TSPY_KELOGR.LISM

To restart in Safe Mode:

• For Windows 2000 users

1. Restart your computer.
2. Press F8 when you see the Starting Windows bar at the bottom of the screen.
3. Choose the Safe Mode option from the Windows Advanced Options menu then press Enter.

• For Windows XP users

1. Restart your computer.
2. Press F8 after the Power-On Self Test (POST) routine is done. If the Windows Advanced Options menu does not appear, try restarting then pressing F8 several times when the POST screen appears.
3. Choose the Safe Mode option from the Windows Advanced Options menu then press Enter.

• For Windows Server 2003 users

1. Restart your computer.
2. Press F8 after Windows starts up. If the Windows Advanced Options menu does not appear, try restarting again and pressing F8 several times afterward.
3. On the Windows Advanced Option menu, use the arrow keys to select Safe Mode then press Enter.

• For Windows Vista, Windows 7, and Windows Server 2008 users

1. Restart your computer.
2. Press F8 after the Power-On Self Test (POST) routine is done. If the Advanced Boot Options menu does not appear, try restarting and then pressing F8 several times after the POST screen is displayed.
3. On the Advanced Boot Options menu, use the arrow keys to select the Safe Mode option, and then press Enter.

• For Windows 8, Windows 8.1, and Windows Server 2012 users

1. Access the Charms bar by moving your mouse pointer to the upper right corner of the screen.
2. Move your mouse pointer down and click Settings>Change your PC Settings.
3. In the left panel, click General.
4. In the right panel, scroll down to the bottom to find the Advanced startup section, then click the Restart now button and wait for the system to restart.
5. In the Advanced Startup menu, click Troubleshoot>Advanced Options>Startup Settings>Restart and wait for the system to restart.
6. In the Startup Settings menu, press 4 to enable safe mode.

To enable Registry Editor, Task Manager, and Folder options:

1. Open Notepad. To do this:
   
   • For Windows 2000, XP, and Server 2003 users:
     Click Start>Run, type Notepad in the text box provided, then press Enter.
   • For Windows Vista, 7, and Server 2008 users:
     Click start. Type Notepad , then press Enter.
   • For Windows 8, 8.1, and 2012 users:
     Right-click on the lower left corner of the screen. Click Run. Type Notepad in the input field, then press Enter.
2. Copy and paste the following script:
   On Error Resume Next Set shl = WScript.CreateObject("WScript.Shell") shl.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools" shl.RegDelete "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools" shl.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr" shl.RegDelete "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr" shl.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions" shl.RegDelete "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions"
3. Save this file as C:\RESTORE.VBS.
4. Run C:\RESTORE.VBS by double-clicking on the file.
5. Click Yes at the prompt of the message box to execute the .VBS file.

To delete the registry key this malware/grayware created:

1. Open Registry Editor.
   » For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run, type regedit in the text box provided, and then press Enter.
   » For Windows Vista, Windows 7, and Windows Server 2008 users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, and Windows Server 2012 users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{97d25db0-0363-11cf-abc4-02608c9e7553}>1.0
3. Still in the left panel, locate and delete the key:
   FLAGS
4. Again Still in the left panel, locate and delete the key:
   HELPDIR
5. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
6. Still in the left panel, locate and delete the key:
   {FD8256D0-FD15-11CE-ABC4-02608C9E7553}
7. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{FD8256D0-FD15-11CE-ABC4-02608C9E7553}
8. Still in the left panel, locate and delete the key:
   ProxyStubClsid
9. Again Still in the left panel, locate and delete the key:
   ProxyStubClsid32
10. Again Still in the left panel, locate and delete the key:
    TypeLib
11. Again Still in the left panel, locate and delete the key:
    {001677D0-FD16-11CE-ABC4-02608C9E7553}
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{001677D0-FD16-11CE-ABC4-02608C9E7553}
13. Still in the left panel, locate and delete the key:
    ProxyStubClsid
14. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
15. Again Still in the left panel, locate and delete the key:
    TypeLib
16. Again Still in the left panel, locate and delete the key:
    {72B945E0-253B-11CF-A988-00AA006BC149}
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{72B945E0-253B-11CF-A988-00AA006BC149}
18. Still in the left panel, locate and delete the key:
    ProxyStubClsid
19. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
20. Again Still in the left panel, locate and delete the key:
    TypeLib
21. Again Still in the left panel, locate and delete the key:
    {451A0030-72EC-11CF-B03B-00AA006E0975}
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{451A0030-72EC-11CF-B03B-00AA006E0975}
23. Still in the left panel, locate and delete the key:
    ProxyStubClsid
24. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
25. Again Still in the left panel, locate and delete the key:
    TypeLib
26. Again Still in the left panel, locate and delete the key:
    {C6F602B6-8F69-11D0-8528-00C04FD8D503}
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C6F602B6-8F69-11D0-8528-00C04FD8D503}
28. Still in the left panel, locate and delete the key:
    ProxyStubClsid
29. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
30. Again Still in the left panel, locate and delete the key:
    TypeLib
31. Again Still in the left panel, locate and delete the key:
    {05792C8E-941F-11D0-8529-00C04FD8D503}
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{05792C8E-941F-11D0-8529-00C04FD8D503}
33. Still in the left panel, locate and delete the key:
    ProxyStubClsid
34. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
35. Again Still in the left panel, locate and delete the key:
    TypeLib
36. Again Still in the left panel, locate and delete the key:
    {79FA9AD0-A97C-11D0-8534-00C04FD8D503}
37. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{79FA9AD0-A97C-11D0-8534-00C04FD8D503}
38. Still in the left panel, locate and delete the key:
    ProxyStubClsid
39. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
40. Again Still in the left panel, locate and delete the key:
    TypeLib
41. Again Still in the left panel, locate and delete the key:
    {306E831C-5BC7-11D1-A3B8-00C04FB950DC}
42. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{306E831C-5BC7-11D1-A3B8-00C04FB950DC}
43. Still in the left panel, locate and delete the key:
    ProxyStubClsid
44. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
45. Again Still in the left panel, locate and delete the key:
    TypeLib
46. Again Still in the left panel, locate and delete the key:
    {B2BD0902-8878-11D1-8C21-00C04FD8D503}
47. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B2BD0902-8878-11D1-8C21-00C04FD8D503}
48. Still in the left panel, locate and delete the key:
    ProxyStubClsid
49. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
50. Again Still in the left panel, locate and delete the key:
    TypeLib
51. Again Still in the left panel, locate and delete the key:
    {28B96BA0-B330-11CF-A9AD-00AA006BC149}
52. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{28B96BA0-B330-11CF-A9AD-00AA006BC149}
53. Still in the left panel, locate and delete the key:
    ProxyStubClsid
54. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
55. Again Still in the left panel, locate and delete the key:
    TypeLib
56. Again Still in the left panel, locate and delete the key:
    {C8F93DD0-4AE0-11CF-9E73-00AA004A5691}
57. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C8F93DD0-4AE0-11CF-9E73-00AA004A5691}
58. Still in the left panel, locate and delete the key:
    ProxyStubClsid
59. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
60. Again Still in the left panel, locate and delete the key:
    TypeLib
61. Again Still in the left panel, locate and delete the key:
    {C8F93DD3-4AE0-11CF-9E73-00AA004A5691}
62. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C8F93DD3-4AE0-11CF-9E73-00AA004A5691}
63. Still in the left panel, locate and delete the key:
    ProxyStubClsid
64. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
65. Again Still in the left panel, locate and delete the key:
    TypeLib
66. Again Still in the left panel, locate and delete the key:
    {C8F93DD2-4AE0-11CF-9E73-00AA004A5691}
67. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C8F93DD2-4AE0-11CF-9E73-00AA004A5691}
68. Still in the left panel, locate and delete the key:
    ProxyStubClsid
69. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
70. Again Still in the left panel, locate and delete the key:
    TypeLib
71. Again Still in the left panel, locate and delete the key:
    {A05E03A2-EFFE-11CF-8ABC-00C04FD8D503}
72. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A05E03A2-EFFE-11CF-8ABC-00C04FD8D503}
73. Still in the left panel, locate and delete the key:
    ProxyStubClsid
74. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
75. Again Still in the left panel, locate and delete the key:
    TypeLib
76. Again Still in the left panel, locate and delete the key:
    {A1CD2DC6-EFFE-11CF-8ABC-00C04FD8D503}
77. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A1CD2DC6-EFFE-11CF-8ABC-00C04FD8D503}
78. Still in the left panel, locate and delete the key:
    ProxyStubClsid
79. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
80. Again Still in the left panel, locate and delete the key:
    TypeLib
81. Again Still in the left panel, locate and delete the key:
    {A2F733B8-EFFE-11CF-8ABC-00C04FD8D503}
82. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A2F733B8-EFFE-11CF-8ABC-00C04FD8D503}
83. Still in the left panel, locate and delete the key:
    ProxyStubClsid
84. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
85. Again Still in the left panel, locate and delete the key:
    TypeLib
86. Again Still in the left panel, locate and delete the key:
    {00E4C220-FD16-11CE-ABC4-02608C9E7553}
87. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{00E4C220-FD16-11CE-ABC4-02608C9E7553}
88. Still in the left panel, locate and delete the key:
    ProxyStubClsid
89. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
90. Again Still in the left panel, locate and delete the key:
    TypeLib
91. Again Still in the left panel, locate and delete the key:
    {EFE3CC70-1D9F-11CF-B1F3-02608C9E7553}
92. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{EFE3CC70-1D9F-11CF-B1F3-02608C9E7553}
93. Still in the left panel, locate and delete the key:
    ProxyStubClsid
94. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
95. Again Still in the left panel, locate and delete the key:
    TypeLib
96. Again Still in the left panel, locate and delete the key:
    {EF497680-1D9F-11CF-B1F3-02608C9E7553}
97. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{EF497680-1D9F-11CF-B1F3-02608C9E7553}
98. Still in the left panel, locate and delete the key:
    ProxyStubClsid
99. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
100. Again Still in the left panel, locate and delete the key:
     TypeLib
101. Again Still in the left panel, locate and delete the key:
     {27636B00-410F-11CF-B1FF-02608C9E7553}
102. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{27636B00-410F-11CF-B1FF-02608C9E7553}
103. Still in the left panel, locate and delete the key:
     ProxyStubClsid
104. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
105. Again Still in the left panel, locate and delete the key:
     TypeLib
106. Again Still in the left panel, locate and delete the key:
     {3E37E320-17E2-11CF-ABC4-02608C9E7553}
107. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{3E37E320-17E2-11CF-ABC4-02608C9E7553}
108. Still in the left panel, locate and delete the key:
     ProxyStubClsid
109. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
110. Again Still in the left panel, locate and delete the key:
     TypeLib
111. Again Still in the left panel, locate and delete the key:
     {B15160D0-1226-11CF-A985-00AA006BC149}
112. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B15160D0-1226-11CF-A985-00AA006BC149}
113. Still in the left panel, locate and delete the key:
     ProxyStubClsid
114. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
115. Again Still in the left panel, locate and delete the key:
     TypeLib
116. Again Still in the left panel, locate and delete the key:
     {124BE5C0-156E-11CF-A986-00AA006BC149}
117. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{124BE5C0-156E-11CF-A986-00AA006BC149}
118. Still in the left panel, locate and delete the key:
     ProxyStubClsid
119. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
120. Again Still in the left panel, locate and delete the key:
     TypeLib
121. Again Still in the left panel, locate and delete the key:
     {32FB6780-1ED0-11CF-A988-00AA006BC149}
122. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{32FB6780-1ED0-11CF-A988-00AA006BC149}
123. Still in the left panel, locate and delete the key:
     ProxyStubClsid
124. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
125. Again Still in the left panel, locate and delete the key:
     TypeLib
126. Again Still in the left panel, locate and delete the key:
     {9A52DB30-1ECF-11CF-A988-00AA006BC149}
127. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{9A52DB30-1ECF-11CF-A988-00AA006BC149}
128. Still in the left panel, locate and delete the key:
     ProxyStubClsid
129. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
130. Again Still in the left panel, locate and delete the key:
     TypeLib
131. Again Still in the left panel, locate and delete the key:
     {68AF66E0-31CA-11CF-A98A-00AA006BC149}
132. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{68AF66E0-31CA-11CF-A98A-00AA006BC149}
133. Still in the left panel, locate and delete the key:
     ProxyStubClsid
134. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
135. Again Still in the left panel, locate and delete the key:
     TypeLib
136. Again Still in the left panel, locate and delete the key:
     {5D7B33F0-31CA-11CF-A98A-00AA006BC149}
137. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{5D7B33F0-31CA-11CF-A98A-00AA006BC149}
138. Still in the left panel, locate and delete the key:
     ProxyStubClsid
139. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
140. Again Still in the left panel, locate and delete the key:
     TypeLib
141. Again Still in the left panel, locate and delete the key:
     {A89D1900-31CA-11CF-A98A-00AA006BC149}
142. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A89D1900-31CA-11CF-A98A-00AA006BC149}
143. Still in the left panel, locate and delete the key:
     ProxyStubClsid
144. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
145. Again Still in the left panel, locate and delete the key:
     TypeLib
146. Again Still in the left panel, locate and delete the key:
     {A02DED10-31CA-11CF-A98A-00AA006BC149}
147. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A02DED10-31CA-11CF-A98A-00AA006BC149}
148. Still in the left panel, locate and delete the key:
     ProxyStubClsid
149. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
150. Again Still in the left panel, locate and delete the key:
     TypeLib
151. Again Still in the left panel, locate and delete the key:
     {EB6DCAF0-4B83-11CF-A995-00AA006BC149}
152. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{EB6DCAF0-4B83-11CF-A995-00AA006BC149}
153. Still in the left panel, locate and delete the key:
     ProxyStubClsid
154. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
155. Again Still in the left panel, locate and delete the key:
     TypeLib
156. Again Still in the left panel, locate and delete the key:
     {398B7DA0-4AAB-11CF-AE2C-00AA006EBFB9}
157. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{398B7DA0-4AAB-11CF-AE2C-00AA006EBFB9}
158. Still in the left panel, locate and delete the key:
     ProxyStubClsid
159. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
160. Again Still in the left panel, locate and delete the key:
     TypeLib
161. Again Still in the left panel, locate and delete the key:
     {34A05B20-4AAB-11CF-AE2C-00AA006EBFB9}
162. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{34A05B20-4AAB-11CF-AE2C-00AA006EBFB9}
163. Still in the left panel, locate and delete the key:
     ProxyStubClsid
164. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
165. Again Still in the left panel, locate and delete the key:
     TypeLib
166. Again Still in the left panel, locate and delete the key:
     {DDF2891E-0F9C-11D0-8AD4-00C04FD8D503}
167. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{DDF2891E-0F9C-11D0-8AD4-00C04FD8D503}
168. Still in the left panel, locate and delete the key:
     ProxyStubClsid
169. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
170. Again Still in the left panel, locate and delete the key:
     TypeLib
171. Again Still in the left panel, locate and delete the key:
     {B4F3A14C-9BDD-11D0-852C-00C04FD8D503}
172. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B4F3A14C-9BDD-11D0-852C-00C04FD8D503}
173. Still in the left panel, locate and delete the key:
     ProxyStubClsid
174. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
175. Again Still in the left panel, locate and delete the key:
     TypeLib
176. Again Still in the left panel, locate and delete the key:
     {B7EE91CC-9BDD-11D0-852C-00C04FD8D503}
177. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B7EE91CC-9BDD-11D0-852C-00C04FD8D503}
178. Still in the left panel, locate and delete the key:
     ProxyStubClsid
179. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
180. Again Still in the left panel, locate and delete the key:
     TypeLib
181. Again Still in the left panel, locate and delete the key:
     {B8C787CA-9BDD-11D0-852C-00C04FD8D503}
182. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B8C787CA-9BDD-11D0-852C-00C04FD8D503}
183. Still in the left panel, locate and delete the key:
     ProxyStubClsid
184. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
185. Again Still in the left panel, locate and delete the key:
     TypeLib
186. Again Still in the left panel, locate and delete the key:
     {9068270B-0939-11D1-8BE1-00C04FD8D503}
187. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{9068270B-0939-11D1-8BE1-00C04FD8D503}
188. Still in the left panel, locate and delete the key:
     ProxyStubClsid
189. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
190. Again Still in the left panel, locate and delete the key:
     TypeLib
191. Again Still in the left panel, locate and delete the key:
     {B1B272A3-3625-11D1-A3A4-00C04FB950DC}
192. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B1B272A3-3625-11D1-A3A4-00C04FB950DC}
193. Still in the left panel, locate and delete the key:
     ProxyStubClsid
194. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
195. Again Still in the left panel, locate and delete the key:
     TypeLib
196. Again Still in the left panel, locate and delete the key:
     {7B66B533-4680-11D1-A3B4-00C04FB950DC}
197. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{7B66B533-4680-11D1-A3B4-00C04FB950DC}
198. Still in the left panel, locate and delete the key:
     ProxyStubClsid
199. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
200. Again Still in the left panel, locate and delete the key:
     TypeLib
201. Again Still in the left panel, locate and delete the key:
     {A910DEA9-4680-11D1-A3B4-00C04FB950DC}
202. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A910DEA9-4680-11D1-A3B4-00C04FB950DC}
203. Still in the left panel, locate and delete the key:
     ProxyStubClsid
204. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
205. Again Still in the left panel, locate and delete the key:
     TypeLib
206. Again Still in the left panel, locate and delete the key:
     {B21A50A9-4080-11D1-A3AC-00C04FB950DC}
207. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B21A50A9-4080-11D1-A3AC-00C04FB950DC}
208. Still in the left panel, locate and delete the key:
     ProxyStubClsid
209. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
210. Again Still in the left panel, locate and delete the key:
     TypeLib
211. Again Still in the left panel, locate and delete the key:
     {7B28B80F-4680-11D1-A3B4-00C04FB950DC}
212. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{7B28B80F-4680-11D1-A3B4-00C04FB950DC}
213. Still in the left panel, locate and delete the key:
     ProxyStubClsid
214. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
215. Again Still in the left panel, locate and delete the key:
     TypeLib
216. Again Still in the left panel, locate and delete the key:
     {97AF011A-478E-11D1-A3B4-00C04FB950DC}
217. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{97AF011A-478E-11D1-A3B4-00C04FB950DC}
218. Still in the left panel, locate and delete the key:
     ProxyStubClsid
219. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
220. Again Still in the left panel, locate and delete the key:
     TypeLib
221. Again Still in the left panel, locate and delete the key:
     {B287FCD5-4080-11D1-A3AC-00C04FB950DC}
222. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B287FCD5-4080-11D1-A3AC-00C04FB950DC}
223. Still in the left panel, locate and delete the key:
     ProxyStubClsid
224. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
225. Again Still in the left panel, locate and delete the key:
     TypeLib
226. Again Still in the left panel, locate and delete the key:
     {F60FB803-4080-11D1-A3AC-00C04FB950DC}
227. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{F60FB803-4080-11D1-A3AC-00C04FB950DC}
228. Still in the left panel, locate and delete the key:
     ProxyStubClsid
229. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
230. Again Still in the left panel, locate and delete the key:
     TypeLib
231. Again Still in the left panel, locate and delete the key:
     {8452D3AB-0869-11D1-A377-00C04FB950DC}
232. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{8452D3AB-0869-11D1-A377-00C04FB950DC}
233. Still in the left panel, locate and delete the key:
     ProxyStubClsid
234. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
235. Again Still in the left panel, locate and delete the key:
     TypeLib
236. Again Still in the left panel, locate and delete the key:
     {B2F5A901-4080-11D1-A3AC-00C04FB950DC}
237. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B2F5A901-4080-11D1-A3AC-00C04FB950DC}
238. Still in the left panel, locate and delete the key:
     ProxyStubClsid
239. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
240. Again Still in the left panel, locate and delete the key:
     TypeLib
241. Again Still in the left panel, locate and delete the key:
     {7ADECF29-4680-11D1-A3B4-00C04FB950DC}
242. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{7ADECF29-4680-11D1-A3B4-00C04FB950DC}
243. Still in the left panel, locate and delete the key:
     ProxyStubClsid
244. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
245. Again Still in the left panel, locate and delete the key:
     TypeLib
246. Again Still in the left panel, locate and delete the key:
     {FD1302BD-4080-11D1-A3AC-00C04FB950DC}
247. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{FD1302BD-4080-11D1-A3AC-00C04FB950DC}
248. Still in the left panel, locate and delete the key:
     ProxyStubClsid
249. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
250. Again Still in the left panel, locate and delete the key:
     TypeLib
251. Again Still in the left panel, locate and delete the key:
     {B371A349-4080-11D1-A3AC-00C04FB950DC}
252. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B371A349-4080-11D1-A3AC-00C04FB950DC}
253. Still in the left panel, locate and delete the key:
     ProxyStubClsid
254. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
255. Again Still in the left panel, locate and delete the key:
     TypeLib
256. Again Still in the left panel, locate and delete the key:
     {B3EB3B37-4080-11D1-A3AC-00C04FB950DC}
257. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B3EB3B37-4080-11D1-A3AC-00C04FB950DC}
258. Still in the left panel, locate and delete the key:
     ProxyStubClsid
259. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
260. Again Still in the left panel, locate and delete the key:
     TypeLib
261. Again Still in the left panel, locate and delete the key:
     {46F14FDA-232B-11D1-A808-00C04FD8D5A8}
262. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{46F14FDA-232B-11D1-A808-00C04FD8D5A8}
263. Still in the left panel, locate and delete the key:
     ProxyStubClsid
264. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
265. Again Still in the left panel, locate and delete the key:
     TypeLib
266. Again Still in the left panel, locate and delete the key:
     {D592AED4-F420-11D0-A36E-00C04FB950DC}
267. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{D592AED4-F420-11D0-A36E-00C04FB950DC}
268. Still in the left panel, locate and delete the key:
     ProxyStubClsid
269. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
270. Again Still in the left panel, locate and delete the key:
     TypeLib
271. Again Still in the left panel, locate and delete the key:
     {5BB11929-AFD1-11D2-9CB9-0000F87A369E}
272. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{5BB11929-AFD1-11D2-9CB9-0000F87A369E}
273. Still in the left panel, locate and delete the key:
     ProxyStubClsid
274. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
275. Again Still in the left panel, locate and delete the key:
     TypeLib
276. Again Still in the left panel, locate and delete the key:
     {6C6D65DC-AFD1-11D2-9CB9-0000F87A369E}
277. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{6C6D65DC-AFD1-11D2-9CB9-0000F87A369E}
278. Still in the left panel, locate and delete the key:
     ProxyStubClsid
279. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
280. Again Still in the left panel, locate and delete the key:
     TypeLib
281. Again Still in the left panel, locate and delete the key:
     {7E99C0A2-F935-11D2-BA96-00C04FB6D0D1}
282. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{7E99C0A2-F935-11D2-BA96-00C04FB6D0D1}
283. Still in the left panel, locate and delete the key:
     ProxyStubClsid
284. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
285. Again Still in the left panel, locate and delete the key:
     TypeLib
286. Again Still in the left panel, locate and delete the key:
     {370DF02E-F934-11D2-BA96-00C04FB6D0D1}
287. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{370DF02E-F934-11D2-BA96-00C04FB6D0D1}
288. Still in the left panel, locate and delete the key:
     ProxyStubClsid
289. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
290. Again Still in the left panel, locate and delete the key:
     TypeLib
291. Again Still in the left panel, locate and delete the key:
     {A63251B2-5F21-474B-AB52-4A8EFAD10895}
292. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A63251B2-5F21-474B-AB52-4A8EFAD10895}
293. Still in the left panel, locate and delete the key:
     ProxyStubClsid
294. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
295. Again Still in the left panel, locate and delete the key:
     TypeLib
296. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Policies>Microsoft>Windows
297. Still in the left panel, locate and delete the key:
     System
298. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Policies
299. Still in the left panel, locate and delete the key:
     System
300. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor.
   » For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run, type regedit in the text box provided, and then press Enter.
   » For Windows Vista, Windows 7, and Windows Server 2008 users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, and Windows Server 2012 users, right-click on the lower-left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Run
3. In the right panel, locate and delete the entry:
   Windows Update = "%User Profile%\Templates\.exe"
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{FD8256D0-FD15-11CE-ABC4-02608C9E7553}>TypeLib
5. In the right panel, locate and delete the entry:
   Version = "1.0"
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{001677D0-FD16-11CE-ABC4-02608C9E7553}>TypeLib
7. In the right panel, locate and delete the entry:
   Version = "1.0"
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{72B945E0-253B-11CF-A988-00AA006BC149}>TypeLib
9. In the right panel, locate and delete the entry:
   Version = "1.0"
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{451A0030-72EC-11CF-B03B-00AA006E0975}>TypeLib
11. In the right panel, locate and delete the entry:
    Version = "1.0"
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C6F602B6-8F69-11D0-8528-00C04FD8D503}>TypeLib
13. In the right panel, locate and delete the entry:
    Version = "1.0"
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{05792C8E-941F-11D0-8529-00C04FD8D503}>TypeLib
15. In the right panel, locate and delete the entry:
    Version = "1.0"
16. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{79FA9AD0-A97C-11D0-8534-00C04FD8D503}>TypeLib
17. In the right panel, locate and delete the entry:
    Version = "1.0"
18. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{306E831C-5BC7-11D1-A3B8-00C04FB950DC}>TypeLib
19. In the right panel, locate and delete the entry:
    Version = "1.0"
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B2BD0902-8878-11D1-8C21-00C04FD8D503}>TypeLib
21. In the right panel, locate and delete the entry:
    Version = "1.0"
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{28B96BA0-B330-11CF-A9AD-00AA006BC149}>TypeLib
23. In the right panel, locate and delete the entry:
    Version = "1.0"
24. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C8F93DD0-4AE0-11CF-9E73-00AA004A5691}>TypeLib
25. In the right panel, locate and delete the entry:
    Version = "1.0"
26. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C8F93DD3-4AE0-11CF-9E73-00AA004A5691}>TypeLib
27. In the right panel, locate and delete the entry:
    Version = "1.0"
28. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C8F93DD2-4AE0-11CF-9E73-00AA004A5691}>TypeLib
29. In the right panel, locate and delete the entry:
    Version = "1.0"
30. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A05E03A2-EFFE-11CF-8ABC-00C04FD8D503}>TypeLib
31. In the right panel, locate and delete the entry:
    Version = "1.0"
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A1CD2DC6-EFFE-11CF-8ABC-00C04FD8D503}>TypeLib
33. In the right panel, locate and delete the entry:
    Version = "1.0"
34. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A2F733B8-EFFE-11CF-8ABC-00C04FD8D503}>TypeLib
35. In the right panel, locate and delete the entry:
    Version = "1.0"
36. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{00E4C220-FD16-11CE-ABC4-02608C9E7553}>TypeLib
37. In the right panel, locate and delete the entry:
    Version = "1.0"
38. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{EFE3CC70-1D9F-11CF-B1F3-02608C9E7553}>TypeLib
39. In the right panel, locate and delete the entry:
    Version = "1.0"
40. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{EF497680-1D9F-11CF-B1F3-02608C9E7553}>TypeLib
41. In the right panel, locate and delete the entry:
    Version = "1.0"
42. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{27636B00-410F-11CF-B1FF-02608C9E7553}>TypeLib
43. In the right panel, locate and delete the entry:
    Version = "1.0"
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{3E37E320-17E2-11CF-ABC4-02608C9E7553}>TypeLib
45. In the right panel, locate and delete the entry:
    Version = "1.0"
46. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B15160D0-1226-11CF-A985-00AA006BC149}>TypeLib
47. In the right panel, locate and delete the entry:
    Version = "1.0"
48. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{124BE5C0-156E-11CF-A986-00AA006BC149}>TypeLib
49. In the right panel, locate and delete the entry:
    Version = "1.0"
50. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{32FB6780-1ED0-11CF-A988-00AA006BC149}>TypeLib
51. In the right panel, locate and delete the entry:
    Version = "1.0"
52. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{9A52DB30-1ECF-11CF-A988-00AA006BC149}>TypeLib
53. In the right panel, locate and delete the entry:
    Version = "1.0"
54. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{68AF66E0-31CA-11CF-A98A-00AA006BC149}>TypeLib
55. In the right panel, locate and delete the entry:
    Version = "1.0"
56. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{5D7B33F0-31CA-11CF-A98A-00AA006BC149}>TypeLib
57. In the right panel, locate and delete the entry:
    Version = "1.0"
58. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A89D1900-31CA-11CF-A98A-00AA006BC149}>TypeLib
59. In the right panel, locate and delete the entry:
    Version = "1.0"
60. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A02DED10-31CA-11CF-A98A-00AA006BC149}>TypeLib
61. In the right panel, locate and delete the entry:
    Version = "1.0"
62. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{EB6DCAF0-4B83-11CF-A995-00AA006BC149}>TypeLib
63. In the right panel, locate and delete the entry:
    Version = "1.0"
64. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{398B7DA0-4AAB-11CF-AE2C-00AA006EBFB9}>TypeLib
65. In the right panel, locate and delete the entry:
    Version = "1.0"
66. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{34A05B20-4AAB-11CF-AE2C-00AA006EBFB9}>TypeLib
67. In the right panel, locate and delete the entry:
    Version = "1.0"
68. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{DDF2891E-0F9C-11D0-8AD4-00C04FD8D503}>TypeLib
69. In the right panel, locate and delete the entry:
    Version = "1.0"
70. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B4F3A14C-9BDD-11D0-852C-00C04FD8D503}>TypeLib
71. In the right panel, locate and delete the entry:
    Version = "1.0"
72. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B7EE91CC-9BDD-11D0-852C-00C04FD8D503}>TypeLib
73. In the right panel, locate and delete the entry:
    Version = "1.0"
74. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B8C787CA-9BDD-11D0-852C-00C04FD8D503}>TypeLib
75. In the right panel, locate and delete the entry:
    Version = "1.0"
76. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{9068270B-0939-11D1-8BE1-00C04FD8D503}>TypeLib
77. In the right panel, locate and delete the entry:
    Version = "1.0"
78. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B1B272A3-3625-11D1-A3A4-00C04FB950DC}>TypeLib
79. In the right panel, locate and delete the entry:
    Version = "1.0"
80. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{7B66B533-4680-11D1-A3B4-00C04FB950DC}>TypeLib
81. In the right panel, locate and delete the entry:
    Version = "1.0"
82. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A910DEA9-4680-11D1-A3B4-00C04FB950DC}>TypeLib
83. In the right panel, locate and delete the entry:
    Version = "1.0"
84. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B21A50A9-4080-11D1-A3AC-00C04FB950DC}>TypeLib
85. In the right panel, locate and delete the entry:
    Version = "1.0"
86. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{7B28B80F-4680-11D1-A3B4-00C04FB950DC}>TypeLib
87. In the right panel, locate and delete the entry:
    Version = "1.0"
88. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{97AF011A-478E-11D1-A3B4-00C04FB950DC}>TypeLib
89. In the right panel, locate and delete the entry:
    Version = "1.0"
90. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B287FCD5-4080-11D1-A3AC-00C04FB950DC}>TypeLib
91. In the right panel, locate and delete the entry:
    Version = "1.0"
92. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{F60FB803-4080-11D1-A3AC-00C04FB950DC}>TypeLib
93. In the right panel, locate and delete the entry:
    Version = "1.0"
94. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{8452D3AB-0869-11D1-A377-00C04FB950DC}>TypeLib
95. In the right panel, locate and delete the entry:
    Version = "1.0"
96. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B2F5A901-4080-11D1-A3AC-00C04FB950DC}>TypeLib
97. In the right panel, locate and delete the entry:
    Version = "1.0"
98. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{7ADECF29-4680-11D1-A3B4-00C04FB950DC}>TypeLib
99. In the right panel, locate and delete the entry:
    Version = "1.0"
100. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{FD1302BD-4080-11D1-A3AC-00C04FB950DC}>TypeLib
101. In the right panel, locate and delete the entry:
     Version = "1.0"
102. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B371A349-4080-11D1-A3AC-00C04FB950DC}>TypeLib
103. In the right panel, locate and delete the entry:
     Version = "1.0"
104. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B3EB3B37-4080-11D1-A3AC-00C04FB950DC}>TypeLib
105. In the right panel, locate and delete the entry:
     Version = "1.0"
106. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{46F14FDA-232B-11D1-A808-00C04FD8D5A8}>TypeLib
107. In the right panel, locate and delete the entry:
     Version = "1.0"
108. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{D592AED4-F420-11D0-A36E-00C04FB950DC}>TypeLib
109. In the right panel, locate and delete the entry:
     Version = "1.0"
110. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{5BB11929-AFD1-11D2-9CB9-0000F87A369E}>TypeLib
111. In the right panel, locate and delete the entry:
     Version = "1.0"
112. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{6C6D65DC-AFD1-11D2-9CB9-0000F87A369E}>TypeLib
113. In the right panel, locate and delete the entry:
     Version = "1.0"
114. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{7E99C0A2-F935-11D2-BA96-00C04FB6D0D1}>TypeLib
115. In the right panel, locate and delete the entry:
     Version = "1.0"
116. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{370DF02E-F934-11D2-BA96-00C04FB6D0D1}>TypeLib
117. In the right panel, locate and delete the entry:
     Version = "1.0"
118. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A63251B2-5F21-474B-AB52-4A8EFAD10895}>TypeLib
119. In the right panel, locate and delete the entry:
     Version = "1.0"
120. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Winlogon>SpecialAccounts>UserList
121. In the right panel, locate and delete the entry:
     Universal = "0"
122. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>policies>system
123. In the right panel, locate and delete the entry:
     EnableLUA = "0"
124. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Policies>Microsoft>Windows>System
125. In the right panel, locate and delete the entry:
     DisableCMD = "1"
126. Close Registry Editor.

To restore registry values this malware/grayware modified:

1. Open Registry Editor. To do this:
   
   • On Windows 2000, XP, and Server 2003:
     Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
   • On Windows Vista, 7, and Server 2008:
     Click the Start button, type REGEDIT in the Search input field then press Enter.
   • On Windows 8, 8.1, and Server 2012:
     Right-click on the lower left corner of the screen and click Run, type REGEDIT in the Run input field, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>SystemRestore
3. In the right panel, locate the registry value:
   DisableSR = "1"
4. Close Registry Editor.

To manually delete a malware/grayware file from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the File name* input box, type the following:
   
   • %User Profile%\etc\hosts
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: The file name input box title varies depending on the Windows version (e.g. Search for files or folders named or All or part of the file name.).

• For Windows Vista, Windows 7, Windows Server 2008, Windows 8, Windows 8.1, and Windows Server 2012:

1. Open a Windows Explorer window.
   • For Windows Vista, 7, and Server 2008 users, click Start>Computer.
   • For Windows 8, 8.1, and Server 2012 users, right-click on the lower left corner of the screen, then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %User Profile%\etc\hosts
3. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete the malware/grayware folder:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %System Root%\Program Settings
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.