WORM_KNOWLOG.A

To enable Registry Editor, Task Manager, and Folder options:

1. Open Notepad. To do this, click Start>Run, type Notepad in the text box provided, then press Enter.
2. Copy and paste the following script:
   On Error Resume Next Set shl = WScript.CreateObject("WScript.Shell") shl.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools" shl.RegDelete "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools" shl.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr" shl.RegDelete "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr" shl.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions" shl.RegDelete "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions"
3. Save this file as C:\RESTORE.VBS.
4. Click Start>Run again, type C:\RESTORE.VBS in the text box provided, then press Enter.
5. Click Yes at the prompt of the message box to execute the .VBS file.

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{97d25db0-0363-11cf-abc4-02608c9e7553}>1.0
3. Still in the left panel, locate and delete the key:
   FLAGS
4. Again Still in the left panel, locate and delete the key:
   HELPDIR
5. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
6. Still in the left panel, locate and delete the key:
   {FD8256D0-FD15-11CE-ABC4-02608C9E7553}
7. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{FD8256D0-FD15-11CE-ABC4-02608C9E7553}
8. Still in the left panel, locate and delete the key:
   ProxyStubClsid
9. Again Still in the left panel, locate and delete the key:
   ProxyStubClsid32
10. Again Still in the left panel, locate and delete the key:
    TypeLib
11. Again Still in the left panel, locate and delete the key:
    {001677D0-FD16-11CE-ABC4-02608C9E7553}
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{001677D0-FD16-11CE-ABC4-02608C9E7553}
13. Still in the left panel, locate and delete the key:
    ProxyStubClsid
14. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
15. Again Still in the left panel, locate and delete the key:
    TypeLib
16. Again Still in the left panel, locate and delete the key:
    {72B945E0-253B-11CF-A988-00AA006BC149}
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{72B945E0-253B-11CF-A988-00AA006BC149}
18. Still in the left panel, locate and delete the key:
    ProxyStubClsid
19. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
20. Again Still in the left panel, locate and delete the key:
    TypeLib
21. Again Still in the left panel, locate and delete the key:
    {451A0030-72EC-11CF-B03B-00AA006E0975}
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{451A0030-72EC-11CF-B03B-00AA006E0975}
23. Still in the left panel, locate and delete the key:
    ProxyStubClsid
24. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
25. Again Still in the left panel, locate and delete the key:
    TypeLib
26. Again Still in the left panel, locate and delete the key:
    {C6F602B6-8F69-11D0-8528-00C04FD8D503}
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C6F602B6-8F69-11D0-8528-00C04FD8D503}
28. Still in the left panel, locate and delete the key:
    ProxyStubClsid
29. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
30. Again Still in the left panel, locate and delete the key:
    TypeLib
31. Again Still in the left panel, locate and delete the key:
    {05792C8E-941F-11D0-8529-00C04FD8D503}
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{05792C8E-941F-11D0-8529-00C04FD8D503}
33. Still in the left panel, locate and delete the key:
    ProxyStubClsid
34. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
35. Again Still in the left panel, locate and delete the key:
    TypeLib
36. Again Still in the left panel, locate and delete the key:
    {79FA9AD0-A97C-11D0-8534-00C04FD8D503}
37. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{79FA9AD0-A97C-11D0-8534-00C04FD8D503}
38. Still in the left panel, locate and delete the key:
    ProxyStubClsid
39. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
40. Again Still in the left panel, locate and delete the key:
    TypeLib
41. Again Still in the left panel, locate and delete the key:
    {306E831C-5BC7-11D1-A3B8-00C04FB950DC}
42. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{306E831C-5BC7-11D1-A3B8-00C04FB950DC}
43. Still in the left panel, locate and delete the key:
    ProxyStubClsid
44. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
45. Again Still in the left panel, locate and delete the key:
    TypeLib
46. Again Still in the left panel, locate and delete the key:
    {B2BD0902-8878-11D1-8C21-00C04FD8D503}
47. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B2BD0902-8878-11D1-8C21-00C04FD8D503}
48. Still in the left panel, locate and delete the key:
    ProxyStubClsid
49. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
50. Again Still in the left panel, locate and delete the key:
    TypeLib
51. Again Still in the left panel, locate and delete the key:
    {28B96BA0-B330-11CF-A9AD-00AA006BC149}
52. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{28B96BA0-B330-11CF-A9AD-00AA006BC149}
53. Still in the left panel, locate and delete the key:
    ProxyStubClsid
54. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
55. Again Still in the left panel, locate and delete the key:
    TypeLib
56. Again Still in the left panel, locate and delete the key:
    {C8F93DD0-4AE0-11CF-9E73-00AA004A5691}
57. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C8F93DD0-4AE0-11CF-9E73-00AA004A5691}
58. Still in the left panel, locate and delete the key:
    ProxyStubClsid
59. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
60. Again Still in the left panel, locate and delete the key:
    TypeLib
61. Again Still in the left panel, locate and delete the key:
    {C8F93DD3-4AE0-11CF-9E73-00AA004A5691}
62. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C8F93DD3-4AE0-11CF-9E73-00AA004A5691}
63. Still in the left panel, locate and delete the key:
    ProxyStubClsid
64. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
65. Again Still in the left panel, locate and delete the key:
    TypeLib
66. Again Still in the left panel, locate and delete the key:
    {C8F93DD2-4AE0-11CF-9E73-00AA004A5691}
67. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C8F93DD2-4AE0-11CF-9E73-00AA004A5691}
68. Still in the left panel, locate and delete the key:
    ProxyStubClsid
69. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
70. Again Still in the left panel, locate and delete the key:
    TypeLib
71. Again Still in the left panel, locate and delete the key:
    {A05E03A2-EFFE-11CF-8ABC-00C04FD8D503}
72. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A05E03A2-EFFE-11CF-8ABC-00C04FD8D503}
73. Still in the left panel, locate and delete the key:
    ProxyStubClsid
74. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
75. Again Still in the left panel, locate and delete the key:
    TypeLib
76. Again Still in the left panel, locate and delete the key:
    {A1CD2DC6-EFFE-11CF-8ABC-00C04FD8D503}
77. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A1CD2DC6-EFFE-11CF-8ABC-00C04FD8D503}
78. Still in the left panel, locate and delete the key:
    ProxyStubClsid
79. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
80. Again Still in the left panel, locate and delete the key:
    TypeLib
81. Again Still in the left panel, locate and delete the key:
    {A2F733B8-EFFE-11CF-8ABC-00C04FD8D503}
82. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A2F733B8-EFFE-11CF-8ABC-00C04FD8D503}
83. Still in the left panel, locate and delete the key:
    ProxyStubClsid
84. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
85. Again Still in the left panel, locate and delete the key:
    TypeLib
86. Again Still in the left panel, locate and delete the key:
    {00E4C220-FD16-11CE-ABC4-02608C9E7553}
87. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{00E4C220-FD16-11CE-ABC4-02608C9E7553}
88. Still in the left panel, locate and delete the key:
    ProxyStubClsid
89. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
90. Again Still in the left panel, locate and delete the key:
    TypeLib
91. Again Still in the left panel, locate and delete the key:
    {EFE3CC70-1D9F-11CF-B1F3-02608C9E7553}
92. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{EFE3CC70-1D9F-11CF-B1F3-02608C9E7553}
93. Still in the left panel, locate and delete the key:
    ProxyStubClsid
94. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
95. Again Still in the left panel, locate and delete the key:
    TypeLib
96. Again Still in the left panel, locate and delete the key:
    {EF497680-1D9F-11CF-B1F3-02608C9E7553}
97. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{EF497680-1D9F-11CF-B1F3-02608C9E7553}
98. Still in the left panel, locate and delete the key:
    ProxyStubClsid
99. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
100. Again Still in the left panel, locate and delete the key:
     TypeLib
101. Again Still in the left panel, locate and delete the key:
     {27636B00-410F-11CF-B1FF-02608C9E7553}
102. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{27636B00-410F-11CF-B1FF-02608C9E7553}
103. Still in the left panel, locate and delete the key:
     ProxyStubClsid
104. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
105. Again Still in the left panel, locate and delete the key:
     TypeLib
106. Again Still in the left panel, locate and delete the key:
     {3E37E320-17E2-11CF-ABC4-02608C9E7553}
107. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{3E37E320-17E2-11CF-ABC4-02608C9E7553}
108. Still in the left panel, locate and delete the key:
     ProxyStubClsid
109. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
110. Again Still in the left panel, locate and delete the key:
     TypeLib
111. Again Still in the left panel, locate and delete the key:
     {B15160D0-1226-11CF-A985-00AA006BC149}
112. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B15160D0-1226-11CF-A985-00AA006BC149}
113. Still in the left panel, locate and delete the key:
     ProxyStubClsid
114. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
115. Again Still in the left panel, locate and delete the key:
     TypeLib
116. Again Still in the left panel, locate and delete the key:
     {124BE5C0-156E-11CF-A986-00AA006BC149}
117. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{124BE5C0-156E-11CF-A986-00AA006BC149}
118. Still in the left panel, locate and delete the key:
     ProxyStubClsid
119. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
120. Again Still in the left panel, locate and delete the key:
     TypeLib
121. Again Still in the left panel, locate and delete the key:
     {32FB6780-1ED0-11CF-A988-00AA006BC149}
122. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{32FB6780-1ED0-11CF-A988-00AA006BC149}
123. Still in the left panel, locate and delete the key:
     ProxyStubClsid
124. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
125. Again Still in the left panel, locate and delete the key:
     TypeLib
126. Again Still in the left panel, locate and delete the key:
     {9A52DB30-1ECF-11CF-A988-00AA006BC149}
127. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{9A52DB30-1ECF-11CF-A988-00AA006BC149}
128. Still in the left panel, locate and delete the key:
     ProxyStubClsid
129. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
130. Again Still in the left panel, locate and delete the key:
     TypeLib
131. Again Still in the left panel, locate and delete the key:
     {68AF66E0-31CA-11CF-A98A-00AA006BC149}
132. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{68AF66E0-31CA-11CF-A98A-00AA006BC149}
133. Still in the left panel, locate and delete the key:
     ProxyStubClsid
134. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
135. Again Still in the left panel, locate and delete the key:
     TypeLib
136. Again Still in the left panel, locate and delete the key:
     {5D7B33F0-31CA-11CF-A98A-00AA006BC149}
137. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{5D7B33F0-31CA-11CF-A98A-00AA006BC149}
138. Still in the left panel, locate and delete the key:
     ProxyStubClsid
139. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
140. Again Still in the left panel, locate and delete the key:
     TypeLib
141. Again Still in the left panel, locate and delete the key:
     {A89D1900-31CA-11CF-A98A-00AA006BC149}
142. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A89D1900-31CA-11CF-A98A-00AA006BC149}
143. Still in the left panel, locate and delete the key:
     ProxyStubClsid
144. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
145. Again Still in the left panel, locate and delete the key:
     TypeLib
146. Again Still in the left panel, locate and delete the key:
     {A02DED10-31CA-11CF-A98A-00AA006BC149}
147. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A02DED10-31CA-11CF-A98A-00AA006BC149}
148. Still in the left panel, locate and delete the key:
     ProxyStubClsid
149. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
150. Again Still in the left panel, locate and delete the key:
     TypeLib
151. Again Still in the left panel, locate and delete the key:
     {EB6DCAF0-4B83-11CF-A995-00AA006BC149}
152. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{EB6DCAF0-4B83-11CF-A995-00AA006BC149}
153. Still in the left panel, locate and delete the key:
     ProxyStubClsid
154. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
155. Again Still in the left panel, locate and delete the key:
     TypeLib
156. Again Still in the left panel, locate and delete the key:
     {398B7DA0-4AAB-11CF-AE2C-00AA006EBFB9}
157. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{398B7DA0-4AAB-11CF-AE2C-00AA006EBFB9}
158. Still in the left panel, locate and delete the key:
     ProxyStubClsid
159. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
160. Again Still in the left panel, locate and delete the key:
     TypeLib
161. Again Still in the left panel, locate and delete the key:
     {34A05B20-4AAB-11CF-AE2C-00AA006EBFB9}
162. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{34A05B20-4AAB-11CF-AE2C-00AA006EBFB9}
163. Still in the left panel, locate and delete the key:
     ProxyStubClsid
164. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
165. Again Still in the left panel, locate and delete the key:
     TypeLib
166. Again Still in the left panel, locate and delete the key:
     {DDF2891E-0F9C-11D0-8AD4-00C04FD8D503}
167. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{DDF2891E-0F9C-11D0-8AD4-00C04FD8D503}
168. Still in the left panel, locate and delete the key:
     ProxyStubClsid
169. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
170. Again Still in the left panel, locate and delete the key:
     TypeLib
171. Again Still in the left panel, locate and delete the key:
     {B4F3A14C-9BDD-11D0-852C-00C04FD8D503}
172. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B4F3A14C-9BDD-11D0-852C-00C04FD8D503}
173. Still in the left panel, locate and delete the key:
     ProxyStubClsid
174. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
175. Again Still in the left panel, locate and delete the key:
     TypeLib
176. Again Still in the left panel, locate and delete the key:
     {B7EE91CC-9BDD-11D0-852C-00C04FD8D503}
177. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B7EE91CC-9BDD-11D0-852C-00C04FD8D503}
178. Still in the left panel, locate and delete the key:
     ProxyStubClsid
179. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
180. Again Still in the left panel, locate and delete the key:
     TypeLib
181. Again Still in the left panel, locate and delete the key:
     {B8C787CA-9BDD-11D0-852C-00C04FD8D503}
182. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B8C787CA-9BDD-11D0-852C-00C04FD8D503}
183. Still in the left panel, locate and delete the key:
     ProxyStubClsid
184. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
185. Again Still in the left panel, locate and delete the key:
     TypeLib
186. Again Still in the left panel, locate and delete the key:
     {9068270B-0939-11D1-8BE1-00C04FD8D503}
187. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{9068270B-0939-11D1-8BE1-00C04FD8D503}
188. Still in the left panel, locate and delete the key:
     ProxyStubClsid
189. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
190. Again Still in the left panel, locate and delete the key:
     TypeLib
191. Again Still in the left panel, locate and delete the key:
     {B1B272A3-3625-11D1-A3A4-00C04FB950DC}
192. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B1B272A3-3625-11D1-A3A4-00C04FB950DC}
193. Still in the left panel, locate and delete the key:
     ProxyStubClsid
194. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
195. Again Still in the left panel, locate and delete the key:
     TypeLib
196. Again Still in the left panel, locate and delete the key:
     {7B66B533-4680-11D1-A3B4-00C04FB950DC}
197. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{7B66B533-4680-11D1-A3B4-00C04FB950DC}
198. Still in the left panel, locate and delete the key:
     ProxyStubClsid
199. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
200. Again Still in the left panel, locate and delete the key:
     TypeLib
201. Again Still in the left panel, locate and delete the key:
     {A910DEA9-4680-11D1-A3B4-00C04FB950DC}
202. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A910DEA9-4680-11D1-A3B4-00C04FB950DC}
203. Still in the left panel, locate and delete the key:
     ProxyStubClsid
204. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
205. Again Still in the left panel, locate and delete the key:
     TypeLib
206. Again Still in the left panel, locate and delete the key:
     {B21A50A9-4080-11D1-A3AC-00C04FB950DC}
207. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B21A50A9-4080-11D1-A3AC-00C04FB950DC}
208. Still in the left panel, locate and delete the key:
     ProxyStubClsid
209. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
210. Again Still in the left panel, locate and delete the key:
     TypeLib
211. Again Still in the left panel, locate and delete the key:
     {7B28B80F-4680-11D1-A3B4-00C04FB950DC}
212. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{7B28B80F-4680-11D1-A3B4-00C04FB950DC}
213. Still in the left panel, locate and delete the key:
     ProxyStubClsid
214. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
215. Again Still in the left panel, locate and delete the key:
     TypeLib
216. Again Still in the left panel, locate and delete the key:
     {97AF011A-478E-11D1-A3B4-00C04FB950DC}
217. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{97AF011A-478E-11D1-A3B4-00C04FB950DC}
218. Still in the left panel, locate and delete the key:
     ProxyStubClsid
219. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
220. Again Still in the left panel, locate and delete the key:
     TypeLib
221. Again Still in the left panel, locate and delete the key:
     {B287FCD5-4080-11D1-A3AC-00C04FB950DC}
222. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B287FCD5-4080-11D1-A3AC-00C04FB950DC}
223. Still in the left panel, locate and delete the key:
     ProxyStubClsid
224. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
225. Again Still in the left panel, locate and delete the key:
     TypeLib
226. Again Still in the left panel, locate and delete the key:
     {F60FB803-4080-11D1-A3AC-00C04FB950DC}
227. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{F60FB803-4080-11D1-A3AC-00C04FB950DC}
228. Still in the left panel, locate and delete the key:
     ProxyStubClsid
229. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
230. Again Still in the left panel, locate and delete the key:
     TypeLib
231. Again Still in the left panel, locate and delete the key:
     {8452D3AB-0869-11D1-A377-00C04FB950DC}
232. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{8452D3AB-0869-11D1-A377-00C04FB950DC}
233. Still in the left panel, locate and delete the key:
     ProxyStubClsid
234. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
235. Again Still in the left panel, locate and delete the key:
     TypeLib
236. Again Still in the left panel, locate and delete the key:
     {B2F5A901-4080-11D1-A3AC-00C04FB950DC}
237. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B2F5A901-4080-11D1-A3AC-00C04FB950DC}
238. Still in the left panel, locate and delete the key:
     ProxyStubClsid
239. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
240. Again Still in the left panel, locate and delete the key:
     TypeLib
241. Again Still in the left panel, locate and delete the key:
     {7ADECF29-4680-11D1-A3B4-00C04FB950DC}
242. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{7ADECF29-4680-11D1-A3B4-00C04FB950DC}
243. Still in the left panel, locate and delete the key:
     ProxyStubClsid
244. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
245. Again Still in the left panel, locate and delete the key:
     TypeLib
246. Again Still in the left panel, locate and delete the key:
     {FD1302BD-4080-11D1-A3AC-00C04FB950DC}
247. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{FD1302BD-4080-11D1-A3AC-00C04FB950DC}
248. Still in the left panel, locate and delete the key:
     ProxyStubClsid
249. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
250. Again Still in the left panel, locate and delete the key:
     TypeLib
251. Again Still in the left panel, locate and delete the key:
     {B371A349-4080-11D1-A3AC-00C04FB950DC}
252. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B371A349-4080-11D1-A3AC-00C04FB950DC}
253. Still in the left panel, locate and delete the key:
     ProxyStubClsid
254. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
255. Again Still in the left panel, locate and delete the key:
     TypeLib
256. Again Still in the left panel, locate and delete the key:
     {B3EB3B37-4080-11D1-A3AC-00C04FB950DC}
257. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B3EB3B37-4080-11D1-A3AC-00C04FB950DC}
258. Still in the left panel, locate and delete the key:
     ProxyStubClsid
259. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
260. Again Still in the left panel, locate and delete the key:
     TypeLib
261. Again Still in the left panel, locate and delete the key:
     {46F14FDA-232B-11D1-A808-00C04FD8D5A8}
262. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{46F14FDA-232B-11D1-A808-00C04FD8D5A8}
263. Still in the left panel, locate and delete the key:
     ProxyStubClsid
264. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
265. Again Still in the left panel, locate and delete the key:
     TypeLib
266. Again Still in the left panel, locate and delete the key:
     {D592AED4-F420-11D0-A36E-00C04FB950DC}
267. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{D592AED4-F420-11D0-A36E-00C04FB950DC}
268. Still in the left panel, locate and delete the key:
     ProxyStubClsid
269. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
270. Again Still in the left panel, locate and delete the key:
     TypeLib
271. Again Still in the left panel, locate and delete the key:
     {5BB11929-AFD1-11D2-9CB9-0000F87A369E}
272. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{5BB11929-AFD1-11D2-9CB9-0000F87A369E}
273. Still in the left panel, locate and delete the key:
     ProxyStubClsid
274. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
275. Again Still in the left panel, locate and delete the key:
     TypeLib
276. Again Still in the left panel, locate and delete the key:
     {6C6D65DC-AFD1-11D2-9CB9-0000F87A369E}
277. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{6C6D65DC-AFD1-11D2-9CB9-0000F87A369E}
278. Still in the left panel, locate and delete the key:
     ProxyStubClsid
279. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
280. Again Still in the left panel, locate and delete the key:
     TypeLib
281. Again Still in the left panel, locate and delete the key:
     {7E99C0A2-F935-11D2-BA96-00C04FB6D0D1}
282. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{7E99C0A2-F935-11D2-BA96-00C04FB6D0D1}
283. Still in the left panel, locate and delete the key:
     ProxyStubClsid
284. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
285. Again Still in the left panel, locate and delete the key:
     TypeLib
286. Again Still in the left panel, locate and delete the key:
     {370DF02E-F934-11D2-BA96-00C04FB6D0D1}
287. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{370DF02E-F934-11D2-BA96-00C04FB6D0D1}
288. Still in the left panel, locate and delete the key:
     ProxyStubClsid
289. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
290. Again Still in the left panel, locate and delete the key:
     TypeLib
291. Again Still in the left panel, locate and delete the key:
     {A63251B2-5F21-474B-AB52-4A8EFAD10895}
292. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A63251B2-5F21-474B-AB52-4A8EFAD10895}
293. Still in the left panel, locate and delete the key:
     ProxyStubClsid
294. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
295. Again Still in the left panel, locate and delete the key:
     TypeLib
296. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Policies
297. Still in the left panel, locate and delete the key:
     System
298. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{FD8256D0-FD15-11CE-ABC4-02608C9E7553}>TypeLib
3. In the right panel, locate and delete the entry:
   Version = "1.0"
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{001677D0-FD16-11CE-ABC4-02608C9E7553}>TypeLib
5. In the right panel, locate and delete the entry:
   Version = "1.0"
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{72B945E0-253B-11CF-A988-00AA006BC149}>TypeLib
7. In the right panel, locate and delete the entry:
   Version = "1.0"
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{451A0030-72EC-11CF-B03B-00AA006E0975}>TypeLib
9. In the right panel, locate and delete the entry:
   Version = "1.0"
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C6F602B6-8F69-11D0-8528-00C04FD8D503}>TypeLib
11. In the right panel, locate and delete the entry:
    Version = "1.0"
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{05792C8E-941F-11D0-8529-00C04FD8D503}>TypeLib
13. In the right panel, locate and delete the entry:
    Version = "1.0"
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{79FA9AD0-A97C-11D0-8534-00C04FD8D503}>TypeLib
15. In the right panel, locate and delete the entry:
    Version = "1.0"
16. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{306E831C-5BC7-11D1-A3B8-00C04FB950DC}>TypeLib
17. In the right panel, locate and delete the entry:
    Version = "1.0"
18. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B2BD0902-8878-11D1-8C21-00C04FD8D503}>TypeLib
19. In the right panel, locate and delete the entry:
    Version = "1.0"
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{28B96BA0-B330-11CF-A9AD-00AA006BC149}>TypeLib
21. In the right panel, locate and delete the entry:
    Version = "1.0"
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C8F93DD0-4AE0-11CF-9E73-00AA004A5691}>TypeLib
23. In the right panel, locate and delete the entry:
    Version = "1.0"
24. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C8F93DD3-4AE0-11CF-9E73-00AA004A5691}>TypeLib
25. In the right panel, locate and delete the entry:
    Version = "1.0"
26. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C8F93DD2-4AE0-11CF-9E73-00AA004A5691}>TypeLib
27. In the right panel, locate and delete the entry:
    Version = "1.0"
28. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A05E03A2-EFFE-11CF-8ABC-00C04FD8D503}>TypeLib
29. In the right panel, locate and delete the entry:
    Version = "1.0"
30. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A1CD2DC6-EFFE-11CF-8ABC-00C04FD8D503}>TypeLib
31. In the right panel, locate and delete the entry:
    Version = "1.0"
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A2F733B8-EFFE-11CF-8ABC-00C04FD8D503}>TypeLib
33. In the right panel, locate and delete the entry:
    Version = "1.0"
34. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{00E4C220-FD16-11CE-ABC4-02608C9E7553}>TypeLib
35. In the right panel, locate and delete the entry:
    Version = "1.0"
36. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{EFE3CC70-1D9F-11CF-B1F3-02608C9E7553}>TypeLib
37. In the right panel, locate and delete the entry:
    Version = "1.0"
38. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{EF497680-1D9F-11CF-B1F3-02608C9E7553}>TypeLib
39. In the right panel, locate and delete the entry:
    Version = "1.0"
40. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{27636B00-410F-11CF-B1FF-02608C9E7553}>TypeLib
41. In the right panel, locate and delete the entry:
    Version = "1.0"
42. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{3E37E320-17E2-11CF-ABC4-02608C9E7553}>TypeLib
43. In the right panel, locate and delete the entry:
    Version = "1.0"
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B15160D0-1226-11CF-A985-00AA006BC149}>TypeLib
45. In the right panel, locate and delete the entry:
    Version = "1.0"
46. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{124BE5C0-156E-11CF-A986-00AA006BC149}>TypeLib
47. In the right panel, locate and delete the entry:
    Version = "1.0"
48. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{32FB6780-1ED0-11CF-A988-00AA006BC149}>TypeLib
49. In the right panel, locate and delete the entry:
    Version = "1.0"
50. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{9A52DB30-1ECF-11CF-A988-00AA006BC149}>TypeLib
51. In the right panel, locate and delete the entry:
    Version = "1.0"
52. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{68AF66E0-31CA-11CF-A98A-00AA006BC149}>TypeLib
53. In the right panel, locate and delete the entry:
    Version = "1.0"
54. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{5D7B33F0-31CA-11CF-A98A-00AA006BC149}>TypeLib
55. In the right panel, locate and delete the entry:
    Version = "1.0"
56. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A89D1900-31CA-11CF-A98A-00AA006BC149}>TypeLib
57. In the right panel, locate and delete the entry:
    Version = "1.0"
58. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A02DED10-31CA-11CF-A98A-00AA006BC149}>TypeLib
59. In the right panel, locate and delete the entry:
    Version = "1.0"
60. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{EB6DCAF0-4B83-11CF-A995-00AA006BC149}>TypeLib
61. In the right panel, locate and delete the entry:
    Version = "1.0"
62. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{398B7DA0-4AAB-11CF-AE2C-00AA006EBFB9}>TypeLib
63. In the right panel, locate and delete the entry:
    Version = "1.0"
64. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{34A05B20-4AAB-11CF-AE2C-00AA006EBFB9}>TypeLib
65. In the right panel, locate and delete the entry:
    Version = "1.0"
66. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{DDF2891E-0F9C-11D0-8AD4-00C04FD8D503}>TypeLib
67. In the right panel, locate and delete the entry:
    Version = "1.0"
68. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B4F3A14C-9BDD-11D0-852C-00C04FD8D503}>TypeLib
69. In the right panel, locate and delete the entry:
    Version = "1.0"
70. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B7EE91CC-9BDD-11D0-852C-00C04FD8D503}>TypeLib
71. In the right panel, locate and delete the entry:
    Version = "1.0"
72. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B8C787CA-9BDD-11D0-852C-00C04FD8D503}>TypeLib
73. In the right panel, locate and delete the entry:
    Version = "1.0"
74. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{9068270B-0939-11D1-8BE1-00C04FD8D503}>TypeLib
75. In the right panel, locate and delete the entry:
    Version = "1.0"
76. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B1B272A3-3625-11D1-A3A4-00C04FB950DC}>TypeLib
77. In the right panel, locate and delete the entry:
    Version = "1.0"
78. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{7B66B533-4680-11D1-A3B4-00C04FB950DC}>TypeLib
79. In the right panel, locate and delete the entry:
    Version = "1.0"
80. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A910DEA9-4680-11D1-A3B4-00C04FB950DC}>TypeLib
81. In the right panel, locate and delete the entry:
    Version = "1.0"
82. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B21A50A9-4080-11D1-A3AC-00C04FB950DC}>TypeLib
83. In the right panel, locate and delete the entry:
    Version = "1.0"
84. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{7B28B80F-4680-11D1-A3B4-00C04FB950DC}>TypeLib
85. In the right panel, locate and delete the entry:
    Version = "1.0"
86. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{97AF011A-478E-11D1-A3B4-00C04FB950DC}>TypeLib
87. In the right panel, locate and delete the entry:
    Version = "1.0"
88. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B287FCD5-4080-11D1-A3AC-00C04FB950DC}>TypeLib
89. In the right panel, locate and delete the entry:
    Version = "1.0"
90. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{F60FB803-4080-11D1-A3AC-00C04FB950DC}>TypeLib
91. In the right panel, locate and delete the entry:
    Version = "1.0"
92. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{8452D3AB-0869-11D1-A377-00C04FB950DC}>TypeLib
93. In the right panel, locate and delete the entry:
    Version = "1.0"
94. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B2F5A901-4080-11D1-A3AC-00C04FB950DC}>TypeLib
95. In the right panel, locate and delete the entry:
    Version = "1.0"
96. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{7ADECF29-4680-11D1-A3B4-00C04FB950DC}>TypeLib
97. In the right panel, locate and delete the entry:
    Version = "1.0"
98. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{FD1302BD-4080-11D1-A3AC-00C04FB950DC}>TypeLib
99. In the right panel, locate and delete the entry:
    Version = "1.0"
100. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B371A349-4080-11D1-A3AC-00C04FB950DC}>TypeLib
101. In the right panel, locate and delete the entry:
     Version = "1.0"
102. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B3EB3B37-4080-11D1-A3AC-00C04FB950DC}>TypeLib
103. In the right panel, locate and delete the entry:
     Version = "1.0"
104. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{46F14FDA-232B-11D1-A808-00C04FD8D5A8}>TypeLib
105. In the right panel, locate and delete the entry:
     Version = "1.0"
106. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{D592AED4-F420-11D0-A36E-00C04FB950DC}>TypeLib
107. In the right panel, locate and delete the entry:
     Version = "1.0"
108. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{5BB11929-AFD1-11D2-9CB9-0000F87A369E}>TypeLib
109. In the right panel, locate and delete the entry:
     Version = "1.0"
110. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{6C6D65DC-AFD1-11D2-9CB9-0000F87A369E}>TypeLib
111. In the right panel, locate and delete the entry:
     Version = "1.0"
112. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{7E99C0A2-F935-11D2-BA96-00C04FB6D0D1}>TypeLib
113. In the right panel, locate and delete the entry:
     Version = "1.0"
114. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{370DF02E-F934-11D2-BA96-00C04FB6D0D1}>TypeLib
115. In the right panel, locate and delete the entry:
     Version = "1.0"
116. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A63251B2-5F21-474B-AB52-4A8EFAD10895}>TypeLib
117. In the right panel, locate and delete the entry:
     Version = "1.0"
118. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Winlogon>SpecialAccounts>UserList
119. In the right panel, locate and delete the entry:
     Universal = "0"
120. Close Registry Editor.

To restore the registry value this malware/grayware/spyware modified:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>GDIPlus
3. In the right panel, locate the registry value:
   FontCachePath = "%Application Data%"
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   FontCachePath = "%User Profile%\Local Settings\Application Data"
5. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>SystemRestore
6. In the right panel, locate the registry value:
   DisableSR = "1"
7. Close Registry Editor.

To delete malware/grayware component files:

1. Search for the following files:
   
   • %System Root%\autorun.inf
   • %User Profile%\Application Data\temp48.txt
   
   Note: To do a search for the following files, right-click Start then click Search... or Find..., depending on the version of Windows you are running. For each file to be deleted, type its file name in the Named input box. In the Look In drop-down list, select My Computer, then press Enter.
2. Once located, select the file then press SHIFT+DELETE to permanently delete the file.
3. Repeat the said steps for all files listed.

To delete the malware/grayware folder:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %System Root%\Program Settings
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.