SPYW_CONDUCENT

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CLASSES_ROOT
3. Still in the left panel, locate and delete the key:
   .WRG
4. Again Still in the left panel, locate and delete the key:
   ReGet.App
5. Again Still in the left panel, locate and delete the key:
   ReGet.Command
6. Again Still in the left panel, locate and delete the key:
   ReGet.Document
7. Again Still in the left panel, locate and delete the key:
   ReGet.MSIEHelperInterface
8. Again Still in the left panel, locate and delete the key:
   ReGet.NetscapeInterface
9. Again Still in the left panel, locate and delete the key:
   ReGet.ReGetApi
10. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>AppID
11. Still in the left panel, locate and delete the key:
    {38AAF322-C5B4-11D1-B75E-000000000000}
12. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>Component Categories
13. Still in the left panel, locate and delete the key:
    {38AAF313-C5B4-11D1-B75E-000000000000}
14. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>Interface
15. Still in the left panel, locate and delete the key:
    {38AAF320-C5B4-11D1-B75E-100000000000}
16. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>TypeLib
17. Still in the left panel, locate and delete the key:
    {38AAF313-C5B4-11D1-B75E-000000000000}
18. In the left panel, double-click the following:
    HKEY_CURRENT_USER>AppEvents>EventLabels
19. Still in the left panel, locate and delete the key:
    ReGetCompleted
20. Again Still in the left panel, locate and delete the key:
    ReGetDlClipAdd
21. Again Still in the left panel, locate and delete the key:
    ReGetDlEnd
22. Again Still in the left panel, locate and delete the key:
    ReGetDlError
23. Again Still in the left panel, locate and delete the key:
    ReGetDlFatalError
24. Again Still in the left panel, locate and delete the key:
    ReGetDlPause
25. Again Still in the left panel, locate and delete the key:
    ReGetDlStart
26. Again Still in the left panel, locate and delete the key:
    ReGetExit
27. Again Still in the left panel, locate and delete the key:
    ReGetStart
28. In the left panel, double-click the following:
    HKEY_CURRENT_USER>AppEvents>Schemes>Apps
29. Still in the left panel, locate and delete the key:
    ReGet
30. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software
31. Still in the left panel, locate and delete the key:
    ReGet Software
32. Again Still in the left panel, locate and delete the key:
    TimeSink, Inc.
33. Again Still in the left panel, locate and delete the key:
    Vladimir Romanov
34. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Extensions
35. Still in the left panel, locate and delete the key:
    {38AAF320-C5B4-11D1-B75E-111111111111}
36. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>MenuExt
37. Still in the left panel, locate and delete the key:
    ReGet—p‚ɃŠƒ“ƒN‚ðˆê——(&L)
38. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE
39. Still in the left panel, locate and delete the key:
    TimeSink, Inc.
40. Again Still in the left panel, locate and delete the key:
    Vladimir Romanov
41. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall
42. Still in the left panel, locate and delete the key:
    ReGet
43. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Run
3. In the right panel, locate and delete the entry:
   TimeSink Ad Client = %Program Files%\TimeSink>AdGateway>tsadbot.exe
4. Close Registry Editor.

To delete malware/grayware component files:

1. Search for the following files:
   

   
   
   • %Program Files%\ReGet\ReGet.inf
   
   
   • %Program Files%\ReGet\ReGet.exe
   
   
   • %Program Files%\ReGet\ReGet.dll
   
   
   • %Program Files%\ReGet\update.dll
   
   
   • %Program Files%\ReGet\rg_all.htm
   
   
   • %Program Files%\ReGet\rg_link.htm
   
   
   • %Program Files%\ReGet\rg_list.htm
   
   
   • %Program Files%\ReGet\license.txt
   
   
   • %Program Files%\ReGet\ReGet.bmp
   
   
   • %Program Files%\ReGet\Button.bmp
   
   
   • %Program Files%\ReGet\ReGet.chm
   
   
   • %Program Files%\ReGet\TSUninst.exe
   
   
   • %Program Files%\ReGet\ReGetAd.bmp
   
   
   • %Program Files%\ReGet\ReGetAd.url
   
   
   • %Program Files%\ReGet\Button1.bmp
   
   
   • %Program Files%\ReGet\Button1.url
   
   
   • %Program Files%\ReGet\Button2.bmp
   
   
   • %Program Files%\ReGet\Button2.url
   
   
   • %Program Files%\TimeSink\AdGateway\tsadbot.exe
   
   
   • %Windows%\tsad.dll
   
   

   
   Note: To do a search for the following files, right-click Start then click Search... or Find..., depending on the version of Windows you are running. For each file to be deleted, type its file name in the Named input box. In the Look In drop-down list, select My Computer, then press Enter.
2. Once located, select the file then press SHIFT+DELETE to permanently delete the file.
3. Repeat the said steps for all files listed.