TSPY_BANCOS.XJOT

To delete the registry key this malware/grayware created:

1. Open Registry Editor.
   » For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run, type regedit in the text box provided, and then press Enter.
   » For Windows Vista, Windows 7, and Windows Server 2008 users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, and Windows Server 2012 users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Clients
3. Still in the left panel, locate and delete the key:
   NetworkAgentDriver
4. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Tz0
5. Still in the left panel, locate and delete the key:
   BIOS
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Tz0>Plugins
7. Still in the left panel, locate and delete the key:
   EMTask
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Control>SafeBoot>Minimal
9. Still in the left panel, locate and delete the key:
   NetworkAgent
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Control>SafeBoot>Network
11. Still in the left panel, locate and delete the key:
    NetworkAgent
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Tz0
13. Still in the left panel, locate and delete the key:
    BIOS
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Clients>NetworkAgentDriver
15. Still in the left panel, locate and delete the key:
    t0_secc
16. Again Still in the left panel, locate and delete the key:
    Agent
17. Again Still in the left panel, locate and delete the key:
    tlb
18. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor.
   » For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run, type regedit in the text box provided, and then press Enter.
   » For Windows Vista, Windows 7, and Windows Server 2008 users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, and Windows Server 2012 users, right-click on the lower-left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Clients>NetworkAgentDriver
3. In the right panel, locate and delete the entry:
   t0_macid = "DC55E17B988987F362F345B5A9"
4. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Tz0>BIOS
5. In the right panel, locate and delete the entry:
   SMBiosType = "PHYSMEM"
6. Again In the right panel, locate and delete the entry:
   SMBios = "{random values}"
7. Again In the right panel, locate and delete the entry:
   t0_macid = "FA73C790F36D9BE776CF699995"
8. Again In the right panel, locate and delete the entry:
   t0_s = "109139122142134090"
9. Again In the right panel, locate and delete the entry:
   t0_deb = "1"
10. Again In the right panel, locate and delete the entry:
    t0_sp = "092083117112098103093104112108117140146140141126134076075117"
11. Again In the right panel, locate and delete the entry:
    t0_sn = "144144141122140132071126145126"
12. Again In the right panel, locate and delete the entry:
    t0_mut = "0"
13. Again In the right panel, locate and delete the entry:
    t0_mutp = "092083117112098103093104112108117140146140141126134076075117"
14. Again In the right panel, locate and delete the entry:
    t0_mutt = "073"
15. Again In the right panel, locate and delete the entry:
    t0_mutx = "073"
16. Again In the right panel, locate and delete the entry:
    t0_tray = "0"
17. Again In the right panel, locate and delete the entry:
    t0_usrt = "0"
18. Again In the right panel, locate and delete the entry:
    t0_fpreset = "1"
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Tz0>Plugins>EMTask
20. In the right panel, locate and delete the entry:
    p_build = "1.0.0.20"
21. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>Services>NetworkAgent
22. In the right panel, locate and delete the entry:
    ImagePath = "%System%\wwtask.exe -service"
23. Again In the right panel, locate and delete the entry:
    Description = "Manages objects protocols in the Network and Dial-Up synchronizations"
24. Again In the right panel, locate and delete the entry:
    DisplayName = "Network Agent Driver Tz0"
25. Again In the right panel, locate and delete the entry:
    t0_dlt = "{random characters}"
26. Again In the right panel, locate and delete the entry:
    t0_macid = "50D86DCECD47454DCB65F60B07"
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Tz0>BIOS
28. In the right panel, locate and delete the entry:
    SMBiosType = "PHYSMEM"
29. Again In the right panel, locate and delete the entry:
    SMBios = "{random values}"
30. Again In the right panel, locate and delete the entry:
    t0_macid = "9890A4B5D648464CCA64F50478"
31. Again In the right panel, locate and delete the entry:
    t0_deb = "0"
32. Again In the right panel, locate and delete the entry:
    t0_p = "077076078082074"
33. Again In the right panel, locate and delete the entry:
    t0_rport = "0"
34. Again In the right panel, locate and delete the entry:
    t0_pdie = "0"
35. Again In the right panel, locate and delete the entry:
    t0_max = "1"
36. Again In the right panel, locate and delete the entry:
    t0_ui = "074"
37. Again In the right panel, locate and delete the entry:
    t0_pcrypt = "0"
38. Again In the right panel, locate and delete the entry:
    t0_pon = "0"
39. Again In the right panel, locate and delete the entry:
    t0_up = "0"
40. Again In the right panel, locate and delete the entry:
    t0_lvv = "{random characters}"
41. Again In the right panel, locate and delete the entry:
    t0_lvf = "{random characters}"
42. Again In the right panel, locate and delete the entry:
    t0_gtimer = "14997"
43. Again In the right panel, locate and delete the entry:
    t0_comp = "1"
44. Again In the right panel, locate and delete the entry:
    t0_recp = "0"
45. Again In the right panel, locate and delete the entry:
    t0_shadow = "0"
46. Again In the right panel, locate and delete the entry:
    t0_lb = "1"
47. Again In the right panel, locate and delete the entry:
    t0_lc = "2"
48. Again In the right panel, locate and delete the entry:
    t0_exs = "0"
49. Again In the right panel, locate and delete the entry:
    t0_htm = "0"
50. Again In the right panel, locate and delete the entry:
    t0_fcnv = "0"
51. Again In the right panel, locate and delete the entry:
    t0_fct0 = "0"
52. Again In the right panel, locate and delete the entry:
    t0_secu = "074"
53. Again In the right panel, locate and delete the entry:
    t0_sece = "069"
54. Again In the right panel, locate and delete the entry:
    t0_sect = "0"
55. Again In the right panel, locate and delete the entry:
    t0_secwa = "0"
56. Again In the right panel, locate and delete the entry:
    t0_secw = "4"
57. Again In the right panel, locate and delete the entry:
    t0_secss = "211111111000000"
58. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Clients>NetworkAgentDriver>t0_secc
59. In the right panel, locate and delete the entry:
    XT0 = "1"
60. Again In the right panel, locate and delete the entry:
    C0 = "{random characters}"
61. Again In the right panel, locate and delete the entry:
    C1 = "{random characters}"
62. Again In the right panel, locate and delete the entry:
    t0_rcimg = "1"
63. Again In the right panel, locate and delete the entry:
    t0_acti = "074073071074071074071078073"
64. Again In the right panel, locate and delete the entry:
    t0_actp = "080080073"
65. Again In the right panel, locate and delete the entry:
    t0_actr = "1"
66. Again In the right panel, locate and delete the entry:
    t0_fpreset = "0"
67. Again In the right panel, locate and delete the entry:
    t0_whw = "1f8"
68. Again In the right panel, locate and delete the entry:
    t0_tmem = "0"
69. Again In the right panel, locate and delete the entry:
    t0_1 = "075078070073082070075073074076057074075083078080083077081068080076078074078074"
70. Again In the right panel, locate and delete the entry:
    t0_mco = "{random characters}"
71. Again In the right panel, locate and delete the entry:
    t0_afpp = "0"
72. Again In the right panel, locate and delete the entry:
    t0_syssec = "0"
73. Again In the right panel, locate and delete the entry:
    t0_okey = "0"
74. Again In the right panel, locate and delete the entry:
    t0_ofiles = "0"
75. Again In the right panel, locate and delete the entry:
    t0_obrow = "0"
76. Again In the right panel, locate and delete the entry:
    t0_spkey = "0"
77. Again In the right panel, locate and delete the entry:
    t0_met_clip = "0"
78. Again In the right panel, locate and delete the entry:
    t0_Off_Prof_Adv = "1"
79. Again In the right panel, locate and delete the entry:
    t0_AgDetect_Adv = "1"
80. Again In the right panel, locate and delete the entry:
    t0_AgDetect_Abs = "1"
81. Again In the right panel, locate and delete the entry:
    t0_cri_up = "0"
82. Again In the right panel, locate and delete the entry:
    t0_hyber = "{random values}"
83. Again In the right panel, locate and delete the entry:
    t0_st_p = "1"
84. Again In the right panel, locate and delete the entry:
    t0_prot = "0"
85. Again In the right panel, locate and delete the entry:
    t0_upi = "074073071074071074071078073"
86. Again In the right panel, locate and delete the entry:
    t0_perft1 = "1"
87. Again In the right panel, locate and delete the entry:
    t0_perft2 = "f"
88. Again In the right panel, locate and delete the entry:
    t0_perfast = "0"
89. Again In the right panel, locate and delete the entry:
    t0_perfr = "0"
90. Again In the right panel, locate and delete the entry:
    t0_afplog = "0"
91. Again In the right panel, locate and delete the entry:
    t0_rulog = "0"
92. Again In the right panel, locate and delete the entry:
    t0_pipe = "3CF309080F00051105010F2CE822F93EC346C254DD42E258CA40CB8DDB7DDA61F741113202"
93. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Tz0>Agent
94. In the right panel, locate and delete the entry:
    Build = "b"
95. Again In the right panel, locate and delete the entry:
    DateBuild = "13.07.2011"
96. Again In the right panel, locate and delete the entry:
    Codename = "NerdCast.x2"
97. Again In the right panel, locate and delete the entry:
    t0_perf_r = "0"
98. Again In the right panel, locate and delete the entry:
    t0_macid = "3C340059BAABD9203E172052CE"
99. Again In the right panel, locate and delete the entry:
    t0_uid = "VPC5618252832641194198215246371816497952X43386"
100. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Clients>NetworkAgentDriver>tlb
101. In the right panel, locate and delete the entry:
     1 = "{random characters}"
102. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>Services>SharedAccess>Parameters>FirewallPolicy>StandardProfile>AuthorizedApplications>List
103. In the right panel, locate and delete the entry:
     %System%\wwtask.exe = "%System%\wwtask.exe:*:Enabled:Tz0 Network Agent Driver"
104. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>Services>SharedAccess>Parameters>FirewallPolicy>DomainProfile>AuthorizedApplications>List
105. In the right panel, locate and delete the entry:
     Tz0 Network Agent Driver = "%System%\wwtask.exe:*:Enabled:Tz0 Network Agent Driver"
106. Again In the right panel, locate and delete the entry:
     Tz0 Network Agent Driver = "%System%\wwtask.exe:*:Enabled:Tz0 Network Agent Driver"
107. Close Registry Editor.

To manually delete a malware/grayware file from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the File name* input box, type the following:
   
   • %System%\actt0.dep
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: The file name input box title varies depending on the Windows version (e.g. Search for files or folders named or All or part of the file name.).

• For Windows Vista, Windows 7, Windows Server 2008, Windows 8, Windows 8.1, and Windows Server 2012:

1. Open a Windows Explorer window.
   • For Windows Vista, 7, and Server 2008 users, click Start>Computer.
   • For Windows 8, 8.1, and Server 2012 users, right-click on the lower left corner of the screen, then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %System%\actt0.dep
3. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete the malware/grayware folder:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %System%\TWH
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.