ADW_TANGO

To delete the registry key this malware/grayware/spyware created:

1. Restart your computer in Safe Mode. For instructions on how to do this, you may refer to this page. If the preceding step requires you to restart in safe mode, you may proceed to #2.
2. Open Registry Editor. To do this, click Start>Run, type REGEDIT in the text box provided, then press Enter.
3. In the left panel of the Registry Editor window, double-click the following:
   HKEY_CLASSES_ROOT>CLSID
4. Still in the left panel, locate and delete the key:
   {random CLSID}
5. In the left panel of the Registry Editor window, double-click the following:
   HKEY_CURRENT_USER>Software
6. Still in the left panel, locate and delete the key:
   IEBarProperties
7. In the left panel of the Registry Editor window, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer
8. Still in the left panel, locate and delete the key:
   SearchScopes
9. In the left panel of the Registry Editor window, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer
10. Still in the left panel, locate and delete the key:
    SearchScopes
11. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Browser Helper Objects
12. Still in the left panel, locate and delete the key:
    {random CLSID}
13. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall
14. Still in the left panel, locate and delete the key:
    {random CLSID}
15. Close Registry Editor.

• In HKEY_CLASSES_ROOT\CLSID\{random CLSID}\InprocServer32
  • (default) = %System%\{random filename}.dll
    
• In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
  • Search Bar = http://www.tangosearch.com/?useie5=1&q= Use Custom Search URL = 1
    
• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main
  • Search Bar = http://www.tangosearch.com/?useie5=1&q= Use Custom Search URL = 1
    
• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
  • {random CLSID} = 0
    

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CLASSES_ROOT>CLSID>{random CLSID}>InprocServer32
3. In the right panel, locate and delete the entry:
   (default) = %System%\{random filename}.dll
4. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Main
5. In the right panel, locate and delete the entry:
   Search Bar = http://www.tangosearch.com/?useie5
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Main
7. In the right panel, locate and delete the entry:
   Search Bar = http://www.tangosearch.com/?useie5
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Toolbar
9. In the right panel, locate and delete the entry:
   {random CLSID} = 0
10. Close Registry Editor.

To reset your Internet Explorer Home and Search Pages:

1. Close all Internet Explorer windows.
2. Open Control Panel. To do this, click Start>Settings>Control Panel.
3. Double-click the Internet Options icon.
4. In the Internet Properties window, click the Programs tab.
   (Note: If you are running Internet Explorer 7 (IE7), click the Advanced tab.)
5. Click the Reset Web Settings... button.
   (Note: On IE7, click the Reset… button. Note that by doing this, you are resetting IE back to its default settings.)
6. Select Also reset my home page. Click Yes.
7. Click OK.