Trojan.Win32.STASER.E

To terminate the malware/grayware/spyware process:

1. Scan your computer with your Trend Micro product and take note of the name of the malware/grayware/spyware detected.
2. Open Windows Task Manager. To do this, press CTRL+SHIFT+ESC.
3. View the list of all running programs. To do this:
   • For Windows 7 and Server 2008 (R2) users, click the Processes tab.
   • For Windows 8, 8.1, 10, and Server 2012 (R2) users, click the Details tab.
4. In the list of running programs, locate a malware/grayware/spyware file detected earlier.
5. Select the detected files, then press either the End Task or the End Process button, depending on the version of Windows you are using.
6. Do the same for the remaining detected malware/grayware/spyware files in the list of running programs.
7. To check if the malware/grayware/spyware process has been terminated, close Task Manager, and then open it again.
8. Close Task Manager.

To delete the registry value this malware/grayware created:

1. Open Registry Editor.
   » For Windows 7 and Windows Server 2008 (R2) users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2) users, right-click on the lower-left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>RestartManager>Session0000
3. In the right panel, locate and delete the entry:
   Owner = "\xf8\x0b\x00\x00\x18'\x03a\xd3\x84\xd5\x01"
4. Again In the right panel, locate and delete the entry:
   SessionHash = "{random characters}"
5. Again In the right panel, locate and delete the entry:
   Sequence = "1"
6. Again In the right panel, locate and delete the entry:
   RegFiles0000 = "\x00\x00\x00\x00"
7. Again In the right panel, locate and delete the entry:
   RegFilesHash = "{random characters}"
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Wow6432Node>Microsoft>Windows>CurrentVersion>Uninstall>Aurora Media Workshop_is1
9. In the right panel, locate and delete the entry:
   Inno Setup: Setup Version = "5.6.0 (a)"
10. Again In the right panel, locate and delete the entry:
    Inno Setup: App Path = "%Program Files%\Aurora Media Workshop"
11. Again In the right panel, locate and delete the entry:
    InstallLocation = "%Program Files%\Aurora Media Workshop"
12. Again In the right panel, locate and delete the entry:
    Inno Setup: Icon Group = "Aurora Media Workshop"
13. Again In the right panel, locate and delete the entry:
    Inno Setup: User = "{username}"
14. Again In the right panel, locate and delete the entry:
    Inno Setup: Language = "default"
15. Again In the right panel, locate and delete the entry:
    DisplayName = "Aurora Media Workshop 3.4.47"
16. Again In the right panel, locate and delete the entry:
    UninstallString = "%Program Files%\Aurora Media Workshop\unins000.exe"
17. Again In the right panel, locate and delete the entry:
    QuietUninstallString = "%Program Files%\Aurora Media Workshop\unins000.exe /SILENT"
18. Again In the right panel, locate and delete the entry:
    Publisher = "Aurora software, Inc."
19. Again In the right panel, locate and delete the entry:
    URLInfoAbout = "http://www.{BLOCKED}ox.com"
20. Again In the right panel, locate and delete the entry:
    HelpLink = "http://www.{BLOCKED}ox.com"
21. Again In the right panel, locate and delete the entry:
    URLUpdateInfo = "http://www.{BLOCKED}ox.com"
22. Again In the right panel, locate and delete the entry:
    NoModify = "1"
23. Again In the right panel, locate and delete the entry:
    NoRepair = "1"
24. Again In the right panel, locate and delete the entry:
    InstallDate = "20191017"
25. Again In the right panel, locate and delete the entry:
    EstimatedSize = "9325"
26. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{4D2B185F-005D-4151-AEFD-8F7E1161C636}
27. In the right panel, locate and delete the entry:
    (Default) = "IVideoCompressors"
28. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{4D2B185F-005D-4151-AEFD-8F7E1161C636}>ProxyStubClsid32
29. In the right panel, locate and delete the entry:
    (Default) = "{00020420-0000-0000-C000-000000000046}"
30. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{4D2B185F-005D-4151-AEFD-8F7E1161C636}>TypeLib
31. In the right panel, locate and delete the entry:
    (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
32. Again In the right panel, locate and delete the entry:
    Version = "1.0"
33. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{C2E365A1-483E-4111-9702-F349B07623E0}
34. In the right panel, locate and delete the entry:
    (Default) = "IAudioCompressors"
35. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{C2E365A1-483E-4111-9702-F349B07623E0}>ProxyStubClsid32
36. In the right panel, locate and delete the entry:
    (Default) = "{00020420-0000-0000-C000-000000000046}"
37. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{C2E365A1-483E-4111-9702-F349B07623E0}>TypeLib
38. In the right panel, locate and delete the entry:
    (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
39. Again In the right panel, locate and delete the entry:
    Version = "1.0"
40. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{615D8560-2CB6-49AA-A4FC-67E36E2BBD92}
41. In the right panel, locate and delete the entry:
    (Default) = "IWMVProfiles"
42. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{615D8560-2CB6-49AA-A4FC-67E36E2BBD92}>ProxyStubClsid32
43. In the right panel, locate and delete the entry:
    (Default) = "{00020420-0000-0000-C000-000000000046}"
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{615D8560-2CB6-49AA-A4FC-67E36E2BBD92}>TypeLib
45. In the right panel, locate and delete the entry:
    (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
46. Again In the right panel, locate and delete the entry:
    Version = "1.0"
47. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{7A89DAA0-62F8-4252-880F-365E0A518A26}
48. In the right panel, locate and delete the entry:
    (Default) = "ITransitions"
49. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{7A89DAA0-62F8-4252-880F-365E0A518A26}>ProxyStubClsid32
50. In the right panel, locate and delete the entry:
    (Default) = "{00020420-0000-0000-C000-000000000046}"
51. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{7A89DAA0-62F8-4252-880F-365E0A518A26}>TypeLib
52. In the right panel, locate and delete the entry:
    (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
53. Again In the right panel, locate and delete the entry:
    Version = "1.0"
54. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{C3BF142B-8DDF-411A-904A-21865C569A9C}
55. In the right panel, locate and delete the entry:
    (Default) = "IEffects"
56. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{C3BF142B-8DDF-411A-904A-21865C569A9C}>ProxyStubClsid32
57. In the right panel, locate and delete the entry:
    (Default) = "{00020420-0000-0000-C000-000000000046}"
58. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{C3BF142B-8DDF-411A-904A-21865C569A9C}>TypeLib
59. In the right panel, locate and delete the entry:
    (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
60. Again In the right panel, locate and delete the entry:
    Version = "1.0"
61. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{68F9B425-6EA2-4365-A956-83B5A396EBBF}
62. In the right panel, locate and delete the entry:
    (Default) = "_DVideoEdit"
63. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{68F9B425-6EA2-4365-A956-83B5A396EBBF}>ProxyStubClsid32
64. In the right panel, locate and delete the entry:
    (Default) = "{00020420-0000-0000-C000-000000000046}"
65. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{68F9B425-6EA2-4365-A956-83B5A396EBBF}>TypeLib
66. In the right panel, locate and delete the entry:
    (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
67. Again In the right panel, locate and delete the entry:
    Version = "1.0"
68. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{E050DEB5-639A-4730-80BC-A25AE602259D}
69. In the right panel, locate and delete the entry:
    (Default) = "_DVideoEditEvents"
70. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{E050DEB5-639A-4730-80BC-A25AE602259D}>ProxyStubClsid32
71. In the right panel, locate and delete the entry:
    (Default) = "{00020420-0000-0000-C000-000000000046}"
72. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{E050DEB5-639A-4730-80BC-A25AE602259D}>TypeLib
73. In the right panel, locate and delete the entry:
    (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
74. Again In the right panel, locate and delete the entry:
    Version = "1.0"
75. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{EA1F3829-2745-4181-955A-DBF78903B38F}
76. In the right panel, locate and delete the entry:
    (Default) = "IWMVProfile"
77. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{EA1F3829-2745-4181-955A-DBF78903B38F}>ProxyStubClsid32
78. In the right panel, locate and delete the entry:
    (Default) = "{00020420-0000-0000-C000-000000000046}"
79. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{EA1F3829-2745-4181-955A-DBF78903B38F}>TypeLib
80. In the right panel, locate and delete the entry:
    (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
81. Again In the right panel, locate and delete the entry:
    Version = "1.0"
82. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{A28929E9-5A90-4D2E-B34C-D303347EC55F}
83. In the right panel, locate and delete the entry:
    (Default) = "IEnumWMVProfiles"
84. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{A28929E9-5A90-4D2E-B34C-D303347EC55F}>ProxyStubClsid32
85. In the right panel, locate and delete the entry:
    (Default) = "{00020420-0000-0000-C000-000000000046}"
86. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{A28929E9-5A90-4D2E-B34C-D303347EC55F}>TypeLib
87. In the right panel, locate and delete the entry:
    (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
88. Again In the right panel, locate and delete the entry:
    Version = "1.0"
89. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{E970D30D-FC7F-4DE6-AF8A-C5A78E29DFF2}
90. In the right panel, locate and delete the entry:
    (Default) = "IVideoCompressor"
91. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{E970D30D-FC7F-4DE6-AF8A-C5A78E29DFF2}>ProxyStubClsid32
92. In the right panel, locate and delete the entry:
    (Default) = "{00020420-0000-0000-C000-000000000046}"
93. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{E970D30D-FC7F-4DE6-AF8A-C5A78E29DFF2}>TypeLib
94. In the right panel, locate and delete the entry:
    (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
95. Again In the right panel, locate and delete the entry:
    Version = "1.0"
96. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{6839A0B0-F264-48E5-93C4-45635C1C928B}
97. In the right panel, locate and delete the entry:
    (Default) = "IEnumVideoCompressors"
98. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{6839A0B0-F264-48E5-93C4-45635C1C928B}>ProxyStubClsid32
99. In the right panel, locate and delete the entry:
    (Default) = "{00020420-0000-0000-C000-000000000046}"
100. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{6839A0B0-F264-48E5-93C4-45635C1C928B}>TypeLib
101. In the right panel, locate and delete the entry:
     (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
102. Again In the right panel, locate and delete the entry:
     Version = "1.0"
103. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{132825D5-9CDB-416F-80CE-EF4038E6C60B}
104. In the right panel, locate and delete the entry:
     (Default) = "IAudioCompressor"
105. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{132825D5-9CDB-416F-80CE-EF4038E6C60B}>ProxyStubClsid32
106. In the right panel, locate and delete the entry:
     (Default) = "{00020420-0000-0000-C000-000000000046}"
107. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{132825D5-9CDB-416F-80CE-EF4038E6C60B}>TypeLib
108. In the right panel, locate and delete the entry:
     (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
109. Again In the right panel, locate and delete the entry:
     Version = "1.0"
110. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{1E8A407C-2809-4243-87B8-17B3E2CC03FC}
111. In the right panel, locate and delete the entry:
     (Default) = "IEnumAudioCompressors"
112. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{1E8A407C-2809-4243-87B8-17B3E2CC03FC}>ProxyStubClsid32
113. In the right panel, locate and delete the entry:
     (Default) = "{00020420-0000-0000-C000-000000000046}"
114. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{1E8A407C-2809-4243-87B8-17B3E2CC03FC}>TypeLib
115. In the right panel, locate and delete the entry:
     (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
116. Again In the right panel, locate and delete the entry:
     Version = "1.0"
117. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{1C08ABFD-2FBF-4F12-B332-32CAAFC22C21}
118. In the right panel, locate and delete the entry:
     (Default) = "ITransition"
119. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{1C08ABFD-2FBF-4F12-B332-32CAAFC22C21}>ProxyStubClsid32
120. In the right panel, locate and delete the entry:
     (Default) = "{00020420-0000-0000-C000-000000000046}"
121. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{1C08ABFD-2FBF-4F12-B332-32CAAFC22C21}>TypeLib
122. In the right panel, locate and delete the entry:
     (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
123. Again In the right panel, locate and delete the entry:
     Version = "1.0"
124. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{CE9422D3-3E4C-4584-8D01-AD3FF9B32674}
125. In the right panel, locate and delete the entry:
     (Default) = "IEnumTransitions"
126. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{CE9422D3-3E4C-4584-8D01-AD3FF9B32674}>ProxyStubClsid32
127. In the right panel, locate and delete the entry:
     (Default) = "{00020420-0000-0000-C000-000000000046}"
128. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{CE9422D3-3E4C-4584-8D01-AD3FF9B32674}>TypeLib
129. In the right panel, locate and delete the entry:
     (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
130. Again In the right panel, locate and delete the entry:
     Version = "1.0"
131. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{BA7B541A-5B8E-48C6-82DD-7841FE46320F}
132. In the right panel, locate and delete the entry:
     (Default) = "IEffect"
133. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{BA7B541A-5B8E-48C6-82DD-7841FE46320F}>ProxyStubClsid32
134. In the right panel, locate and delete the entry:
     (Default) = "{00020420-0000-0000-C000-000000000046}"
135. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{BA7B541A-5B8E-48C6-82DD-7841FE46320F}>TypeLib
136. In the right panel, locate and delete the entry:
     (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
137. Again In the right panel, locate and delete the entry:
     Version = "1.0"
138. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{B1C93753-37F9-42C7-BA46-507D93C809EF}
139. In the right panel, locate and delete the entry:
     (Default) = "IEnumEffects"
140. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{B1C93753-37F9-42C7-BA46-507D93C809EF}>ProxyStubClsid32
141. In the right panel, locate and delete the entry:
     (Default) = "{00020420-0000-0000-C000-000000000046}"
142. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{B1C93753-37F9-42C7-BA46-507D93C809EF}>TypeLib
143. In the right panel, locate and delete the entry:
     (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
144. Again In the right panel, locate and delete the entry:
     Version = "1.0"
145. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{2EEC36B3-5255-4F5A-9B0B-EC644326477B}
146. In the right panel, locate and delete the entry:
     (Default) = "VideoEdit Property Page"
147. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{2EEC36B3-5255-4F5A-9B0B-EC644326477B}>InprocServer32
148. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\AURORA~1\VIDEOE~1.OCX"
149. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VIDEOEDIT.VideoEditCtrl.1
150. In the right panel, locate and delete the entry:
     (Default) = "VideoEdit Gold Control"
151. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VIDEOEDIT.VideoEditCtrl.1>CLSID
152. In the right panel, locate and delete the entry:
     (Default) = "{57D9AF4C-23BA-47EC-A40B-2DA79641B285}"
153. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{57D9AF4C-23BA-47EC-A40B-2DA79641B285}
154. In the right panel, locate and delete the entry:
     (Default) = "VideoEdit Gold Control"
155. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{57D9AF4C-23BA-47EC-A40B-2DA79641B285}>ProgID
156. In the right panel, locate and delete the entry:
     (Default) = "VIDEOEDIT.VideoEditCtrl.1"
157. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{57D9AF4C-23BA-47EC-A40B-2DA79641B285}>InprocServer32
158. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\AURORA~1\VIDEOE~1.OCX"
159. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{57D9AF4C-23BA-47EC-A40B-2DA79641B285}>ToolboxBitmap32
160. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\AURORA~1\VIDEOE~1.OCX, 1"
161. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{57D9AF4C-23BA-47EC-A40B-2DA79641B285}>MiscStatus
162. In the right panel, locate and delete the entry:
     (Default) = "0"
163. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{57D9AF4C-23BA-47EC-A40B-2DA79641B285}>MiscStatus>1
164. In the right panel, locate and delete the entry:
     (Default) = "131473"
165. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{57D9AF4C-23BA-47EC-A40B-2DA79641B285}>Control
166. In the right panel, locate and delete the entry:
     (Default) = ""
167. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{57D9AF4C-23BA-47EC-A40B-2DA79641B285}>TypeLib
168. In the right panel, locate and delete the entry:
     (Default) = "{F2BD1C8B-41F5-4842-AC48-3B94E1F85FCE}"
169. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{57D9AF4C-23BA-47EC-A40B-2DA79641B285}>Version
170. In the right panel, locate and delete the entry:
     (Default) = "1.0"
171. Again In the right panel, locate and delete the entry:
     ThreadingModel = "Apartment"
172. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{731B8592-4001-46D4-B1A5-33EC792B4501}
173. In the right panel, locate and delete the entry:
     (Default) = "Elecard MPEG2 Demultiplexer"
174. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{731B8592-4001-46D4-B1A5-33EC792B4501}>InprocServer32
175. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\Aurora Media Workshop\mpeg2dmx.ax"
176. Again In the right panel, locate and delete the entry:
     ThreadingModel = "Both"
177. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{731B8682-4001-46D4-B1A5-33EC792B4501}
178. In the right panel, locate and delete the entry:
     (Default) = "Elecard MPEG2 Demultiplexer Property Page"
179. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{731B8682-4001-46D4-B1A5-33EC792B4501}>InprocServer32
180. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\Aurora Media Workshop\mpeg2dmx.ax"
181. Again In the right panel, locate and delete the entry:
     ThreadingModel = "Both"
182. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{083863F1-70DE-11D0-BD40-00A0C911CE86}>Instance>{731B8592-4001-46D4-B1A5-33EC792B4501}
183. In the right panel, locate and delete the entry:
     FriendlyName = "Elecard MPEG2 Demultiplexer"
184. Again In the right panel, locate and delete the entry:
     CLSID = "{731B8592-4001-46D4-B1A5-33EC792B4501}"
185. Again In the right panel, locate and delete the entry:
     FilterData = "{random characters}"
186. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{F50B3F13-19C4-11CF-AA9A-02608C9BABA2}
187. In the right panel, locate and delete the entry:
     (Default) = "Elecard MPEG2 Video Decoder"
188. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{F50B3F13-19C4-11CF-AA9A-02608C9BABA2}>InprocServer32
189. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\Aurora Media Workshop\mpgdec.ax"
190. Again In the right panel, locate and delete the entry:
     ThreadingModel = "Both"
191. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{F50B3F14-19C4-11CF-AA9A-02608C9BABA2}
192. In the right panel, locate and delete the entry:
     (Default) = "Elecard MPEG2 Video Decoder Property Page"
193. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{F50B3F14-19C4-11CF-AA9A-02608C9BABA2}>InprocServer32
194. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\Aurora Media Workshop\mpgdec.ax"
195. Again In the right panel, locate and delete the entry:
     ThreadingModel = "Both"
196. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{F50B3F15-19C4-11CF-AA9A-02608C9BABA2}
197. In the right panel, locate and delete the entry:
     (Default) = "Elecard MPEG2 Video Decoder Settings"
198. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{F50B3F15-19C4-11CF-AA9A-02608C9BABA2}>InprocServer32
199. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\Aurora Media Workshop\mpgdec.ax"
200. Again In the right panel, locate and delete the entry:
     ThreadingModel = "Both"
201. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{083863F1-70DE-11D0-BD40-00A0C911CE86}>Instance>{F50B3F13-19C4-11CF-AA9A-02608C9BABA2}
202. In the right panel, locate and delete the entry:
     FriendlyName = "Elecard MPEG2 Video Decoder"
203. Again In the right panel, locate and delete the entry:
     CLSID = "{F50B3F13-19C4-11CF-AA9A-02608C9BABA2}"
204. Again In the right panel, locate and delete the entry:
     FilterData = "{random characters}"
205. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{3690DD35-542A-482A-A21C-63142EF9BC6F}
206. In the right panel, locate and delete the entry:
     (Default) = "Essien MPEG Encoder Filter v4"
207. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{3690DD35-542A-482A-A21C-63142EF9BC6F}>InprocServer32
208. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\Aurora Media Workshop\DirectEncode.dll"
209. Again In the right panel, locate and delete the entry:
     ThreadingModel = "Both"
210. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{EF6F5BB9-637E-4B27-B54D-51EA574AFCC5}
211. In the right panel, locate and delete the entry:
     (Default) = "Essien MPEG Encoder Filter v4 Property Page"
212. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{EF6F5BB9-637E-4B27-B54D-51EA574AFCC5}>InprocServer32
213. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\Aurora Media Workshop\DirectEncode.dll"
214. Again In the right panel, locate and delete the entry:
     ThreadingModel = "Both"
215. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{083863F1-70DE-11D0-BD40-00A0C911CE86}>Instance>{3690DD35-542A-482A-A21C-63142EF9BC6F}
216. In the right panel, locate and delete the entry:
     FriendlyName = "Essien MPEG Encoder Filter v4"
217. Again In the right panel, locate and delete the entry:
     CLSID = "{3690DD35-542A-482A-A21C-63142EF9BC6F}"
218. Again In the right panel, locate and delete the entry:
     FilterData = "{random characters}"
219. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{3C78B8E2-6C4D-11D1-ADE2-0000F8754B99}
220. In the right panel, locate and delete the entry:
     (Default) = "WAV Dest"
221. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{3C78B8E2-6C4D-11D1-ADE2-0000F8754B99}>InprocServer32
222. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\Aurora Media Workshop\viscomwave.dll"
223. Again In the right panel, locate and delete the entry:
     ThreadingModel = "Both"
224. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{083863F1-70DE-11D0-BD40-00A0C911CE86}>Instance>{3C78B8E2-6C4D-11D1-ADE2-0000F8754B99}
225. In the right panel, locate and delete the entry:
     FriendlyName = "WAV Dest"
226. Again In the right panel, locate and delete the entry:
     CLSID = "{3C78B8E2-6C4D-11D1-ADE2-0000F8754B99}"
227. Again In the right panel, locate and delete the entry:
     FilterData = "\x02\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00\x00\x00"
228. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>NCTAudioPlayer2.AudioPlayer2.2
229. In the right panel, locate and delete the entry:
     (Default) = "NCTAudioPlayer2 Class"
230. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>NCTAudioPlayer2.AudioPlayer2.2>CLSID
231. In the right panel, locate and delete the entry:
     (Default) = "{8532DECB-E102-48A8-BE72-DADC2B02C49F}"
232. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>NCTAudioPlayer2.AudioPlayer2
233. In the right panel, locate and delete the entry:
     (Default) = "NCTAudioPlayer2 Class"
234. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>NCTAudioPlayer2.AudioPlayer2>CLSID
235. In the right panel, locate and delete the entry:
     (Default) = "{8532DECB-E102-48A8-BE72-DADC2B02C49F}"
236. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>NCTAudioPlayer2.AudioPlayer2>CurVer
237. In the right panel, locate and delete the entry:
     (Default) = "NCTAudioPlayer2.AudioPlayer2.2"
238. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{8532DECB-E102-48A8-BE72-DADC2B02C49F}
239. In the right panel, locate and delete the entry:
     (Default) = "NCTAudioPlayer2 Class"
240. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{8532DECB-E102-48A8-BE72-DADC2B02C49F}>ProgID
241. In the right panel, locate and delete the entry:
     (Default) = "NCTAudioPlayer2.AudioPlayer2.2"
242. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{8532DECB-E102-48A8-BE72-DADC2B02C49F}>VersionIndependentProgID
243. In the right panel, locate and delete the entry:
     (Default) = "NCTAudioPlayer2.AudioPlayer2"
244. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{8532DECB-E102-48A8-BE72-DADC2B02C49F}>InprocServer32
245. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\Aurora Media Workshop\NCTAudioPlayer2.dll"
246. Again In the right panel, locate and delete the entry:
     ThreadingModel = "Apartment"
247. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{8532DECB-E102-48A8-BE72-DADC2B02C49F}>TypeLib
248. In the right panel, locate and delete the entry:
     (Default) = "{2345C85B-969D-459C-90E9-D5E65ECC294E}"
249. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{DDED59B4-7070-4EA5-A688-90D80387E9CD}
250. In the right panel, locate and delete the entry:
     (Default) = "IAudioPlayer2"
251. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{DDED59B4-7070-4EA5-A688-90D80387E9CD}>ProxyStubClsid32
252. In the right panel, locate and delete the entry:
     (Default) = "{00020424-0000-0000-C000-000000000046}"
253. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{DDED59B4-7070-4EA5-A688-90D80387E9CD}>TypeLib
254. In the right panel, locate and delete the entry:
     (Default) = "{2345C85B-969D-459C-90E9-D5E65ECC294E}"
255. Again In the right panel, locate and delete the entry:
     Version = "2.0"
256. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{46AC87BA-BEC7-4546-A226-A11F8438FE42}
257. In the right panel, locate and delete the entry:
     (Default) = "_IAudioPlayer2Events"
258. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{46AC87BA-BEC7-4546-A226-A11F8438FE42}>ProxyStubClsid32
259. In the right panel, locate and delete the entry:
     (Default) = "{00020420-0000-0000-C000-000000000046}"
260. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{46AC87BA-BEC7-4546-A226-A11F8438FE42}>TypeLib
261. In the right panel, locate and delete the entry:
     (Default) = "{2345C85B-969D-459C-90E9-D5E65ECC294E}"
262. Again In the right panel, locate and delete the entry:
     Version = "2.0"
263. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>NCTAudioRecord2.AudioRecord2.2
264. In the right panel, locate and delete the entry:
     (Default) = "NCTAudioRecord2 Class"
265. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>NCTAudioRecord2.AudioRecord2.2>CLSID
266. In the right panel, locate and delete the entry:
     (Default) = "{1C9920E5-7623-4AAF-936B-A14BCAB742EC}"
267. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>NCTAudioRecord2.AudioRecord2
268. In the right panel, locate and delete the entry:
     (Default) = "NCTAudioRecord2 Class"
269. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>NCTAudioRecord2.AudioRecord2>CLSID
270. In the right panel, locate and delete the entry:
     (Default) = "{1C9920E5-7623-4AAF-936B-A14BCAB742EC}"
271. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>NCTAudioRecord2.AudioRecord2>CurVer
272. In the right panel, locate and delete the entry:
     (Default) = "NCTAudioRecord2.AudioRecord2.2"
273. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{1C9920E5-7623-4AAF-936B-A14BCAB742EC}
274. In the right panel, locate and delete the entry:
     (Default) = "NCTAudioRecord2 Class"
275. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{1C9920E5-7623-4AAF-936B-A14BCAB742EC}>ProgID
276. In the right panel, locate and delete the entry:
     (Default) = "NCTAudioRecord2.AudioRecord2.2"
277. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{1C9920E5-7623-4AAF-936B-A14BCAB742EC}>VersionIndependentProgID
278. In the right panel, locate and delete the entry:
     (Default) = "NCTAudioRecord2.AudioRecord2"
279. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{1C9920E5-7623-4AAF-936B-A14BCAB742EC}>InprocServer32
280. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\Aurora Media Workshop\NCTAudioRecord2.dll"
281. Again In the right panel, locate and delete the entry:
     ThreadingModel = "Apartment"
282. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{1C9920E5-7623-4AAF-936B-A14BCAB742EC}>TypeLib
283. In the right panel, locate and delete the entry:
     (Default) = "{26AEB14D-8715-4281-AEAC-3343AEB2630F}"
284. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{73F620FC-3000-44BC-A1C6-42DA6A2E2399}
285. In the right panel, locate and delete the entry:
     (Default) = "IAudioRecord2"
286. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{73F620FC-3000-44BC-A1C6-42DA6A2E2399}>ProxyStubClsid32
287. In the right panel, locate and delete the entry:
     (Default) = "{00020424-0000-0000-C000-000000000046}"
288. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{73F620FC-3000-44BC-A1C6-42DA6A2E2399}>TypeLib
289. In the right panel, locate and delete the entry:
     (Default) = "{26AEB14D-8715-4281-AEAC-3343AEB2630F}"
290. Again In the right panel, locate and delete the entry:
     Version = "2.0"
291. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{6F6E7853-C3D2-4A50-BA90-5D09A708EC0A}
292. In the right panel, locate and delete the entry:
     (Default) = "_IAudioRecord2Events"
293. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{6F6E7853-C3D2-4A50-BA90-5D09A708EC0A}>ProxyStubClsid32
294. In the right panel, locate and delete the entry:
     (Default) = "{00020420-0000-0000-C000-000000000046}"
295. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{6F6E7853-C3D2-4A50-BA90-5D09A708EC0A}>TypeLib
296. In the right panel, locate and delete the entry:
     (Default) = "{26AEB14D-8715-4281-AEAC-3343AEB2630F}"
297. Again In the right panel, locate and delete the entry:
     Version = "2.0"
298. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>NCTAudioVisualization2.AudioVisualization2.2
299. In the right panel, locate and delete the entry:
     (Default) = "NCTAudioVisualization2 Class"
300. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>NCTAudioVisualization2.AudioVisualization2.2>CLSID
301. In the right panel, locate and delete the entry:
     (Default) = "{D24FF6DB-59CF-44D6-96B9-023A901EF476}"
302. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>NCTAudioVisualization2.AudioVisualization2
303. In the right panel, locate and delete the entry:
     (Default) = "NCTAudioVisualization2 Class"
304. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>NCTAudioVisualization2.AudioVisualization2>CLSID
305. In the right panel, locate and delete the entry:
     (Default) = "{D24FF6DB-59CF-44D6-96B9-023A901EF476}"
306. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>NCTAudioVisualization2.AudioVisualization2>CurVer
307. In the right panel, locate and delete the entry:
     (Default) = "NCTAudioVisualization2.AudioVisualization2.2"
308. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{D24FF6DB-59CF-44D6-96B9-023A901EF476}
309. In the right panel, locate and delete the entry:
     (Default) = "NCTAudioVisualization2 Class"
310. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{D24FF6DB-59CF-44D6-96B9-023A901EF476}>ProgID
311. In the right panel, locate and delete the entry:
     (Default) = "NCTAudioVisualization2.AudioVisualization2.2"
312. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{D24FF6DB-59CF-44D6-96B9-023A901EF476}>VersionIndependentProgID
313. In the right panel, locate and delete the entry:
     (Default) = "NCTAudioVisualization2.AudioVisualization2"
314. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{D24FF6DB-59CF-44D6-96B9-023A901EF476}>InprocServer32
315. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\Aurora Media Workshop\NCTAudioVisualization2.dll"
316. Again In the right panel, locate and delete the entry:
     ThreadingModel = "Apartment"
317. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{D24FF6DB-59CF-44D6-96B9-023A901EF476}>ToolboxBitmap32
318. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\Aurora Media Workshop\NCTAudioVisualization2.dll, 101"
319. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{D24FF6DB-59CF-44D6-96B9-023A901EF476}>MiscStatus
320. In the right panel, locate and delete the entry:
     (Default) = "0"
321. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{D24FF6DB-59CF-44D6-96B9-023A901EF476}>MiscStatus>1
322. In the right panel, locate and delete the entry:
     (Default) = "131473"
323. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{D24FF6DB-59CF-44D6-96B9-023A901EF476}>TypeLib
324. In the right panel, locate and delete the entry:
     (Default) = "{32505FA1-6E30-4E62-BBF6-D0AF7AF4733F}"
325. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{D24FF6DB-59CF-44D6-96B9-023A901EF476}>Version
326. In the right panel, locate and delete the entry:
     (Default) = "2.0"
327. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{5B227078-049D-4679-BA05-7E58847AA314}
328. In the right panel, locate and delete the entry:
     (Default) = "IAudioVisualization2"
329. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{5B227078-049D-4679-BA05-7E58847AA314}>ProxyStubClsid32
330. In the right panel, locate and delete the entry:
     (Default) = "{00020424-0000-0000-C000-000000000046}"
331. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{5B227078-049D-4679-BA05-7E58847AA314}>TypeLib
332. In the right panel, locate and delete the entry:
     (Default) = "{32505FA1-6E30-4E62-BBF6-D0AF7AF4733F}"
333. Again In the right panel, locate and delete the entry:
     Version = "2.0"
334. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{8DB7E42E-B570-4D35-AA1A-FEA5F65125AB}
335. In the right panel, locate and delete the entry:
     (Default) = "_IAudioVisualization2Events"
336. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{8DB7E42E-B570-4D35-AA1A-FEA5F65125AB}>ProxyStubClsid32
337. In the right panel, locate and delete the entry:
     (Default) = "{00020420-0000-0000-C000-000000000046}"
338. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{8DB7E42E-B570-4D35-AA1A-FEA5F65125AB}>TypeLib
339. In the right panel, locate and delete the entry:
     (Default) = "{32505FA1-6E30-4E62-BBF6-D0AF7AF4733F}"
340. Again In the right panel, locate and delete the entry:
     Version = "2.0"
341. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{9F147551-86BA-4DDD-8873-FAB85BAEE8AE}
342. In the right panel, locate and delete the entry:
     (Default) = "IVideoCodecs"
343. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{9F147551-86BA-4DDD-8873-FAB85BAEE8AE}>ProxyStubClsid32
344. In the right panel, locate and delete the entry:
     (Default) = "{00020420-0000-0000-C000-000000000046}"
345. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{9F147551-86BA-4DDD-8873-FAB85BAEE8AE}>TypeLib
346. In the right panel, locate and delete the entry:
     (Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"
347. Again In the right panel, locate and delete the entry:
     Version = "1.0"
348. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{1B2D3B6E-1623-47BC-813C-4C953395A735}
349. In the right panel, locate and delete the entry:
     (Default) = "IAudioCodecs"
350. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{1B2D3B6E-1623-47BC-813C-4C953395A735}>ProxyStubClsid32
351. In the right panel, locate and delete the entry:
     (Default) = "{00020420-0000-0000-C000-000000000046}"
352. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{1B2D3B6E-1623-47BC-813C-4C953395A735}>TypeLib
353. In the right panel, locate and delete the entry:
     (Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"
354. Again In the right panel, locate and delete the entry:
     Version = "1.0"
355. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{8EA63A90-B82B-48C5-8B2B-1A105DB990E7}
356. In the right panel, locate and delete the entry:
     (Default) = "IAudioFormats"
357. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{8EA63A90-B82B-48C5-8B2B-1A105DB990E7}>ProxyStubClsid32
358. In the right panel, locate and delete the entry:
     (Default) = "{00020420-0000-0000-C000-000000000046}"
359. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{8EA63A90-B82B-48C5-8B2B-1A105DB990E7}>TypeLib
360. In the right panel, locate and delete the entry:
     (Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"
361. Again In the right panel, locate and delete the entry:
     Version = "1.0"
362. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{B57F2A8D-CA8B-47EE-9F1A-CD92A0ABB1A1}
363. In the right panel, locate and delete the entry:
     (Default) = "ILanguages"
364. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{B57F2A8D-CA8B-47EE-9F1A-CD92A0ABB1A1}>ProxyStubClsid32
365. In the right panel, locate and delete the entry:
     (Default) = "{00020420-0000-0000-C000-000000000046}"
366. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{B57F2A8D-CA8B-47EE-9F1A-CD92A0ABB1A1}>TypeLib
367. In the right panel, locate and delete the entry:
     (Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"
368. Again In the right panel, locate and delete the entry:
     Version = "1.0"
369. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{F04AF314-58FD-43F0-A9A4-6B3D11BFC563}
370. In the right panel, locate and delete the entry:
     (Default) = "_DWMVProfileEditor"
371. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{F04AF314-58FD-43F0-A9A4-6B3D11BFC563}>ProxyStubClsid32
372. In the right panel, locate and delete the entry:
     (Default) = "{00020420-0000-0000-C000-000000000046}"
373. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{F04AF314-58FD-43F0-A9A4-6B3D11BFC563}>TypeLib
374. In the right panel, locate and delete the entry:
     (Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"
375. Again In the right panel, locate and delete the entry:
     Version = "1.0"
376. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{899BDC5C-4F40-400A-A524-A7DC2C61841B}
377. In the right panel, locate and delete the entry:
     (Default) = "_DWMVProfileEditorEvents"
378. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{899BDC5C-4F40-400A-A524-A7DC2C61841B}>ProxyStubClsid32
379. In the right panel, locate and delete the entry:
     (Default) = "{00020420-0000-0000-C000-000000000046}"
380. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{899BDC5C-4F40-400A-A524-A7DC2C61841B}>TypeLib
381. In the right panel, locate and delete the entry:
     (Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"
382. Again In the right panel, locate and delete the entry:
     Version = "1.0"
383. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{80F58506-33D5-406D-BDBA-09F7B9B1740A}
384. In the right panel, locate and delete the entry:
     (Default) = "IVideoCodec"
385. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{80F58506-33D5-406D-BDBA-09F7B9B1740A}>ProxyStubClsid32
386. In the right panel, locate and delete the entry:
     (Default) = "{00020420-0000-0000-C000-000000000046}"
387. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{80F58506-33D5-406D-BDBA-09F7B9B1740A}>TypeLib
388. In the right panel, locate and delete the entry:
     (Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"
389. Again In the right panel, locate and delete the entry:
     Version = "1.0"
390. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{4174C2F6-BF59-426C-AD90-BFC5B9398591}
391. In the right panel, locate and delete the entry:
     (Default) = "IEnumVideoCodecs"
392. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{4174C2F6-BF59-426C-AD90-BFC5B9398591}>ProxyStubClsid32
393. In the right panel, locate and delete the entry:
     (Default) = "{00020420-0000-0000-C000-000000000046}"
394. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{4174C2F6-BF59-426C-AD90-BFC5B9398591}>TypeLib
395. In the right panel, locate and delete the entry:
     (Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"
396. Again In the right panel, locate and delete the entry:
     Version = "1.0"
397. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{0FE6D84A-8D63-499E-8E0C-3DC3B09EA666}
398. In the right panel, locate and delete the entry:
     (Default) = "IAudioCodec"
399. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{0FE6D84A-8D63-499E-8E0C-3DC3B09EA666}>ProxyStubClsid32
400. In the right panel, locate and delete the entry:
     (Default) = "{00020420-0000-0000-C000-000000000046}"
401. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{0FE6D84A-8D63-499E-8E0C-3DC3B09EA666}>TypeLib
402. In the right panel, locate and delete the entry:
     (Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"
403. Again In the right panel, locate and delete the entry:
     Version = "1.0"
404. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{9B7C329A-CD4F-45F8-B60B-58EF740EF78B}
405. In the right panel, locate and delete the entry:
     (Default) = "IEnumAudioCodecs"
406. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{9B7C329A-CD4F-45F8-B60B-58EF740EF78B}>ProxyStubClsid32
407. In the right panel, locate and delete the entry:
     (Default) = "{00020420-0000-0000-C000-000000000046}"
408. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{9B7C329A-CD4F-45F8-B60B-58EF740EF78B}>TypeLib
409. In the right panel, locate and delete the entry:
     (Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"
410. Again In the right panel, locate and delete the entry:
     Version = "1.0"
411. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{F0E12FC4-334A-400C-937B-43FD4880BE4F}
412. In the right panel, locate and delete the entry:
     (Default) = "IAudioFormat"
413. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{F0E12FC4-334A-400C-937B-43FD4880BE4F}>ProxyStubClsid32
414. In the right panel, locate and delete the entry:
     (Default) = "{00020420-0000-0000-C000-000000000046}"
415. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{F0E12FC4-334A-400C-937B-43FD4880BE4F}>TypeLib
416. In the right panel, locate and delete the entry:
     (Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"
417. Again In the right panel, locate and delete the entry:
     Version = "1.0"
418. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{33F197D5-19D3-45AA-99B0-EFDDC820FE6A}
419. In the right panel, locate and delete the entry:
     (Default) = "IEnumAudioFormats"
420. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{33F197D5-19D3-45AA-99B0-EFDDC820FE6A}>ProxyStubClsid32
421. In the right panel, locate and delete the entry:
     (Default) = "{00020420-0000-0000-C000-000000000046}"
422. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{33F197D5-19D3-45AA-99B0-EFDDC820FE6A}>TypeLib
423. In the right panel, locate and delete the entry:
     (Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"
424. Again In the right panel, locate and delete the entry:
     Version = "1.0"
425. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{95603D96-D1DB-42D4-8A06-353C6B4B8A63}
426. In the right panel, locate and delete the entry:
     (Default) = "ILang"
427. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{95603D96-D1DB-42D4-8A06-353C6B4B8A63}>ProxyStubClsid32
428. In the right panel, locate and delete the entry:
     (Default) = "{00020420-0000-0000-C000-000000000046}"
429. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{95603D96-D1DB-42D4-8A06-353C6B4B8A63}>TypeLib
430. In the right panel, locate and delete the entry:
     (Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"
431. Again In the right panel, locate and delete the entry:
     Version = "1.0"
432. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{88CA0382-1A63-4764-A29C-759AEFF56156}
433. In the right panel, locate and delete the entry:
     (Default) = "ILanguage"
434. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{88CA0382-1A63-4764-A29C-759AEFF56156}>ProxyStubClsid32
435. In the right panel, locate and delete the entry:
     (Default) = "{00020420-0000-0000-C000-000000000046}"
436. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{88CA0382-1A63-4764-A29C-759AEFF56156}>TypeLib
437. In the right panel, locate and delete the entry:
     (Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"
438. Again In the right panel, locate and delete the entry:
     Version = "1.0"
439. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{B37CA430-C178-4C52-9F46-38A3747E61E0}
440. In the right panel, locate and delete the entry:
     (Default) = "IEnumLanguages"
441. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{B37CA430-C178-4C52-9F46-38A3747E61E0}>ProxyStubClsid32
442. In the right panel, locate and delete the entry:
     (Default) = "{00020420-0000-0000-C000-000000000046}"
443. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{B37CA430-C178-4C52-9F46-38A3747E61E0}>TypeLib
444. In the right panel, locate and delete the entry:
     (Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"
445. Again In the right panel, locate and delete the entry:
     Version = "1.0"
446. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{1767B1D4-EF8A-4438-806E-3E6DEBA9368A}
447. In the right panel, locate and delete the entry:
     (Default) = "WMVProfileEditor Property Page"
448. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{1767B1D4-EF8A-4438-806E-3E6DEBA9368A}>InprocServer32
449. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\AURORA~1\WMVPRO~1.OCX"
450. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>WMVPROFILEEDITOR.WMVProfileEditorCtrl.1
451. In the right panel, locate and delete the entry:
     (Default) = "WMVProfileEditor Control"
452. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>WMVPROFILEEDITOR.WMVProfileEditorCtrl.1>CLSID
453. In the right panel, locate and delete the entry:
     (Default) = "{AEDF0925-71C2-429E-BC54-B14F26FEAAD0}"
454. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{AEDF0925-71C2-429E-BC54-B14F26FEAAD0}
455. In the right panel, locate and delete the entry:
     (Default) = "WMVProfileEditor Control"
456. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{AEDF0925-71C2-429E-BC54-B14F26FEAAD0}>ProgID
457. In the right panel, locate and delete the entry:
     (Default) = "WMVPROFILEEDITOR.WMVProfileEditorCtrl.1"
458. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{AEDF0925-71C2-429E-BC54-B14F26FEAAD0}>InprocServer32
459. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\AURORA~1\WMVPRO~1.OCX"
460. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{AEDF0925-71C2-429E-BC54-B14F26FEAAD0}>ToolboxBitmap32
461. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\AURORA~1\WMVPRO~1.OCX, 1"
462. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{AEDF0925-71C2-429E-BC54-B14F26FEAAD0}>MiscStatus
463. In the right panel, locate and delete the entry:
     (Default) = "0"
464. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{AEDF0925-71C2-429E-BC54-B14F26FEAAD0}>MiscStatus>1
465. In the right panel, locate and delete the entry:
     (Default) = "131473"
466. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{AEDF0925-71C2-429E-BC54-B14F26FEAAD0}>Control
467. In the right panel, locate and delete the entry:
     (Default) = ""
468. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{AEDF0925-71C2-429E-BC54-B14F26FEAAD0}>TypeLib
469. In the right panel, locate and delete the entry:
     (Default) = "{C99E4EFC-CCD5-4F78-B574-EB2CF6CE842C}"
470. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{AEDF0925-71C2-429E-BC54-B14F26FEAAD0}>Version
471. In the right panel, locate and delete the entry:
     (Default) = "1.0"
472. Again In the right panel, locate and delete the entry:
     ThreadingModel = "Apartment"
473. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Wow6432Node>WIFIService
474. In the right panel, locate and delete the entry:
     idconst_34162 = "1"
475. Close Registry Editor.

To manually delete a malware/grayware file from an affected system:

•For Windows 7, Windows Server 2008 (R2), Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2):

1. Open a Windows Explorer window.
   • For Windows 7 and Server 2008 (R2) users, click Start>Computer.
   • For Windows 8, 8.1, 10, and Server 2012 (R2) users, right-click on the lower-left corner of the screen,then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %System%\is-FCPU4.tmp
   • %Program Files%\Aurora Media Workshop\is-DTEDS.tmp
   • %Program Files%\Aurora Media Workshop\is-MDE5G.tmp
   • %Program Files%\Aurora Media Workshop\is-UNDPG.tmp
   • %Program Files%\Aurora Media Workshop\is-0EF6D.tmp
   • %Program Files%\Aurora Media Workshop\is-B9D5O.tmp
   • %Program Files%\Aurora Media Workshop\buynow.url
   • %Program Files%\Aurora Media Workshop\homepage.url
   • %Program Files%\Aurora Media Workshop\forceASPI17\WIN9X\WINASPI.DLL
   • %Program Files%\Aurora Media Workshop\vcdimager.dll
   • %Program Files%\Aurora Media Workshop\forceASPI17\WIN9X\ASPIENUM.VXD
   • %Program Files%\Aurora Media Workshop\is-I5Q66.tmp
   • %Program Files%\Aurora Media Workshop\forceASPI17\WinNTDUMP\frcASPI.txt
   • %Program Files%\Aurora Media Workshop\forceASPI17\InstallASPI.bat
   • %Program Files%\Aurora Media Workshop\libsnd.dll
   • %Program Files%\Aurora Media Workshop\TIPS.TXT
   • %Program Files%\Aurora Media Workshop\skin\winaqua.smf
   • %Program Files%\Aurora Media Workshop\forceASPI17\WinNTDUMP\WOWPOST.EXE
   • %Program Files%\Aurora Media Workshop\forceASPI17\WIN9X\WNASPI32.DLL
   • %Program Files%\Aurora Media Workshop\msvcr70.dll
   • %Program Files%\Aurora Media Workshop\NCTAudioRecord2.dll
   • %Program Files%\Aurora Media Workshop\forceASPI17\WinNTDUMP\WNASPI32.DLL
   • %Program Files%\Aurora Media Workshop\is-5OJK2.tmp
   • %Program Files%\Aurora Media Workshop\AuroraMediaWorkshop.exe
   • %Program Files%\Aurora Media Workshop\setup.ini
   • %Program Files%\Aurora Media Workshop\is-IO1SG.tmp
   • %Program Files%\Aurora Media Workshop\forceASPI17\WINNT\is-FOGJ3.tmp
   • %Program Files%\Aurora Media Workshop\is-O53JL.tmp
   • %Program Files%\Aurora Media Workshop\forceASPI17\WINNT\is-VKC9J.tmp
   • %Program Files%\Aurora Media Workshop\is-0CK7O.tmp
   • %Program Files%\Aurora Media Workshop\forceASPI17\WINNT\is-BI7VF.tmp
   • %Program Files%\Aurora Media Workshop\forceASPI17\WIN9X\WIN9X.REG
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Aurora Media Workshop\Aurora Media Workshop.lnk
   • %Program Files%\Aurora Media Workshop\is-IVFNU.tmp
   • %Program Files%\Aurora Media Workshop\is-8K4AD.tmp
   • %Program Files%\Aurora Media Workshop\forceASPI17\WIN9X\is-68DCF.tmp
   • %Program Files%\Aurora Media Workshop\forceASPI17\WINNT\WINNT.REG
   • %Program Files%\Aurora Media Workshop\is-6BR8T.tmp
   • %Program Files%\Aurora Media Workshop\unins000.exe
   • %Program Files%\Aurora Media Workshop\vorbis.dll
   • %Program Files%\Aurora Media Workshop\forceASPI17\WIN9X\is-7RTD9.tmp
   • %Program Files%\Aurora Media Workshop\forceASPI17\WinNTDUMP\is-UPSE3.tmp
   • %Program Files%\Aurora Media Workshop\forceASPI17\is-GAIJ1.tmp
   • %Program Files%\Aurora Media Workshop\is-DLDNF.tmp
   • %Program Files%\Aurora Media Workshop\is-12IRR.tmp
   • %Program Files%\Aurora Media Workshop\license.TXT
   • %Program Files%\Aurora Media Workshop\is-K15H3.tmp
   • %Program Files%\Aurora Media Workshop\is-S64LV.tmp
   • %Program Files%\Aurora Media Workshop\skin\is-NVQ4J.tmp
   • %Program Files%\Aurora Media Workshop\is-NJKIV.tmp
   • %Program Files%\Aurora Media Workshop\viscomimage.dll
   • %Program Files%\Aurora Media Workshop\forceASPI17\WINNT\is-4FVV3.tmp
   • %Program Files%\Aurora Media Workshop\is-64AHV.tmp
   • %Program Files%\Aurora Media Workshop\is-UR68V.tmp
   • %Program Files%\Aurora Media Workshop\is-C9DF1.tmp
   • %Program Files%\Aurora Media Workshop\forceASPI17\WIN9X\is-SGOLA.tmp
   • %User Temp%\fix150120.dat
   • %Program Files%\Aurora Media Workshop\is-F1MVR.tmp
   • %Program Files%\Aurora Media Workshop\forceASPI17\WIN9X\is-UCC5P.tmp
   • %Program Files%\Aurora Media Workshop\is-VONCQ.tmp
   • %Program Files%\Aurora Media Workshop\forceASPI17\WINNT\ASPI32.SYS
   • %Program Files%\Aurora Media Workshop\is-M6TIC.tmp
   • %Program Files%\Aurora Media Workshop\mp3lib.dll
   • %Program Files%\Aurora Media Workshop\is-MBU4D.tmp
   • %Program Files%\Aurora Media Workshop\readme.TXT
   • %Program Files%\Aurora Media Workshop\mpeg2dmx.ax
   • %Program Files%\Aurora Media Workshop\is-I667T.tmp
   • %Program Files%\Aurora Media Workshop\forceASPI17\WinNTDUMP\is-N0HAN.tmp
   • %Program Files%\Aurora Media Workshop\forceASPI17\WinNTDUMP\is-FNFJ5.tmp
   • %Program Files%\Aurora Media Workshop\cdrip.dll
   • %Program Files%\Aurora Media Workshop\unins000.dat
   • %Program Files%\Aurora Media Workshop\skinmagic.dll
   • %Program Files%\Aurora Media Workshop\NCTAudioPlayer2.dll
   • %Program Files%\Aurora Media Workshop\forceASPI17\WINNT\WOWPOST.EXE
   • %Program Files%\Aurora Media Workshop\Help.CHM
   • %Program Files%\Aurora Media Workshop\forceASPI17\WINNT\WINASPI.DLL
   • %Program Files%\Aurora Media Workshop\is-GN80O.tmp
   • %Program Files%\Google\Update\GoogleUpdate.exe
   • %Program Files%\Aurora Media Workshop\is-AHQ81.tmp
   • %Program Files%\Aurora Media Workshop\Support.ini
   • %Program Files%\Aurora Media Workshop\viscomwave.dll
   • %Program Files%\Aurora Media Workshop\forceASPI17\WINNT\is-NQQKE.tmp
   • %Program Files%\Aurora Media Workshop\is-H7HJM.tmp
   • %Program Files%\Aurora Media Workshop\VideoEdit.ocx
   • %Program Files%\Aurora Media Workshop\forceASPI17\WIN9X\APIX.VXD
   • %Program Files%\Aurora Media Workshop\forceASPI17\WinNTDUMP\WINASPI.DLL
   • %Program Files%\Aurora Media Workshop\WMVProfileEditor.ocx
   • %Program Files%\Aurora Media Workshop\msvcr71.dll
   • %Program Files%\Aurora Media Workshop\forceASPI17\WinNTDUMP\is-6H70E.tmp
   • %System%\smd.dll
   • %Program Files%\Aurora Media Workshop\forceASPI17\WINNT\WNASPI32.DLL
   • %Program Files%\Aurora Media Workshop\is-6SLN6.tmp
   • %Program Files%\Aurora Media Workshop\wmaudsdk.dll
   • %Program Files%\Aurora Media Workshop\NCTAudioVisualization2.dll
   • %Program Files%\Aurora Media Workshop\is-71UQA.tmp
   • %Program Files%\Aurora Media Workshop\msvcrt.dll
   • %Program Files%\Aurora Media Workshop\lame_enc.dll
   • %Program Files%\Aurora Media Workshop\forceASPI17\WinNTDUMP\is-HSFNB.tmp
   • %Program Files%\Aurora Media Workshop\Foxburner.dll
   • %Program Files%\Aurora Media Workshop\is-3JHS3.tmp
   • %Program Files%\Aurora Media Workshop\DirectEncode.dll
   • %Program Files%\Aurora Media Workshop\forceASPI17\WIN9X\is-H29T1.tmp
   • %Program Files%\Aurora Media Workshop\forceASPI17\WinNTDUMP\ASPI32.SYS
   • %Program Files%\Aurora Media Workshop\mpgdec.ax
3. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7 and Windows Server 2008 (R2).

To delete malware/grayware/spyware folders:

For Windows 7, Windows Server 2008 (R2), Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2):

1. Open a Windows Explorer window.
   • For Windows 7 and Server 2008 (R2) users, click Start>Computer.
   • For Windows 8, 8.1, 10, and Server 2012 (R2) users, right-click on the lower-left corner of the screen,then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %Program Files%\Aurora Media Workshop\forceASPI17\WIN9X
   • %Program Files%\Aurora Media Workshop\skin
   • %Program Files%\Aurora Media Workshop\forceASPI17
   • %Program Files%\Aurora Media Workshop\forceASPI17\WinNTDUMP
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Aurora Media Workshop
   • %User Temp%\is-V4OUL.tmp\_isetup
   • %Program Files%\Aurora Media Workshop
   • %Program Files%\Aurora Media Workshop\forceASPI17\WINNT
3. Once located, select the file then press SHIFT+DELETE to permanently delete the folder.
4. Repeat steps 2-3 for the remaining folders:
   • %Program Files%\Aurora Media Workshop\forceASPI17\WIN9X
   • %Program Files%\Aurora Media Workshop\skin
   • %Program Files%\Aurora Media Workshop\forceASPI17
   • %Program Files%\Aurora Media Workshop\forceASPI17\WinNTDUMP
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\Aurora Media Workshop
   • %User Temp%\is-V4OUL.tmp\_isetup
   • %Program Files%\Aurora Media Workshop
   • %Program Files%\Aurora Media Workshop\forceASPI17\WINNT
   *Note: Read the following Microsoft page if these steps do not work on Windows 7 and Server 2008 (R2).