VBS_STARTPA.GP

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Uninstall
3. Still in the left panel, locate and delete the key:
   MICHANG OCX Setup_is1
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
5. Still in the left panel, locate and delete the key:
   {BDEA39DE-AA0E-44C6-8EF4-D3EB73ACE9E9}
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{BDEA39DE-AA0E-44C6-8EF4-D3EB73ACE9E9}
7. Still in the left panel, locate and delete the key:
   1.1
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{BDEA39DE-AA0E-44C6-8EF4-D3EB73ACE9E9}>1.1
9. Still in the left panel, locate and delete the key:
   FLAGS
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{BDEA39DE-AA0E-44C6-8EF4-D3EB73ACE9E9}>1.1>0
11. Still in the left panel, locate and delete the key:
    win32
12. Again Still in the left panel, locate and delete the key:
    HELPDIR
13. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
14. Still in the left panel, locate and delete the key:
    {74D927BB-F9AE-4A67-AB86-807DC577E8F0}
15. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{74D927BB-F9AE-4A67-AB86-807DC577E8F0}
16. Still in the left panel, locate and delete the key:
    ProxyStubClsid
17. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
18. Again Still in the left panel, locate and delete the key:
    TypeLib
19. Again Still in the left panel, locate and delete the key:
    {4BDF59C9-2353-4E35-8D99-3BBAAC95CC43}
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{4BDF59C9-2353-4E35-8D99-3BBAAC95CC43}
21. Still in the left panel, locate and delete the key:
    ProxyStubClsid
22. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
23. Again Still in the left panel, locate and delete the key:
    TypeLib
24. Again Still in the left panel, locate and delete the key:
    {B23DAB38-CC2C-4F37-B18B-C299986A1B76}
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B23DAB38-CC2C-4F37-B18B-C299986A1B76}
26. Still in the left panel, locate and delete the key:
    ProxyStubClsid
27. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
28. Again Still in the left panel, locate and delete the key:
    TypeLib
29. Again Still in the left panel, locate and delete the key:
    {B4967DDB-5E44-42E6-9DC7-0F3875332848}
30. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B4967DDB-5E44-42E6-9DC7-0F3875332848}
31. Still in the left panel, locate and delete the key:
    ProxyStubClsid
32. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
33. Again Still in the left panel, locate and delete the key:
    TypeLib
34. Again Still in the left panel, locate and delete the key:
    {CC242159-B9B5-45A9-8A3C-502E2A42D4DE}
35. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{CC242159-B9B5-45A9-8A3C-502E2A42D4DE}
36. Still in the left panel, locate and delete the key:
    ProxyStubClsid
37. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
38. Again Still in the left panel, locate and delete the key:
    TypeLib
39. Again Still in the left panel, locate and delete the key:
    {9032DAB4-80CD-4410-90EE-E439D7ADB875}
40. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{9032DAB4-80CD-4410-90EE-E439D7ADB875}
41. Still in the left panel, locate and delete the key:
    ProxyStubClsid
42. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
43. Again Still in the left panel, locate and delete the key:
    TypeLib
44. Again Still in the left panel, locate and delete the key:
    {AABB3CB4-37DB-4624-89E4-0D234E90C541}
45. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{AABB3CB4-37DB-4624-89E4-0D234E90C541}
46. Still in the left panel, locate and delete the key:
    ProxyStubClsid
47. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
48. Again Still in the left panel, locate and delete the key:
    TypeLib
49. Again Still in the left panel, locate and delete the key:
    {9331D132-45B6-466F-BB1F-833A41F82575}
50. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{9331D132-45B6-466F-BB1F-833A41F82575}
51. Still in the left panel, locate and delete the key:
    ProxyStubClsid
52. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
53. Again Still in the left panel, locate and delete the key:
    TypeLib
54. Again Still in the left panel, locate and delete the key:
    {1935504C-30A4-4756-B30B-8577ED966834}
55. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{1935504C-30A4-4756-B30B-8577ED966834}
56. Still in the left panel, locate and delete the key:
    ProxyStubClsid
57. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
58. Again Still in the left panel, locate and delete the key:
    TypeLib
59. Again Still in the left panel, locate and delete the key:
    {1DA9BE77-DB49-4D6D-A99C-742795C7D27E}
60. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{1DA9BE77-DB49-4D6D-A99C-742795C7D27E}
61. Still in the left panel, locate and delete the key:
    ProxyStubClsid
62. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
63. Again Still in the left panel, locate and delete the key:
    TypeLib
64. Again Still in the left panel, locate and delete the key:
    {0B8AA27C-3ACB-411A-8824-7435DB657AE6}
65. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{0B8AA27C-3ACB-411A-8824-7435DB657AE6}
66. Still in the left panel, locate and delete the key:
    ProxyStubClsid
67. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
68. Again Still in the left panel, locate and delete the key:
    TypeLib
69. Again Still in the left panel, locate and delete the key:
    {90F34DEB-BA8F-4C0D-810E-58B39EB10BB5}
70. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{90F34DEB-BA8F-4C0D-810E-58B39EB10BB5}
71. Still in the left panel, locate and delete the key:
    ProxyStubClsid
72. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
73. Again Still in the left panel, locate and delete the key:
    TypeLib
74. Again Still in the left panel, locate and delete the key:
    {B5CAE009-A348-4BEF-A13A-A7D351F6C7C0}
75. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B5CAE009-A348-4BEF-A13A-A7D351F6C7C0}
76. Still in the left panel, locate and delete the key:
    ProxyStubClsid
77. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
78. Again Still in the left panel, locate and delete the key:
    TypeLib
79. Again Still in the left panel, locate and delete the key:
    {A7EB0978-20A2-434C-99ED-A6FF54508DF0}
80. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A7EB0978-20A2-434C-99ED-A6FF54508DF0}
81. Still in the left panel, locate and delete the key:
    ProxyStubClsid
82. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
83. Again Still in the left panel, locate and delete the key:
    TypeLib
84. Again Still in the left panel, locate and delete the key:
    {BCE04D33-1EFD-4273-9F45-452FA82E3120}
85. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BCE04D33-1EFD-4273-9F45-452FA82E3120}
86. Still in the left panel, locate and delete the key:
    ProxyStubClsid
87. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
88. Again Still in the left panel, locate and delete the key:
    TypeLib
89. Again Still in the left panel, locate and delete the key:
    {625067D9-1F33-481A-BE7C-51D4128290BC}
90. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{625067D9-1F33-481A-BE7C-51D4128290BC}
91. Still in the left panel, locate and delete the key:
    ProxyStubClsid
92. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
93. Again Still in the left panel, locate and delete the key:
    TypeLib
94. Again Still in the left panel, locate and delete the key:
    {D48802A1-FAD7-4B15-B62F-29BFCE7121DF}
95. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{D48802A1-FAD7-4B15-B62F-29BFCE7121DF}
96. Still in the left panel, locate and delete the key:
    ProxyStubClsid
97. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
98. Again Still in the left panel, locate and delete the key:
    TypeLib
99. Again Still in the left panel, locate and delete the key:
    {DD47BBF1-E560-4879-ADD7-839D183037A9}
100. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{DD47BBF1-E560-4879-ADD7-839D183037A9}
101. Still in the left panel, locate and delete the key:
     ProxyStubClsid
102. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
103. Again Still in the left panel, locate and delete the key:
     TypeLib
104. In the left panel, double-click the following:
     HKEY_CLASSES_ROOT>CLSID
105. Still in the left panel, locate and delete the key:
     {BE60A055-ABCF-42FF-A1F7-7FC2AF99503D}
106. In the left panel, double-click the following:
     HKEY_CLASSES_ROOT>CLSID>{BE60A055-ABCF-42FF-A1F7-7FC2AF99503D}
107. Still in the left panel, locate and delete the key:
     InprocServer32
108. In the left panel, double-click the following:
     HKEY_CLASSES_ROOT
109. Still in the left panel, locate and delete the key:
     AFXPrintProj1.AFXPrint
110. In the left panel, double-click the following:
     HKEY_CLASSES_ROOT>AFXPrintProj1.AFXPrint
111. Still in the left panel, locate and delete the key:
     Clsid
112. Again Still in the left panel, locate and delete the key:
     ProgID
113. Again Still in the left panel, locate and delete the key:
     Version
114. Again Still in the left panel, locate and delete the key:
     TypeLib
115. Again Still in the left panel, locate and delete the key:
     MiscStatus
116. Again Still in the left panel, locate and delete the key:
     ToolboxBitmap32
117. Again Still in the left panel, locate and delete the key:
     Control
118. Again Still in the left panel, locate and delete the key:
     Verb
119. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>MICHANG OCX Setup_is1
3. In the right panel, locate and delete the entry:
   Inno Setup: Setup Version = "5.3.10 (a)"
4. Again In the right panel, locate and delete the entry:
   Inno Setup: App Path = "%Program Files%\MICHANG OCX Setup"
5. Again In the right panel, locate and delete the entry:
   InstallLocation = "%Program Files%\MICHANG OCX Setup"
6. Again In the right panel, locate and delete the entry:
   Inno Setup: Icon Group = "MICHANG OCX Setup"
7. Again In the right panel, locate and delete the entry:
   Inno Setup: User = "Wilbert"
8. Again In the right panel, locate and delete the entry:
   Inno Setup: Deselected Tasks = "desktopicon"
9. Again In the right panel, locate and delete the entry:
   Inno Setup: Language = "english"
10. Again In the right panel, locate and delete the entry:
    DisplayName = "OCX Setup 1.1.3"
11. Again In the right panel, locate and delete the entry:
    UninstallString = "%Program Files%\MICHANG OCX Setup\unins000.exe"
12. Again In the right panel, locate and delete the entry:
    QuietUninstallString = "%Program Files%\MICHANG OCX Setup\unins000.exe /SILENT"
13. Again In the right panel, locate and delete the entry:
    Publisher = "MICHANG CABLE CO.,LTD"
14. Again In the right panel, locate and delete the entry:
    NoModify = "1"
15. Again In the right panel, locate and delete the entry:
    NoRepair = "1"
16. Again In the right panel, locate and delete the entry:
    InstallDate = "20130725"
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{74D927BB-F9AE-4A67-AB86-807DC577E8F0}>TypeLib
18. In the right panel, locate and delete the entry:
    Version = "1.1"
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{4BDF59C9-2353-4E35-8D99-3BBAAC95CC43}>TypeLib
20. In the right panel, locate and delete the entry:
    Version = "1.1"
21. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B23DAB38-CC2C-4F37-B18B-C299986A1B76}>TypeLib
22. In the right panel, locate and delete the entry:
    Version = "1.1"
23. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B4967DDB-5E44-42E6-9DC7-0F3875332848}>TypeLib
24. In the right panel, locate and delete the entry:
    Version = "1.1"
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{CC242159-B9B5-45A9-8A3C-502E2A42D4DE}>TypeLib
26. In the right panel, locate and delete the entry:
    Version = "1.1"
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{9032DAB4-80CD-4410-90EE-E439D7ADB875}>TypeLib
28. In the right panel, locate and delete the entry:
    Version = "1.1"
29. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{AABB3CB4-37DB-4624-89E4-0D234E90C541}>TypeLib
30. In the right panel, locate and delete the entry:
    Version = "1.1"
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{9331D132-45B6-466F-BB1F-833A41F82575}>TypeLib
32. In the right panel, locate and delete the entry:
    Version = "1.1"
33. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{1935504C-30A4-4756-B30B-8577ED966834}>TypeLib
34. In the right panel, locate and delete the entry:
    Version = "1.1"
35. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{1DA9BE77-DB49-4D6D-A99C-742795C7D27E}>TypeLib
36. In the right panel, locate and delete the entry:
    Version = "1.1"
37. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{0B8AA27C-3ACB-411A-8824-7435DB657AE6}>TypeLib
38. In the right panel, locate and delete the entry:
    Version = "1.1"
39. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{90F34DEB-BA8F-4C0D-810E-58B39EB10BB5}>TypeLib
40. In the right panel, locate and delete the entry:
    Version = "1.1"
41. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B5CAE009-A348-4BEF-A13A-A7D351F6C7C0}>TypeLib
42. In the right panel, locate and delete the entry:
    Version = "1.1"
43. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A7EB0978-20A2-434C-99ED-A6FF54508DF0}>TypeLib
44. In the right panel, locate and delete the entry:
    Version = "1.1"
45. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BCE04D33-1EFD-4273-9F45-452FA82E3120}>TypeLib
46. In the right panel, locate and delete the entry:
    Version = "1.1"
47. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{625067D9-1F33-481A-BE7C-51D4128290BC}>TypeLib
48. In the right panel, locate and delete the entry:
    Version = "1.1"
49. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{D48802A1-FAD7-4B15-B62F-29BFCE7121DF}>TypeLib
50. In the right panel, locate and delete the entry:
    Version = "1.1"
51. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{DD47BBF1-E560-4879-ADD7-839D183037A9}>TypeLib
52. In the right panel, locate and delete the entry:
    Version = "1.1"
53. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{BE60A055-ABCF-42FF-A1F7-7FC2AF99503D}>InprocServer32
54. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
55. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %User Temp%\is-shnen.tmp\{malware file name}.tmp
   • %User Temp%\is-O19LQ.tmp\_isetup\_RegDLL.tmp
   • %User Temp%\is-O19LQ.tmp\_isetup\_shfoldr.dll
   • %Program Files%\MICHANG OCX Setup\unins000.dat
   • %Program Files%\MICHANG OCX Setup\is-Q62UE.tmp
   • %Program Files%\MICHANG OCX Setup\is-9TVNR.tmp
   • %Program Files%\MICHANG OCX Setup\is-2BFU4.tmp
   • %Program Files%\MICHANG OCX Setup\is-8CA1O.tmp
   • %Start Menu%\Programs\MICHANG OCX Setup\MICHANG OCX Setup.lnk
   • %Start Menu%\Programs\MICHANG OCX Setup\Uninstall MICHANG OCX Setup.lnk
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %User Temp%\is-shnen.tmp\{malware file name}.tmp
   • %User Temp%\is-O19LQ.tmp\_isetup\_RegDLL.tmp
   • %User Temp%\is-O19LQ.tmp\_isetup\_shfoldr.dll
   • %Program Files%\MICHANG OCX Setup\unins000.dat
   • %Program Files%\MICHANG OCX Setup\is-Q62UE.tmp
   • %Program Files%\MICHANG OCX Setup\is-9TVNR.tmp
   • %Program Files%\MICHANG OCX Setup\is-2BFU4.tmp
   • %Program Files%\MICHANG OCX Setup\is-8CA1O.tmp
   • %Start Menu%\Programs\MICHANG OCX Setup\MICHANG OCX Setup.lnk
   • %Start Menu%\Programs\MICHANG OCX Setup\Uninstall MICHANG OCX Setup.lnk
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %User Temp%\is-SHNEN.tmp
   • %User Temp%\is-O19LQ.tmp
   • %User Temp%\is-O19LQ.tmp\_isetup
   • %Program Files%\MICHANG OCX Setup
   • %Start Menu%\Programs\MICHANG OCX Setup
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %User Temp%\is-SHNEN.tmp
   • %User Temp%\is-O19LQ.tmp
   • %User Temp%\is-O19LQ.tmp\_isetup
   • %Program Files%\MICHANG OCX Setup
   • %Start Menu%\Programs\MICHANG OCX Setup