TROJ_MULDROP.AC

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
3. Still in the left panel, locate and delete the key:
   {831FDD16-0C5C-11D2-A9FC-0000F8754DA1}
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{BDC217C5-ED16-11CD-956C-0000C04E4C0A}
5. Still in the left panel, locate and delete the key:
   Control
6. Again Still in the left panel, locate and delete the key:
   {BDC217C8-ED16-11CD-956C-0000C04E4C0A}
7. Again Still in the left panel, locate and delete the key:
   {EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}
8. Close Registry Editor.

To restore registry values this malware/grayware modified:

1. Open Registry Editor. To do this:
   
   • On Windows 2000, XP, and Server 2003:
     Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
   • On Windows Vista and 7:
     Click the Start button, type REGEDIT in the Search input field then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}>InProcServer32
3. In the right panel, locate the registry value:
   ThreadingModel = "Apartment"
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   ThreadingModel = "Apartment"
5. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>Services>Eventlog>Application>VBRuntime
6. In the right panel, locate the registry value:
   EventMessageFile = "%System%\MSVBVM60.DLL"
7. Right-click on the value name and choose Modify. Change the value data of this entry to:
   EventMessageFile = "%Windows%\system32\MSVBVM60.DLL"
8. Again In the right panel, locate the registry value:
   TypesSupported = "4"
9. Right-click on the value name and choose Modify. Change the value data of this entry to:
   TypesSupported = "4"
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{BDD1F04B-858B-11D1-B16A-00C0F0283628}>InprocServer32
11. In the right panel, locate the registry value:
    ThreadingModel = "Apartment"
12. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Apartment"
13. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{C74190B6-8589-11D1-B16A-00C0F0283628}>InprocServer32
14. In the right panel, locate the registry value:
    ThreadingModel = "Apartment"
15. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Apartment"
16. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{1EFB6596-857C-11D1-B16A-00C0F0283628}>InprocServer32
17. In the right panel, locate the registry value:
    ThreadingModel = "Apartment"
18. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Apartment"
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{66833FE6-8583-11D1-B16A-00C0F0283628}>InprocServer32
20. In the right panel, locate the registry value:
    ThreadingModel = "Apartment"
21. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Apartment"
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{2C247F23-8591-11D1-B16A-00C0F0283628}>InprocServer32
23. In the right panel, locate the registry value:
    ThreadingModel = "Apartment"
24. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Apartment"
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{8E3867A3-8586-11D1-B16A-00C0F0283628}>InprocServer32
26. In the right panel, locate the registry value:
    ThreadingModel = "Apartment"
27. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Apartment"
28. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{F08DF954-8592-11D1-B16A-00C0F0283628}>InprocServer32
29. In the right panel, locate the registry value:
    ThreadingModel = "Apartment"
30. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Apartment"
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{35053A22-8589-11D1-B16A-00C0F0283628}>InprocServer32
32. In the right panel, locate the registry value:
    ThreadingModel = "Apartment"
33. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Apartment"
34. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{DD9DA666-8594-11D1-B16A-00C0F0283628}>InprocServer32
35. In the right panel, locate the registry value:
    ThreadingModel = "Apartment"
36. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Apartment"
37. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{2334D2B1-713E-11CF-8AE5-00AA00C00905}>TypeLib
38. In the right panel, locate the registry value:
    Version = "2.0"
39. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "2.0"
40. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{2334D2B3-713E-11CF-8AE5-00AA00C00905}>TypeLib
41. In the right panel, locate the registry value:
    Version = "2.0"
42. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "2.0"
43. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{1EFB6594-857C-11D1-B16A-00C0F0283628}>TypeLib
44. In the right panel, locate the registry value:
    Version = "2.0"
45. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "2.0"
46. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{1EFB6595-857C-11D1-B16A-00C0F0283628}>TypeLib
47. In the right panel, locate the registry value:
    Version = "2.0"
48. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "2.0"
49. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{1EFB6597-857C-11D1-B16A-00C0F0283628}>TypeLib
50. In the right panel, locate the registry value:
    Version = "2.0"
51. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "2.0"
52. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{1EFB6599-857C-11D1-B16A-00C0F0283628}>TypeLib
53. In the right panel, locate the registry value:
    Version = "2.0"
54. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "2.0"
55. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{66833FE4-8583-11D1-B16A-00C0F0283628}>TypeLib
56. In the right panel, locate the registry value:
    Version = "2.0"
57. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "2.0"
58. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{66833FE5-8583-11D1-B16A-00C0F0283628}>TypeLib
59. In the right panel, locate the registry value:
    Version = "2.0"
60. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "2.0"
61. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{66833FE7-8583-11D1-B16A-00C0F0283628}>TypeLib
62. In the right panel, locate the registry value:
    Version = "2.0"
63. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "2.0"
64. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{66833FE9-8583-11D1-B16A-00C0F0283628}>TypeLib
65. In the right panel, locate the registry value:
    Version = "2.0"
66. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "2.0"
67. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{66833FEB-8583-11D1-B16A-00C0F0283628}>TypeLib
68. In the right panel, locate the registry value:
    Version = "2.0"
69. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "2.0"
70. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{66833FED-8583-11D1-B16A-00C0F0283628}>TypeLib
71. In the right panel, locate the registry value:
    Version = "2.0"
72. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "2.0"
73. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{8E3867A1-8586-11D1-B16A-00C0F0283628}>TypeLib
74. In the right panel, locate the registry value:
    Version = "2.0"
75. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "2.0"
76. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{8E3867A2-8586-11D1-B16A-00C0F0283628}>TypeLib
77. In the right panel, locate the registry value:
    Version = "2.0"
78. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "2.0"
79. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{8E3867A4-8586-11D1-B16A-00C0F0283628}>TypeLib
80. In the right panel, locate the registry value:
    Version = "2.0"
81. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "2.0"
82. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{8E3867AA-8586-11D1-B16A-00C0F0283628}>TypeLib
83. In the right panel, locate the registry value:
    Version = "2.0"
84. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "2.0"
85. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{35053A20-8589-11D1-B16A-00C0F0283628}>TypeLib
86. In the right panel, locate the registry value:
    Version = "2.0"
87. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "2.0"
88. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{35053A21-8589-11D1-B16A-00C0F0283628}>TypeLib
89. In the right panel, locate the registry value:
    Version = "2.0"
90. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "2.0"
91. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C74190B4-8589-11D1-B16A-00C0F0283628}>TypeLib
92. In the right panel, locate the registry value:
    Version = "2.0"
93. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "2.0"
94. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C74190B5-8589-11D1-B16A-00C0F0283628}>TypeLib
95. In the right panel, locate the registry value:
    Version = "2.0"
96. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "2.0"
97. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C74190B7-8589-11D1-B16A-00C0F0283628}>TypeLib
98. In the right panel, locate the registry value:
    Version = "2.0"
99. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "2.0"
100. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C74190B8-8589-11D1-B16A-00C0F0283628}>TypeLib
101. In the right panel, locate the registry value:
     Version = "2.0"
102. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
103. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BDD1F049-858B-11D1-B16A-00C0F0283628}>TypeLib
104. In the right panel, locate the registry value:
     Version = "2.0"
105. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
106. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BDD1F04A-858B-11D1-B16A-00C0F0283628}>TypeLib
107. In the right panel, locate the registry value:
     Version = "2.0"
108. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
109. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BDD1F04C-858B-11D1-B16A-00C0F0283628}>TypeLib
110. In the right panel, locate the registry value:
     Version = "2.0"
111. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
112. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BDD1F04E-858B-11D1-B16A-00C0F0283628}>TypeLib
113. In the right panel, locate the registry value:
     Version = "2.0"
114. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
115. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BDD1F050-858B-11D1-B16A-00C0F0283628}>TypeLib
116. In the right panel, locate the registry value:
     Version = "2.0"
117. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
118. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BDD1F051-858B-11D1-B16A-00C0F0283628}>TypeLib
119. In the right panel, locate the registry value:
     Version = "2.0"
120. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
121. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BDD1F053-858B-11D1-B16A-00C0F0283628}>TypeLib
122. In the right panel, locate the registry value:
     Version = "2.0"
123. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
124. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BDD1F055-858B-11D1-B16A-00C0F0283628}>TypeLib
125. In the right panel, locate the registry value:
     Version = "2.0"
126. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
127. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{2C247F21-8591-11D1-B16A-00C0F0283628}>TypeLib
128. In the right panel, locate the registry value:
     Version = "2.0"
129. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
130. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{2C247F22-8591-11D1-B16A-00C0F0283628}>TypeLib
131. In the right panel, locate the registry value:
     Version = "2.0"
132. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
133. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{2C247F24-8591-11D1-B16A-00C0F0283628}>TypeLib
134. In the right panel, locate the registry value:
     Version = "2.0"
135. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
136. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{2C247F26-8591-11D1-B16A-00C0F0283628}>TypeLib
137. In the right panel, locate the registry value:
     Version = "2.0"
138. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
139. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{F08DF952-8592-11D1-B16A-00C0F0283628}>TypeLib
140. In the right panel, locate the registry value:
     Version = "2.0"
141. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
142. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{F08DF953-8592-11D1-B16A-00C0F0283628}>TypeLib
143. In the right panel, locate the registry value:
     Version = "2.0"
144. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
145. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C8A3DC00-8593-11D1-B16A-00C0F0283628}>TypeLib
146. In the right panel, locate the registry value:
     Version = "2.0"
147. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
148. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{DD9DA660-8594-11D1-B16A-00C0F0283628}>TypeLib
149. In the right panel, locate the registry value:
     Version = "2.0"
150. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
151. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{DD9DA662-8594-11D1-B16A-00C0F0283628}>TypeLib
152. In the right panel, locate the registry value:
     Version = "2.0"
153. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
154. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{DD9DA664-8594-11D1-B16A-00C0F0283628}>TypeLib
155. In the right panel, locate the registry value:
     Version = "2.0"
156. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
157. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{DD9DA665-8594-11D1-B16A-00C0F0283628}>TypeLib
158. In the right panel, locate the registry value:
     Version = "2.0"
159. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
160. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{BDC217C5-ED16-11CD-956C-0000C04E4C0A}>InprocServer32
161. In the right panel, locate the registry value:
     ThreadingModel = "Apartment"
162. Right-click on the value name and choose Modify. Change the value data of this entry to:
     ThreadingModel = "Apartment"
163. Again In the right panel, locate the registry value:
     Version = "1.1"
164. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
165. Again In the right panel, locate the registry value:
     Version = "1.1"
166. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
167. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{2A4FCCB0-DFF1-11CF-8E74-00A0C90F26F8}>TypeLib
168. In the right panel, locate the registry value:
     Version = "1.1"
169. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "1.1"
170. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BDC217C7-ED16-11CD-956C-0000C04E4C0A}>TypeLib
171. In the right panel, locate the registry value:
     Version = "1.1"
172. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "1.1"
173. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %System Root%\xduyefda.zip
   • %System Root%\Club.uzy
   • %System Root%\SECUR32.DLL
   • %System Root%\MSVBVM60.DLL
   • %System Root%\stdole2.tlb
   • %System Root%\MSCOMCTL.OCX
   • %System Root%\TABCTL32.OCX
   • %System Root%\shdocvw.dll
   • %System Root%\Melodie.dll
   • %System Root%\CList.dat
   • %User Temp%\TMP4352$.TMP
   • %User Temp%\RGI1.tmp
   • %System%\SECUR32.DLL
   • %System%\MSVBVM60.DLL
   • %System%\stdole2.tlb
   • %System%\MSCOMCTL.OCX
   • %System%\TABCTL32.OCX
   • %System%\shdocvw.dll
   • %System%\Melodie.dll
   • %System%\E:\VB\ÃÀ¤·¤­¤â¤Î\Club.uzy
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %System Root%\xduyefda.zip
   • %System Root%\Club.uzy
   • %System Root%\SECUR32.DLL
   • %System Root%\MSVBVM60.DLL
   • %System Root%\stdole2.tlb
   • %System Root%\MSCOMCTL.OCX
   • %System Root%\TABCTL32.OCX
   • %System Root%\shdocvw.dll
   • %System Root%\Melodie.dll
   • %System Root%\CList.dat
   • %User Temp%\TMP4352$.TMP
   • %User Temp%\RGI1.tmp
   • %System%\SECUR32.DLL
   • %System%\MSVBVM60.DLL
   • %System%\stdole2.tlb
   • %System%\MSCOMCTL.OCX
   • %System%\TABCTL32.OCX
   • %System%\shdocvw.dll
   • %System%\Melodie.dll
   • %System%\E:\VB\ÃÀ¤·¤­¤â¤Î\Club.uzy
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.