TSPY_BANKER.YWNKD

To delete the registry key this malware/grayware created:

1. Open Registry Editor.
   » For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run, type regedit in the text box provided, and then press Enter.
   » For Windows Vista, Windows 7, and Windows Server 2008 users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, and Windows Server 2012 users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Clients
3. Still in the left panel, locate and delete the key:
   NetworkAgentDriver
4. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Tz0
5. Still in the left panel, locate and delete the key:
   BIOS
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Tz0>Plugins
7. Still in the left panel, locate and delete the key:
   EMTask
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Control>SafeBoot>Minimal
9. Still in the left panel, locate and delete the key:
   NetworkAgent
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Control>SafeBoot>Network
11. Still in the left panel, locate and delete the key:
    NetworkAgent
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Tz0
13. Still in the left panel, locate and delete the key:
    BIOS
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Clients>NetworkAgentDriver
15. Still in the left panel, locate and delete the key:
    t0_secc
16. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor.
   » For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run, type regedit in the text box provided, and then press Enter.
   » For Windows Vista, Windows 7, and Windows Server 2008 users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, and Windows Server 2012 users, right-click on the lower-left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Clients>NetworkAgentDriver
3. In the right panel, locate and delete the entry:
   t0_macid = "ED46122B68D92852C094A6E46F"
4. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Tz0>BIOS
5. In the right panel, locate and delete the entry:
   SMBiosType = "PHYSMEM"
6. Again In the right panel, locate and delete the entry:
   SMBios = "{random values}"
7. Again In the right panel, locate and delete the entry:
   t0_macid = "30380C2D6EE7266CEA7FD9383A"
8. Again In the right panel, locate and delete the entry:
   t0_s = "109139122142134090"
9. Again In the right panel, locate and delete the entry:
   t0_deb = "1"
10. Again In the right panel, locate and delete the entry:
    t0_sp = "092083117112098103093104112108117140146140141126134076075117"
11. Again In the right panel, locate and delete the entry:
    t0_sn = "144144141122140132071126145126"
12. Again In the right panel, locate and delete the entry:
    t0_mut = "0"
13. Again In the right panel, locate and delete the entry:
    t0_mutp = "092083117112098103093104112108117140146140141126134076075117"
14. Again In the right panel, locate and delete the entry:
    t0_mutt = "073"
15. Again In the right panel, locate and delete the entry:
    t0_mutx = "073"
16. Again In the right panel, locate and delete the entry:
    t0_tray = "0"
17. Again In the right panel, locate and delete the entry:
    t0_usrt = "0"
18. Again In the right panel, locate and delete the entry:
    t0_fpreset = "1"
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Tz0>Plugins>EMTask
20. In the right panel, locate and delete the entry:
    p_build = "1.0.0.20"
21. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>Services>NetworkAgent
22. In the right panel, locate and delete the entry:
    ImagePath = "%System%\wwtask.exe -service"
23. Again In the right panel, locate and delete the entry:
    Description = "Manages objects protocols in the Network and Dial-Up synchronizations"
24. Again In the right panel, locate and delete the entry:
    DisplayName = "Network Agent Driver Tz0"
25. Again In the right panel, locate and delete the entry:
    t0_dlt = "{random characters}"
26. Again In the right panel, locate and delete the entry:
    t0_macid = "363E0A53B0A1EF1A380C2E6CF6"
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Tz0>BIOS
28. In the right panel, locate and delete the entry:
    SMBiosType = "PHYSMEM"
29. Again In the right panel, locate and delete the entry:
    SMBios = "{random values}"
30. Again In the right panel, locate and delete the entry:
    t0_macid = "141C283152C3C1C9481C3E5CE6"
31. Again In the right panel, locate and delete the entry:
    t0_s = "140141122139128122141126"
32. Again In the right panel, locate and delete the entry:
    t0_p = "077076078082074"
33. Again In the right panel, locate and delete the entry:
    t0_rport = "0"
34. Again In the right panel, locate and delete the entry:
    t0_pdie = "0"
35. Again In the right panel, locate and delete the entry:
    t0_max = "3e7"
36. Again In the right panel, locate and delete the entry:
    t0_ui = "074"
37. Again In the right panel, locate and delete the entry:
    t0_pcrypt = "0"
38. Again In the right panel, locate and delete the entry:
    t0_pon = "0"
39. Again In the right panel, locate and delete the entry:
    t0_up = "0"
40. Again In the right panel, locate and delete the entry:
    t0_lvv = "{random characters}"
41. Again In the right panel, locate and delete the entry:
    t0_lvf = "{random characters}"
42. Again In the right panel, locate and delete the entry:
    t0_gtimer = "14997"
43. Again In the right panel, locate and delete the entry:
    t0_comp = "1"
44. Again In the right panel, locate and delete the entry:
    t0_recp = "0"
45. Again In the right panel, locate and delete the entry:
    t0_shadow = "0"
46. Again In the right panel, locate and delete the entry:
    t0_lb = "1"
47. Again In the right panel, locate and delete the entry:
    t0_lc = "2"
48. Again In the right panel, locate and delete the entry:
    t0_tray = "1"
49. Again In the right panel, locate and delete the entry:
    t0_exs = "0"
50. Again In the right panel, locate and delete the entry:
    t0_htm = "0"
51. Again In the right panel, locate and delete the entry:
    t0_fcnv = "0"
52. Again In the right panel, locate and delete the entry:
    t0_fct0 = "0"
53. Again In the right panel, locate and delete the entry:
    t0_secu = "074"
54. Again In the right panel, locate and delete the entry:
    t0_sece = "069"
55. Again In the right panel, locate and delete the entry:
    t0_sect = "3"
56. Again In the right panel, locate and delete the entry:
    t0_secwa = "1"
57. Again In the right panel, locate and delete the entry:
    t0_secw = "4"
58. Again In the right panel, locate and delete the entry:
    t0_secss = "500000000111000"
59. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Clients>NetworkAgentDriver>t0_secc
60. In the right panel, locate and delete the entry:
    XT0 = "9"
61. Again In the right panel, locate and delete the entry:
    C0 = "{random characters}"
62. Close Registry Editor.