AF63FF93-7AD3-48F3-A06A-13EBF3C4DDDE}
49. Still in the left panel, locate and delete the key:
    1.0
50. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{AF63FF93-7AD3-48F3-A06A-13EBF3C4DDDE}>1.0
51. Still in the left panel, locate and delete the key:
    FLAGS
52. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{AF63FF93-7AD3-48F3-A06A-13EBF3C4DDDE}>1.0>0
53. Still in the left panel, locate and delete the key:
    win32
54. Again Still in the left panel, locate and delete the key:
    HELPDIR
55. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
56. Still in the left panel, locate and delete the key:
    {77CF20D2-B091-4496-83DA-ACB897068778}
57. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{77CF20D2-B091-4496-83DA-ACB897068778}
58. Still in the left panel, locate and delete the key:
    ProxyStubClsid
59. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
60. Again Still in the left panel, locate and delete the key:
    TypeLib
61. Again Still in the left panel, locate and delete the key:
    {A0F4099E-BA1A-4D10-89B4-DC0C67DB9528}
62. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A0F4099E-BA1A-4D10-89B4-DC0C67DB9528}
63. Still in the left panel, locate and delete the key:
    ProxyStubClsid
64. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
65. Again Still in the left panel, locate and delete the key:
    TypeLib
66. Again Still in the left panel, locate and delete the key:
    {5AA68E42-C1F2-449A-8230-5917FA0E6A60}
67. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{5AA68E42-C1F2-449A-8230-5917FA0E6A60}
68. Still in the left panel, locate and delete the key:
    ProxyStubClsid
69. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
70. Again Still in the left panel, locate and delete the key:
    TypeLib
71. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{35EC0410-555E-4402-B372-D9A6E0BF6795}>InprocServer32
3. In the right panel, locate and delete the entry:
   ThreadingModel = "Apartment"
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{43E40178-0298-4789-B74C-388340A3BE6B}>InprocServer32
5. In the right panel, locate and delete the entry:
   ThreadingModel = "Apartment"
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{F57F0570-4EEB-4AF5-930D-97A35796AE82}>InprocServer32
7. In the right panel, locate and delete the entry:
   ThreadingModel = "Apartment"
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{77CF20D2-B091-4496-83DA-ACB897068778}>TypeLib
9. In the right panel, locate and delete the entry:
   Version = "1.0"
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A0F4099E-BA1A-4D10-89B4-DC0C67DB9528}>TypeLib
11. In the right panel, locate and delete the entry:
    Version = "1.0"
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{5AA68E42-C1F2-449A-8230-5917FA0E6A60}>TypeLib
13. In the right panel, locate and delete the entry:
    Version = "1.0"
14. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %User Temp%\hostB\B\b.sys
   • %User Temp%\hostB\B\staB.dll
   • %User Temp%\hostB\B\winB.dll
   • %User Temp%\hostB\Setup.exe
   • %System%\winvxq93.dll
   • %System%\drivers\hfrvxq93.sys
   • %System%\hfrvxq93.dll
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %User Temp%\hostB\B\b.sys
   • %User Temp%\hostB\B\staB.dll
   • %User Temp%\hostB\B\winB.dll
   • %User Temp%\hostB\Setup.exe
   • %System%\winvxq93.dll
   • %System%\drivers\hfrvxq93.sys
   • %System%\hfrvxq93.dll
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\Wilbert
   • %User Profile%\LOCALS~1
   • %User Temp%\hostB
   • %User Temp%\hostB\B
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\Wilbert
   • %User Profile%\LOCALS~1
   • %User Temp%\hostB
   • %User Temp%\hostB\B