PUA.Win32.WebBrowser.A

To delete the registry value this malware created:

1. Open Registry Editor. To do this:
   » For Windows 7 and Windows Server 2008 (R2) users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, 10, and Windows Server 2012 (R2) users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel of the Registry Editor window, double-click the following:
   HKEY_USERS>{SID}_CLASSES>CLSID>{F87D77DF-DEF2-4294-9F4B-A92E5A6725DE}>InprocServer32
3. In the right panel, locate and delete the entry:
   (Default) = %User Profile%\Wavesor Software\SWUpdater\1.3.107.0\psuser.dll
4. Again In the right panel, locate and delete the entry:
   ThreadingModel = Both
5. In the left panel of the Registry Editor window, double-click the following:
   HKEY_USERS>{SID}_CLASSES>CLSID>{F6994161-37C3-47C9-BE83-C84C33A1CF2A}>InprocServer32
6. In the right panel, locate and delete the entry:
   (Default) = %User Profile%\Wavesor Software\SWUpdater\1.3.107.0\psuser.dll
7. Again In the right panel, locate and delete the entry:
   ThreadingModel = Both
8. In the left panel of the Registry Editor window, double-click the following:
   HKEY_USERS>{SID}_CLASSES>CLSID>{43E9B4E0-060F-4EDD-A19D-6ECD343EBB68}>InprocHandler32
9. In the right panel, locate and delete the entry:
   (Default) = %User Profile%\Wavesor Software\SWUpdater\1.3.107.0\psuser.dll
10. Again In the right panel, locate and delete the entry:
    ThreadingModel = Both
11. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>CLSID>{C5596523-009B-41A7-AB11-BCA2274BDCDB}>InProcServer32
12. In the right panel, locate and delete the entry:
    (Default) = %User Profile%\Wavesor Software\SWUpdater\1.3.107.0\psuser.dll
13. Again In the right panel, locate and delete the entry:
    ThreadingModel = Both
14. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>CLSID>{C5596523-009B-41A7-AB11-BCA2274BDCDB}
15. In the right panel, locate and delete the entry:
    (Default) = PSFactoryBuffer
16. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{C5E89508-3927-4EF5-A3B3-C479F0D4E36F}>ProxyStubClsid32
17. In the right panel, locate and delete the entry:
    (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
18. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{C5E89508-3927-4EF5-A3B3-C479F0D4E36F}
19. In the right panel, locate and delete the entry:
    (Default) = IAppCommand
20. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{C5E89508-3927-4EF5-A3B3-C479F0D4E36F}>NumMethods
21. In the right panel, locate and delete the entry:
    (Default) = 11
22. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{CFDE680E-8700-4808-BAAF-8B1F50F2CC87}>ProxyStubClsid32
23. In the right panel, locate and delete the entry:
    (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
24. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{CFDE680E-8700-4808-BAAF-8B1F50F2CC87}
25. In the right panel, locate and delete the entry:
    (Default) = IPolicyStatusValue
26. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{CFDE680E-8700-4808-BAAF-8B1F50F2CC87}>NumMethods
27. In the right panel, locate and delete the entry:
    (Default) = 12
28. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{CEF9DF20-AE5B-4A54-B479-9C2AFC1C2683}>ProxyStubClsid32
29. In the right panel, locate and delete the entry:
    (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
30. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{CEF9DF20-AE5B-4A54-B479-9C2AFC1C2683}
31. In the right panel, locate and delete the entry:
    (Default) = IPolicyStatus
32. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{CEF9DF20-AE5B-4A54-B479-9C2AFC1C2683}>NumMethods
33. In the right panel, locate and delete the entry:
    (Default) = 16
34. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{0D311A22-BD24-4C7A-8FC1-117F8D62A781}>ProxyStubClsid32
35. In the right panel, locate and delete the entry:
    (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
36. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{0D311A22-BD24-4C7A-8FC1-117F8D62A781}
37. In the right panel, locate and delete the entry:
    (Default) = IProgressWndEvents
38. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{0D311A22-BD24-4C7A-8FC1-117F8D62A781}>NumMethods
39. In the right panel, locate and delete the entry:
    (Default) = 9
40. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{E44B162B-4287-40B0-8E7A-6E251D80B3DF}>ProxyStubClsid32
41. In the right panel, locate and delete the entry:
    (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
42. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{E44B162B-4287-40B0-8E7A-6E251D80B3DF}
43. In the right panel, locate and delete the entry:
    (Default) = IAppWeb
44. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{E44B162B-4287-40B0-8E7A-6E251D80B3DF}>NumMethods
45. In the right panel, locate and delete the entry:
    (Default) = 17
46. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{7DFF302B-EA41-49F8-97B1-9413CEF98C68}>ProxyStubClsid32
47. In the right panel, locate and delete the entry:
    (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
48. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{7DFF302B-EA41-49F8-97B1-9413CEF98C68}
49. In the right panel, locate and delete the entry:
    (Default) = IGoogleUpdate3
50. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{7DFF302B-EA41-49F8-97B1-9413CEF98C68}>NumMethods
51. In the right panel, locate and delete the entry:
    (Default) = 10
52. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{DA4EFC2D-B243-4BA8-8A14-8937D867B699}>ProxyStubClsid32
53. In the right panel, locate and delete the entry:
    (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
54. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{DA4EFC2D-B243-4BA8-8A14-8937D867B699}
55. In the right panel, locate and delete the entry:
    (Default) = IAppBundle
56. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{DA4EFC2D-B243-4BA8-8A14-8937D867B699}>NumMethods
57. In the right panel, locate and delete the entry:
    (Default) = 41
58. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{50363C3E-2FB2-4EC0-A827-CD3314F526C5}>ProxyStubClsid32
59. In the right panel, locate and delete the entry:
    (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
60. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{50363C3E-2FB2-4EC0-A827-CD3314F526C5}
61. In the right panel, locate and delete the entry:
    (Default) = IAppVersionWeb
62. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{50363C3E-2FB2-4EC0-A827-CD3314F526C5}>NumMethods
63. In the right panel, locate and delete the entry:
    (Default) = 10
64. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{E4E4854F-9D7B-4120-A207-CF52C875F08E}>ProxyStubClsid32
65. In the right panel, locate and delete the entry:
    (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
66. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{E4E4854F-9D7B-4120-A207-CF52C875F08E}
67. In the right panel, locate and delete the entry:
    (Default) = IProcessLauncher2
68. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{E4E4854F-9D7B-4120-A207-CF52C875F08E}>NumMethods
69. In the right panel, locate and delete the entry:
    (Default) = 7
70. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{D669BD5D-A9B6-47FD-B558-81508AEF48C4}>ProxyStubClsid32
71. In the right panel, locate and delete the entry:
    (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
72. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{D669BD5D-A9B6-47FD-B558-81508AEF48C4}
73. In the right panel, locate and delete the entry:
    (Default) = ICoCreateAsync
74. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{D669BD5D-A9B6-47FD-B558-81508AEF48C4}>NumMethods
75. In the right panel, locate and delete the entry:
    (Default) = 4
76. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{6130C56B-9B2C-4D5D-8160-C7A583B5DC3B}>ProxyStubClsid32
77. In the right panel, locate and delete the entry:
    (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
78. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{6130C56B-9B2C-4D5D-8160-C7A583B5DC3B}
79. In the right panel, locate and delete the entry:
    (Default) = IApp2
80. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{6130C56B-9B2C-4D5D-8160-C7A583B5DC3B}>NumMethods
81. In the right panel, locate and delete the entry:
    (Default) = 43
82. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{C0151E6C-8D24-485D-BEC8-B6C6C82E26E8}>ProxyStubClsid32
83. In the right panel, locate and delete the entry:
    (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
84. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{C0151E6C-8D24-485D-BEC8-B6C6C82E26E8}
85. In the right panel, locate and delete the entry:
    (Default) = IPolicyStatus2
86. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{C0151E6C-8D24-485D-BEC8-B6C6C82E26E8}>NumMethods
87. In the right panel, locate and delete the entry:
    (Default) = 23
88. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{3BE77C6E-0029-4F24-B677-32C9E15CD8F1}>ProxyStubClsid32
89. In the right panel, locate and delete the entry:
    (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
90. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{3BE77C6E-0029-4F24-B677-32C9E15CD8F1}
91. In the right panel, locate and delete the entry:
    (Default) = IGoogleUpdate3WebSecurity
92. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{3BE77C6E-0029-4F24-B677-32C9E15CD8F1}>NumMethods
93. In the right panel, locate and delete the entry:
    (Default) = 4
94. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{64A19E70-BCFF-4808-A320-774FD11571E5}>ProxyStubClsid32
95. In the right panel, locate and delete the entry:
    (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
96. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{64A19E70-BCFF-4808-A320-774FD11571E5}
97. In the right panel, locate and delete the entry:
    (Default) = IBrowserHttpRequest2
98. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>Interface>{64A19E70-BCFF-4808-A320-774FD11571E5}>NumMethods
99. In the right panel, locate and delete the entry:
    (Default) = 4
100. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{894ADE70-1E5F-4520-A281-CE3BF0309CE6}>ProxyStubClsid32
101. In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
102. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{894ADE70-1E5F-4520-A281-CE3BF0309CE6}
103. In the right panel, locate and delete the entry:
     (Default) = IAppCommandWeb
104. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{894ADE70-1E5F-4520-A281-CE3BF0309CE6}>NumMethods
105. In the right panel, locate and delete the entry:
     (Default) = 11
106. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{44367D77-92C0-45E8-840D-0C098E650CE8}>ProxyStubClsid32
107. In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
108. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{44367D77-92C0-45E8-840D-0C098E650CE8}
109. In the right panel, locate and delete the entry:
     (Default) = IJobObserver
110. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{44367D77-92C0-45E8-840D-0C098E650CE8}>NumMethods
111. In the right panel, locate and delete the entry:
     (Default) = 13
112. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{068FAC78-4F23-4F74-99A0-F7C4797D5ECA}>ProxyStubClsid32
113. In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
114. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{068FAC78-4F23-4F74-99A0-F7C4797D5ECA}
115. In the right panel, locate and delete the entry:
     (Default) = IApp
116. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{068FAC78-4F23-4F74-99A0-F7C4797D5ECA}>NumMethods
117. In the right panel, locate and delete the entry:
     (Default) = 41
118. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{8129608C-48BD-42A6-9EBC-7B0933A5CFA3}>ProxyStubClsid32
119. In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
120. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{8129608C-48BD-42A6-9EBC-7B0933A5CFA3}
121. In the right panel, locate and delete the entry:
     (Default) = IAppCommand2
122. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{8129608C-48BD-42A6-9EBC-7B0933A5CFA3}>NumMethods
123. In the right panel, locate and delete the entry:
     (Default) = 12
124. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{E053F7BD-D525-49F4-9ADE-5D7E6FCEE775}>ProxyStubClsid32
125. In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
126. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{E053F7BD-D525-49F4-9ADE-5D7E6FCEE775}
127. In the right panel, locate and delete the entry:
     (Default) = IGoogleUpdateCore
128. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{E053F7BD-D525-49F4-9ADE-5D7E6FCEE775}>NumMethods
129. In the right panel, locate and delete the entry:
     (Default) = 4
130. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{97518FC7-7CA2-4921-BC40-F4A07E221C1C}>ProxyStubClsid32
131. In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
132. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{97518FC7-7CA2-4921-BC40-F4A07E221C1C}
133. In the right panel, locate and delete the entry:
     (Default) = ICoCreateAsyncStatus
134. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{97518FC7-7CA2-4921-BC40-F4A07E221C1C}>NumMethods
135. In the right panel, locate and delete the entry:
     (Default) = 10
136. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{B2083DCC-1D29-45E6-8386-BEE1488D11AA}>ProxyStubClsid32
137. In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
138. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{B2083DCC-1D29-45E6-8386-BEE1488D11AA}
139. In the right panel, locate and delete the entry:
     (Default) = IAppBundleWeb
140. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{B2083DCC-1D29-45E6-8386-BEE1488D11AA}>NumMethods
141. In the right panel, locate and delete the entry:
     (Default) = 24
142. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{2C53B9D4-A718-4972-B28E-2E7AF1055602}>ProxyStubClsid32
143. In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
144. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{2C53B9D4-A718-4972-B28E-2E7AF1055602}
145. In the right panel, locate and delete the entry:
     (Default) = IAppVersion
146. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{2C53B9D4-A718-4972-B28E-2E7AF1055602}>NumMethods
147. In the right panel, locate and delete the entry:
     (Default) = 10
148. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{92333BDA-3022-4A7F-8858-081260EA85DE}>ProxyStubClsid32
149. In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
150. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{92333BDA-3022-4A7F-8858-081260EA85DE}
151. In the right panel, locate and delete the entry:
     (Default) = ICredentialDialog
152. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{92333BDA-3022-4A7F-8858-081260EA85DE}>NumMethods
153. In the right panel, locate and delete the entry:
     (Default) = 4
154. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{D3C865DD-E36B-432E-9E47-554925B86737}>ProxyStubClsid32
155. In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
156. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{D3C865DD-E36B-432E-9E47-554925B86737}
157. In the right panel, locate and delete the entry:
     (Default) = IJobObserver2
158. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{D3C865DD-E36B-432E-9E47-554925B86737}>NumMethods
159. In the right panel, locate and delete the entry:
     (Default) = 4
160. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{E4E159E0-7B9C-4D75-AC11-A80628173DE3}>ProxyStubClsid32
161. In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
162. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{E4E159E0-7B9C-4D75-AC11-A80628173DE3}
163. In the right panel, locate and delete the entry:
     (Default) = IRegistrationUpdateHook
164. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{E4E159E0-7B9C-4D75-AC11-A80628173DE3}>NumMethods
165. In the right panel, locate and delete the entry:
     (Default) = 8
166. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{E44DDEE0-3097-499E-9DD5-7D5D5DCC401D}>ProxyStubClsid32
167. In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
168. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{E44DDEE0-3097-499E-9DD5-7D5D5DCC401D}
169. In the right panel, locate and delete the entry:
     (Default) = IGoogleUpdate3Web
170. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{E44DDEE0-3097-499E-9DD5-7D5D5DCC401D}>NumMethods
171. In the right panel, locate and delete the entry:
     (Default) = 8
172. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{617E37E1-AC79-4162-BACC-C797A1D31D3E}>ProxyStubClsid32
173. In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
174. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{617E37E1-AC79-4162-BACC-C797A1D31D3E}
175. In the right panel, locate and delete the entry:
     (Default) = IGoogleUpdate
176. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{617E37E1-AC79-4162-BACC-C797A1D31D3E}>NumMethods
177. In the right panel, locate and delete the entry:
     (Default) = 5
178. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{DDF98EF0-2728-4A8D-8B0F-32627DC56437}>ProxyStubClsid32
179. In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
180. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{DDF98EF0-2728-4A8D-8B0F-32627DC56437}
181. In the right panel, locate and delete the entry:
     (Default) = ICurrentState
182. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{DDF98EF0-2728-4A8D-8B0F-32627DC56437}>NumMethods
183. In the right panel, locate and delete the entry:
     (Default) = 24
184. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{62A51DF2-CCB8-4DD9-9069-34B8461617FC}>ProxyStubClsid32
185. In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
186. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{62A51DF2-CCB8-4DD9-9069-34B8461617FC}
187. In the right panel, locate and delete the entry:
     (Default) = IPackage
188. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{62A51DF2-CCB8-4DD9-9069-34B8461617FC}>NumMethods
189. In the right panel, locate and delete the entry:
     (Default) = 10
190. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{730EBDF4-7AD2-4516-BF1A-6C6F28C60CF9}>ProxyStubClsid32
191. In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
192. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{730EBDF4-7AD2-4516-BF1A-6C6F28C60CF9}
193. In the right panel, locate and delete the entry:
     (Default) = IProcessLauncher
194. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>Interface>{730EBDF4-7AD2-4516-BF1A-6C6F28C60CF9}>NumMethods
195. In the right panel, locate and delete the entry:
     (Default) = 6
196. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.Update3COMClassUser.1.0
197. In the right panel, locate and delete the entry:
     (Default) = Update3COMClass
198. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.Update3COMClassUser.1.0>CLSID
199. In the right panel, locate and delete the entry:
     (Default) = {9E0CE9B5-C498-40A8-B7F2-B89AF1C56FFF}
200. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.Update3COMClassUser
201. In the right panel, locate and delete the entry:
     (Default) = Update3COMClass
202. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.Update3COMClassUser>CLSID
203. In the right panel, locate and delete the entry:
     (Default) = {9E0CE9B5-C498-40A8-B7F2-B89AF1C56FFF}
204. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.Update3COMClassUser>CurVer
205. In the right panel, locate and delete the entry:
     (Default) = WavesorSWUpdater.Update3COMClassUser.1.0
206. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>CLSID>{9E0CE9B5-C498-40A8-B7F2-B89AF1C56FFF}
207. In the right panel, locate and delete the entry:
     (Default) = Update3COMClass
208. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>CLSID>{9E0CE9B5-C498-40A8-B7F2-B89AF1C56FFF}>ProgID
209. In the right panel, locate and delete the entry:
     (Default) = WavesorSWUpdater.Update3COMClassUser.1.0
210. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>CLSID>{9E0CE9B5-C498-40A8-B7F2-B89AF1C56FFF}>VersionIndependentProgID
211. In the right panel, locate and delete the entry:
     (Default) = WavesorSWUpdater.Update3COMClassUser
212. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>CLSID>{9E0CE9B5-C498-40A8-B7F2-B89AF1C56FFF}>LocalServer32
213. In the right panel, locate and delete the entry:
     (Default) = "%User Profile%\Wavesor Software\SWUpdater\SWUpdater.exe"
214. Again In the right panel, locate and delete the entry:
     (Default) = %User Profile%\Wavesor Software\SWUpdater\1.3.107.0\psuser.dll
215. Again In the right panel, locate and delete the entry:
     ThreadingModel = Both
216. Again In the right panel, locate and delete the entry:
     (Default) = %User Profile%\Wavesor Software\SWUpdater\1.3.107.0\psuser.dll
217. Again In the right panel, locate and delete the entry:
     ThreadingModel = Both
218. Again In the right panel, locate and delete the entry:
     (Default) = %User Profile%\Wavesor Software\SWUpdater\1.3.107.0\psuser.dll
219. Again In the right panel, locate and delete the entry:
     ThreadingModel = Both
220. Again In the right panel, locate and delete the entry:
     (Default) = %User Profile%\Wavesor Software\SWUpdater\1.3.107.0\psuser.dll
221. Again In the right panel, locate and delete the entry:
     ThreadingModel = Both
222. Again In the right panel, locate and delete the entry:
     (Default) = PSFactoryBuffer
223. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
224. Again In the right panel, locate and delete the entry:
     (Default) = IAppCommand
225. Again In the right panel, locate and delete the entry:
     (Default) = 11
226. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
227. Again In the right panel, locate and delete the entry:
     (Default) = IPolicyStatusValue
228. Again In the right panel, locate and delete the entry:
     (Default) = 12
229. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
230. Again In the right panel, locate and delete the entry:
     (Default) = IPolicyStatus
231. Again In the right panel, locate and delete the entry:
     (Default) = 16
232. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
233. Again In the right panel, locate and delete the entry:
     (Default) = IProgressWndEvents
234. Again In the right panel, locate and delete the entry:
     (Default) = 9
235. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
236. Again In the right panel, locate and delete the entry:
     (Default) = IAppWeb
237. Again In the right panel, locate and delete the entry:
     (Default) = 17
238. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
239. Again In the right panel, locate and delete the entry:
     (Default) = IGoogleUpdate3
240. Again In the right panel, locate and delete the entry:
     (Default) = 10
241. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
242. Again In the right panel, locate and delete the entry:
     (Default) = IAppBundle
243. Again In the right panel, locate and delete the entry:
     (Default) = 41
244. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
245. Again In the right panel, locate and delete the entry:
     (Default) = IAppVersionWeb
246. Again In the right panel, locate and delete the entry:
     (Default) = 10
247. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
248. Again In the right panel, locate and delete the entry:
     (Default) = IProcessLauncher2
249. Again In the right panel, locate and delete the entry:
     (Default) = 7
250. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
251. Again In the right panel, locate and delete the entry:
     (Default) = ICoCreateAsync
252. Again In the right panel, locate and delete the entry:
     (Default) = 4
253. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
254. Again In the right panel, locate and delete the entry:
     (Default) = IApp2
255. Again In the right panel, locate and delete the entry:
     (Default) = 43
256. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
257. Again In the right panel, locate and delete the entry:
     (Default) = IPolicyStatus2
258. Again In the right panel, locate and delete the entry:
     (Default) = 23
259. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
260. Again In the right panel, locate and delete the entry:
     (Default) = IGoogleUpdate3WebSecurity
261. Again In the right panel, locate and delete the entry:
     (Default) = 4
262. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
263. Again In the right panel, locate and delete the entry:
     (Default) = IBrowserHttpRequest2
264. Again In the right panel, locate and delete the entry:
     (Default) = 4
265. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
266. Again In the right panel, locate and delete the entry:
     (Default) = IAppCommandWeb
267. Again In the right panel, locate and delete the entry:
     (Default) = 11
268. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
269. Again In the right panel, locate and delete the entry:
     (Default) = IJobObserver
270. Again In the right panel, locate and delete the entry:
     (Default) = 13
271. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
272. Again In the right panel, locate and delete the entry:
     (Default) = IApp
273. Again In the right panel, locate and delete the entry:
     (Default) = 41
274. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
275. Again In the right panel, locate and delete the entry:
     (Default) = IAppCommand2
276. Again In the right panel, locate and delete the entry:
     (Default) = 12
277. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
278. Again In the right panel, locate and delete the entry:
     (Default) = IGoogleUpdateCore
279. Again In the right panel, locate and delete the entry:
     (Default) = 4
280. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
281. Again In the right panel, locate and delete the entry:
     (Default) = ICoCreateAsyncStatus
282. Again In the right panel, locate and delete the entry:
     (Default) = 10
283. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
284. Again In the right panel, locate and delete the entry:
     (Default) = IAppBundleWeb
285. Again In the right panel, locate and delete the entry:
     (Default) = 24
286. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
287. Again In the right panel, locate and delete the entry:
     (Default) = IAppVersion
288. Again In the right panel, locate and delete the entry:
     (Default) = 10
289. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
290. Again In the right panel, locate and delete the entry:
     (Default) = ICredentialDialog
291. Again In the right panel, locate and delete the entry:
     (Default) = 4
292. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
293. Again In the right panel, locate and delete the entry:
     (Default) = IJobObserver2
294. Again In the right panel, locate and delete the entry:
     (Default) = 4
295. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
296. Again In the right panel, locate and delete the entry:
     (Default) = IRegistrationUpdateHook
297. Again In the right panel, locate and delete the entry:
     (Default) = 8
298. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
299. Again In the right panel, locate and delete the entry:
     (Default) = IGoogleUpdate3Web
300. Again In the right panel, locate and delete the entry:
     (Default) = 8
301. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
302. Again In the right panel, locate and delete the entry:
     (Default) = IGoogleUpdate
303. Again In the right panel, locate and delete the entry:
     (Default) = 5
304. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
305. Again In the right panel, locate and delete the entry:
     (Default) = ICurrentState
306. Again In the right panel, locate and delete the entry:
     (Default) = 24
307. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
308. Again In the right panel, locate and delete the entry:
     (Default) = IPackage
309. Again In the right panel, locate and delete the entry:
     (Default) = 10
310. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
311. Again In the right panel, locate and delete the entry:
     (Default) = IProcessLauncher
312. Again In the right panel, locate and delete the entry:
     (Default) = 6
313. Again In the right panel, locate and delete the entry:
     (Default) = %User Profile%\Wavesor Software\SWUpdater\1.3.107.0\psuser.dll
314. Again In the right panel, locate and delete the entry:
     ThreadingModel = Both
315. Again In the right panel, locate and delete the entry:
     (Default) = %User Profile%\Wavesor Software\SWUpdater\1.3.107.0\psuser.dll
316. Again In the right panel, locate and delete the entry:
     ThreadingModel = Both
317. Again In the right panel, locate and delete the entry:
     (Default) = %User Profile%\Wavesor Software\SWUpdater\1.3.107.0\psuser.dll
318. Again In the right panel, locate and delete the entry:
     ThreadingModel = Both
319. Again In the right panel, locate and delete the entry:
     (Default) = %User Profile%\Wavesor Software\SWUpdater\1.3.107.0\psuser.dll
320. Again In the right panel, locate and delete the entry:
     ThreadingModel = Both
321. Again In the right panel, locate and delete the entry:
     (Default) = PSFactoryBuffer
322. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
323. Again In the right panel, locate and delete the entry:
     (Default) = IAppCommand
324. Again In the right panel, locate and delete the entry:
     (Default) = 11
325. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
326. Again In the right panel, locate and delete the entry:
     (Default) = IPolicyStatusValue
327. Again In the right panel, locate and delete the entry:
     (Default) = 12
328. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
329. Again In the right panel, locate and delete the entry:
     (Default) = IPolicyStatus
330. Again In the right panel, locate and delete the entry:
     (Default) = 16
331. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
332. Again In the right panel, locate and delete the entry:
     (Default) = IProgressWndEvents
333. Again In the right panel, locate and delete the entry:
     (Default) = 9
334. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
335. Again In the right panel, locate and delete the entry:
     (Default) = IAppWeb
336. Again In the right panel, locate and delete the entry:
     (Default) = 17
337. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
338. Again In the right panel, locate and delete the entry:
     (Default) = IGoogleUpdate3
339. Again In the right panel, locate and delete the entry:
     (Default) = 10
340. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
341. Again In the right panel, locate and delete the entry:
     (Default) = IAppBundle
342. Again In the right panel, locate and delete the entry:
     (Default) = 41
343. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
344. Again In the right panel, locate and delete the entry:
     (Default) = IAppVersionWeb
345. Again In the right panel, locate and delete the entry:
     (Default) = 10
346. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
347. Again In the right panel, locate and delete the entry:
     (Default) = IProcessLauncher2
348. Again In the right panel, locate and delete the entry:
     (Default) = 7
349. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
350. Again In the right panel, locate and delete the entry:
     (Default) = ICoCreateAsync
351. Again In the right panel, locate and delete the entry:
     (Default) = 4
352. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
353. Again In the right panel, locate and delete the entry:
     (Default) = IApp2
354. Again In the right panel, locate and delete the entry:
     (Default) = 43
355. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
356. Again In the right panel, locate and delete the entry:
     (Default) = IPolicyStatus2
357. Again In the right panel, locate and delete the entry:
     (Default) = 23
358. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
359. Again In the right panel, locate and delete the entry:
     (Default) = IGoogleUpdate3WebSecurity
360. Again In the right panel, locate and delete the entry:
     (Default) = 4
361. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
362. Again In the right panel, locate and delete the entry:
     (Default) = IBrowserHttpRequest2
363. Again In the right panel, locate and delete the entry:
     (Default) = 4
364. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
365. Again In the right panel, locate and delete the entry:
     (Default) = IAppCommandWeb
366. Again In the right panel, locate and delete the entry:
     (Default) = 11
367. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
368. Again In the right panel, locate and delete the entry:
     (Default) = IJobObserver
369. Again In the right panel, locate and delete the entry:
     (Default) = 13
370. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
371. Again In the right panel, locate and delete the entry:
     (Default) = IApp
372. Again In the right panel, locate and delete the entry:
     (Default) = 41
373. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
374. Again In the right panel, locate and delete the entry:
     (Default) = IAppCommand2
375. Again In the right panel, locate and delete the entry:
     (Default) = 12
376. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
377. Again In the right panel, locate and delete the entry:
     (Default) = IGoogleUpdateCore
378. Again In the right panel, locate and delete the entry:
     (Default) = 4
379. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
380. Again In the right panel, locate and delete the entry:
     (Default) = ICoCreateAsyncStatus
381. Again In the right panel, locate and delete the entry:
     (Default) = 10
382. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
383. Again In the right panel, locate and delete the entry:
     (Default) = IAppBundleWeb
384. Again In the right panel, locate and delete the entry:
     (Default) = 24
385. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
386. Again In the right panel, locate and delete the entry:
     (Default) = IAppVersion
387. Again In the right panel, locate and delete the entry:
     (Default) = 10
388. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
389. Again In the right panel, locate and delete the entry:
     (Default) = ICredentialDialog
390. Again In the right panel, locate and delete the entry:
     (Default) = 4
391. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
392. Again In the right panel, locate and delete the entry:
     (Default) = IJobObserver2
393. Again In the right panel, locate and delete the entry:
     (Default) = 4
394. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
395. Again In the right panel, locate and delete the entry:
     (Default) = IRegistrationUpdateHook
396. Again In the right panel, locate and delete the entry:
     (Default) = 8
397. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
398. Again In the right panel, locate and delete the entry:
     (Default) = IGoogleUpdate3Web
399. Again In the right panel, locate and delete the entry:
     (Default) = 8
400. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
401. Again In the right panel, locate and delete the entry:
     (Default) = IGoogleUpdate
402. Again In the right panel, locate and delete the entry:
     (Default) = 5
403. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
404. Again In the right panel, locate and delete the entry:
     (Default) = ICurrentState
405. Again In the right panel, locate and delete the entry:
     (Default) = 24
406. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
407. Again In the right panel, locate and delete the entry:
     (Default) = IPackage
408. Again In the right panel, locate and delete the entry:
     (Default) = 10
409. Again In the right panel, locate and delete the entry:
     (Default) = {C5596523-009B-41A7-AB11-BCA2274BDCDB}
410. Again In the right panel, locate and delete the entry:
     (Default) = IProcessLauncher
411. Again In the right panel, locate and delete the entry:
     (Default) = 6
412. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.Update3WebUser.1.0
413. In the right panel, locate and delete the entry:
     (Default) = SWUpdater Update3Web
414. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.Update3WebUser.1.0>CLSID
415. In the right panel, locate and delete the entry:
     (Default) = {30FB944E-9455-49DD-81C6-7542E47AA3E7}
416. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.Update3WebUser
417. In the right panel, locate and delete the entry:
     (Default) = SWUpdater Update3Web
418. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.Update3WebUser>CLSID
419. In the right panel, locate and delete the entry:
     (Default) = {30FB944E-9455-49DD-81C6-7542E47AA3E7}
420. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.Update3WebUser>CurVer
421. In the right panel, locate and delete the entry:
     (Default) = WavesorSWUpdater.Update3WebUser.1.0
422. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>CLSID>{30FB944E-9455-49DD-81C6-7542E47AA3E7}
423. In the right panel, locate and delete the entry:
     (Default) = SWUpdater Update3Web
424. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>CLSID>{30FB944E-9455-49DD-81C6-7542E47AA3E7}>ProgID
425. In the right panel, locate and delete the entry:
     (Default) = WavesorSWUpdater.Update3WebUser.1.0
426. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>CLSID>{30FB944E-9455-49DD-81C6-7542E47AA3E7}>VersionIndependentProgID
427. In the right panel, locate and delete the entry:
     (Default) = WavesorSWUpdater.Update3WebUser
428. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>CLSID>{30FB944E-9455-49DD-81C6-7542E47AA3E7}>LocalServer32
429. In the right panel, locate and delete the entry:
     (Default) = "%User Profile%\Wavesor Software\SWUpdater\1.3.107.0\SWUpdaterOnDemand.exe"
430. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.OnDemandCOMClassUser.1.0
431. In the right panel, locate and delete the entry:
     (Default) = SWUpdater Legacy On Demand
432. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.OnDemandCOMClassUser.1.0>CLSID
433. In the right panel, locate and delete the entry:
     (Default) = {1BE9D40C-2307-4213-830E-7E3CE9EDF0C2}
434. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.OnDemandCOMClassUser
435. In the right panel, locate and delete the entry:
     (Default) = SWUpdater Legacy On Demand
436. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.OnDemandCOMClassUser>CLSID
437. In the right panel, locate and delete the entry:
     (Default) = {1BE9D40C-2307-4213-830E-7E3CE9EDF0C2}
438. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.OnDemandCOMClassUser>CurVer
439. In the right panel, locate and delete the entry:
     (Default) = WavesorSWUpdater.OnDemandCOMClassUser.1.0
440. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>CLSID>{1BE9D40C-2307-4213-830E-7E3CE9EDF0C2}
441. In the right panel, locate and delete the entry:
     (Default) = SWUpdater Legacy On Demand
442. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>CLSID>{1BE9D40C-2307-4213-830E-7E3CE9EDF0C2}>ProgID
443. In the right panel, locate and delete the entry:
     (Default) = WavesorSWUpdater.OnDemandCOMClassUser.1.0
444. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>CLSID>{1BE9D40C-2307-4213-830E-7E3CE9EDF0C2}>VersionIndependentProgID
445. In the right panel, locate and delete the entry:
     (Default) = WavesorSWUpdater.OnDemandCOMClassUser
446. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>CLSID>{1BE9D40C-2307-4213-830E-7E3CE9EDF0C2}>LocalServer32
447. In the right panel, locate and delete the entry:
     (Default) = "%User Profile%\Wavesor Software\SWUpdater\1.3.107.0\SWUpdaterOnDemand.exe"
448. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.PolicyStatusUser.1.0
449. In the right panel, locate and delete the entry:
     (Default) = SWUpdater Policy Status Class
450. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.PolicyStatusUser.1.0>CLSID
451. In the right panel, locate and delete the entry:
     (Default) = {3C41B0C4-B5B6-4293-BED4-C927CCFDB909}
452. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.PolicyStatusUser
453. In the right panel, locate and delete the entry:
     (Default) = SWUpdater Policy Status Class
454. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.PolicyStatusUser>CLSID
455. In the right panel, locate and delete the entry:
     (Default) = {3C41B0C4-B5B6-4293-BED4-C927CCFDB909}
456. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.PolicyStatusUser>CurVer
457. In the right panel, locate and delete the entry:
     (Default) = WavesorSWUpdater.PolicyStatusUser.1.0
458. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>CLSID>{3C41B0C4-B5B6-4293-BED4-C927CCFDB909}
459. In the right panel, locate and delete the entry:
     (Default) = SWUpdater Policy Status Class
460. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>CLSID>{3C41B0C4-B5B6-4293-BED4-C927CCFDB909}>ProgID
461. In the right panel, locate and delete the entry:
     (Default) = WavesorSWUpdater.PolicyStatusUser.1.0
462. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>CLSID>{3C41B0C4-B5B6-4293-BED4-C927CCFDB909}>VersionIndependentProgID
463. In the right panel, locate and delete the entry:
     (Default) = WavesorSWUpdater.PolicyStatusUser
464. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>CLSID>{3C41B0C4-B5B6-4293-BED4-C927CCFDB909}>LocalServer32
465. In the right panel, locate and delete the entry:
     (Default) = "%User Profile%\Wavesor Software\SWUpdater\1.3.107.0\SWUpdaterOnDemand.exe"
466. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.CredentialDialogUser.1.0
467. In the right panel, locate and delete the entry:
     (Default) = SWUpdater CredentialDialog
468. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.CredentialDialogUser.1.0>CLSID
469. In the right panel, locate and delete the entry:
     (Default) = {D12748C8-5013-45E2-9A24-2FB7C2EEFB7C}
470. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.CredentialDialogUser
471. In the right panel, locate and delete the entry:
     (Default) = SWUpdater CredentialDialog
472. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.CredentialDialogUser>CLSID
473. In the right panel, locate and delete the entry:
     (Default) = {D12748C8-5013-45E2-9A24-2FB7C2EEFB7C}
474. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.CredentialDialogUser>CurVer
475. In the right panel, locate and delete the entry:
     (Default) = WavesorSWUpdater.CredentialDialogUser.1.0
476. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>CLSID>{D12748C8-5013-45E2-9A24-2FB7C2EEFB7C}
477. In the right panel, locate and delete the entry:
     (Default) = SWUpdater CredentialDialog
478. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>CLSID>{D12748C8-5013-45E2-9A24-2FB7C2EEFB7C}>ProgID
479. In the right panel, locate and delete the entry:
     (Default) = WavesorSWUpdater.CredentialDialogUser.1.0
480. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>CLSID>{D12748C8-5013-45E2-9A24-2FB7C2EEFB7C}>VersionIndependentProgID
481. In the right panel, locate and delete the entry:
     (Default) = WavesorSWUpdater.CredentialDialogUser
482. In the left panel of the Registry Editor window, double-click the following:
     HKEY_USERS>{SID}_CLASSES>CLSID>{D12748C8-5013-45E2-9A24-2FB7C2EEFB7C}>LocalServer32
483. In the right panel, locate and delete the entry:
     (Default) = "%User Profile%\Wavesor Software\SWUpdater\1.3.107.0\SWUpdaterOnDemand.exe"
484. In the left panel of the Registry Editor window, double-click the following:
     HKEY_CURRENT_USER>Software>Wavesor>SWUpdater
485. In the right panel, locate and delete the entry:
     version = 1.3.107.0
486. In the left panel of the Registry Editor window, double-click the following:
     HKEY_CURRENT_USER>Software>Wavesor>SWUpdater>ClientState>{F6F60ACE-71AD-4610-80D4-9253729FB4B7}
487. In the right panel, locate and delete the entry:
     brand = GGLS
488. Again In the right panel, locate and delete the entry:
     InstallTime = {value}
489. Again In the right panel, locate and delete the entry:
     DayOfInstall = {value}
490. Again In the right panel, locate and delete the entry:
     DayOfLastActivity = {value}
491. Again In the right panel, locate and delete the entry:
     DayOfLastRollCall = {value}
492. In the left panel of the Registry Editor window, double-click the following:
     HKEY_CURRENT_USER>Software>Wavesor>SWUpdater>PersistedPings>{F5A07A76-4BBF-4E14-921E-A3CB6C5B3BAA}
493. In the right panel, locate and delete the entry:
     PersistedPingTime = {value}
494. In the left panel of the Registry Editor window, double-click the following:
     HKEY_CURRENT_USER>Software>Wavesor>SWUpdater>PersistedPings>{9C86975C-B0E2-404E-9474-27F5B3E61F6E}
495. In the right panel, locate and delete the entry:
     PersistedPingTime = {value}
496. In the left panel of the Registry Editor window, double-click the following:
     HKEY_CURRENT_USER>Software>Wavesor>SWUpdater>PersistedPings>{D0AFCED3-9D86-4084-97A1-F52071532D63}
497. In the right panel, locate and delete the entry:
     PersistedPingTime = {value}
498. In the left panel of the Registry Editor window, double-click the following:
     HKEY_CURRENT_USER>Software>Wavesor>SWUpdater>ClientState>{EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}>CurrentState
499. In the right panel, locate and delete the entry:
     StateValue = 17
500. In the left panel of the Registry Editor window, double-click the following:
     HKEY_CURRENT_USER>Software>Wavesor>SWUpdater>ClientState>{EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}
501. In the right panel, locate and delete the entry:
     CustomInstallPath = %User Profile%\Wavesor Software\WaveBrowser
502. Again In the right panel, locate and delete the entry:
     SWUSetupOptions = /R /DWID
503. Again In the right panel, locate and delete the entry:
     path = %User Profile%\Wavesor Software\SWUpdater\SWUpdater.exe
504. Again In the right panel, locate and delete the entry:
     UninstallCmdLine = "%User Profile%\Wavesor Software\SWUpdater\SWUpdater.exe" /uninstall
505. In the left panel of the Registry Editor window, double-click the following:
     HKEY_CURRENT_USER>Software>Wavesor>SWUpdater>Clients>{F6F60ACE-71AD-4610-80D4-9253729FB4B7}
506. In the right panel, locate and delete the entry:
     pv = 1.3.107.0
507. Again In the right panel, locate and delete the entry:
     name = SWUpdater
508. Again In the right panel, locate and delete the entry:
     pv = 1.3.107.0
509. In the left panel of the Registry Editor window, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Run
510. In the right panel, locate and delete the entry:
     Wavesor SWUpdater = "%User Profile%\Wavesor Software\SWUpdater\1.3.107.0\SWUpdaterCore.exe"
511. Again In the right panel, locate and delete the entry:
     IsMSIHelperRegistered = 0
512. Close Registry Editor.

To delete registry keys this malware/grayware created:

1. Open Registry Editor. To do this:
   » For Windows 7 and Server 2008 (R2) users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, 8.1, 10, and Server 2012 (R2) users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel of the Registry Editor window, double-click the following:
   HKEY_USERS>{SID}_CLASSES>CLSID>{30FB944E-9455-49DD-81C6-7542E47AA3E7}>VersionIndependentProgID
3. Still in the left panel, locate and delete the key:
   
4. In the left panel of the Registry Editor window, double-click the following:
   HKEY_USERS>{SID}_CLASSES>CLSID>{30FB944E-9455-49DD-81C6-7542E47AA3E7}>LocalServer32
5. Still in the left panel, locate and delete the key:
   
6. In the left panel of the Registry Editor window, double-click the following:
   HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.OnDemandCOMClassUser.1.0
7. Still in the left panel, locate and delete the key:
   
8. In the left panel of the Registry Editor window, double-click the following:
   HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.OnDemandCOMClassUser.1.0>CLSID
9. Still in the left panel, locate and delete the key:
   
10. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.OnDemandCOMClassUser
11. Still in the left panel, locate and delete the key:
    
12. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.OnDemandCOMClassUser>CLSID
13. Still in the left panel, locate and delete the key:
    
14. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.OnDemandCOMClassUser>CurVer
15. Still in the left panel, locate and delete the key:
    
16. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>CLSID>{1BE9D40C-2307-4213-830E-7E3CE9EDF0C2}
17. Still in the left panel, locate and delete the key:
    
18. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>CLSID>{1BE9D40C-2307-4213-830E-7E3CE9EDF0C2}>ProgID
19. Still in the left panel, locate and delete the key:
    
20. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>CLSID>{1BE9D40C-2307-4213-830E-7E3CE9EDF0C2}>VersionIndependentProgID
21. Still in the left panel, locate and delete the key:
    
22. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>CLSID>{1BE9D40C-2307-4213-830E-7E3CE9EDF0C2}>LocalServer32
23. Still in the left panel, locate and delete the key:
    
24. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.PolicyStatusUser.1.0
25. Still in the left panel, locate and delete the key:
    
26. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.PolicyStatusUser.1.0>CLSID
27. Still in the left panel, locate and delete the key:
    
28. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.PolicyStatusUser
29. Still in the left panel, locate and delete the key:
    
30. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.PolicyStatusUser>CLSID
31. Still in the left panel, locate and delete the key:
    
32. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.PolicyStatusUser>CurVer
33. Still in the left panel, locate and delete the key:
    
34. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>CLSID>{3C41B0C4-B5B6-4293-BED4-C927CCFDB909}
35. Still in the left panel, locate and delete the key:
    
36. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>CLSID>{3C41B0C4-B5B6-4293-BED4-C927CCFDB909}>ProgID
37. Still in the left panel, locate and delete the key:
    
38. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>CLSID>{3C41B0C4-B5B6-4293-BED4-C927CCFDB909}>VersionIndependentProgID
39. Still in the left panel, locate and delete the key:
    
40. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>CLSID>{3C41B0C4-B5B6-4293-BED4-C927CCFDB909}>LocalServer32
41. Still in the left panel, locate and delete the key:
    
42. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.CredentialDialogUser.1.0
43. Still in the left panel, locate and delete the key:
    
44. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.CredentialDialogUser.1.0>CLSID
45. Still in the left panel, locate and delete the key:
    
46. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.CredentialDialogUser
47. Still in the left panel, locate and delete the key:
    
48. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.CredentialDialogUser>CLSID
49. Still in the left panel, locate and delete the key:
    
50. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>WavesorSWUpdater.CredentialDialogUser>CurVer
51. Still in the left panel, locate and delete the key:
    
52. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>CLSID>{D12748C8-5013-45E2-9A24-2FB7C2EEFB7C}
53. Still in the left panel, locate and delete the key:
    
54. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>CLSID>{D12748C8-5013-45E2-9A24-2FB7C2EEFB7C}>ProgID
55. Still in the left panel, locate and delete the key:
    
56. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>CLSID>{D12748C8-5013-45E2-9A24-2FB7C2EEFB7C}>VersionIndependentProgID
57. Still in the left panel, locate and delete the key:
    
58. In the left panel of the Registry Editor window, double-click the following:
    HKEY_USERS>{SID}_CLASSES>CLSID>{D12748C8-5013-45E2-9A24-2FB7C2EEFB7C}>LocalServer32
59. Still in the left panel, locate and delete the key:
    
60. In the left panel of the Registry Editor window, double-click the following:
    HKEY_CURRENT_USER>Software>Wavesor>SWUpdater>PersistedPings
61. Still in the left panel, locate and delete the key:
    
62. In the left panel of the Registry Editor window, double-click the following:
    HKEY_CURRENT_USER>Software>Wavesor>SWUpdater>PersistedPings>{F5A07A76-4BBF-4E14-921E-A3CB6C5B3BAA}
63. Still in the left panel, locate and delete the key:
    
64. In the left panel of the Registry Editor window, double-click the following:
    HKEY_CURRENT_USER>Software>Wavesor>SWUpdater>PersistedPings>{9C86975C-B0E2-404E-9474-27F5B3E61F6E}
65. Still in the left panel, locate and delete the key:
    
66. In the left panel of the Registry Editor window, double-click the following:
    HKEY_CURRENT_USER>Software>Wavesor>SWUpdater>PersistedPings>{D0AFCED3-9D86-4084-97A1-F52071532D63}
67. Still in the left panel, locate and delete the key:
    
68. In the left panel of the Registry Editor window, double-click the following:
    HKEY_CURRENT_USER>Software>Wavesor>SWUpdater>ClientState>{EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}>CurrentState
69. Still in the left panel, locate and delete the key:
    
70. Close Registry Editor.

To manually delete a malware/grayware file from an affected system:

•For Windows 7, Windows Server 2008 (R2), Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2):

1. Open a Windows Explorer window.
   • For Windows 7 and Server 2008 (R2) users, click Start>Computer.
   • For Windows 8, 8.1, 10, and Server 2012 (R2) users, right-click on the lower-left corner of the screen,then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %User Temp%\{random}.tmp\inetc.dll
   • %User Temp%\{random}.tmp\nsResize.dll
   • %User Temp%\{random}.tmp\nsDialogs.dll
   • %User Temp%\{random}.tmp\System.dll
   • %User Temp%\{random}.tmp\Info.rtf
   • %User Temp%\{random}.tmp\WaveBrowserSetup_opt.exe
   • %Program Files%\Wavesor\Temp\{random}.tmp\SWUpdater.exe
   • %Program Files%\Wavesor\Temp\{random}.tmp\SWUpdaterCrashHandler.exe
   • %Program Files%\Wavesor\Temp\{random}.tmp\swupdater.dll
   • %Program Files%\Wavesor\Temp\{random}.tmp\SWUpdaterBroker.exe
   • %Program Files%\Wavesor\Temp\{random}.tmp\SWUpdaterOnDemand.exe
   • %Program Files%\Wavesor\Temp\{random}.tmp\SWUpdaterComRegisterShell64.exe
   • %Program Files%\Wavesor\Temp\{random}.tmp\psmachine.dll
   • %Program Files%\Wavesor\Temp\{random}.tmp\psmachine_64.dll
   • %Program Files%\Wavesor\Temp\{random}.tmp\psuser.dll
   • %Program Files%\Wavesor\Temp\{random}.tmp\psuser_64.dll
   • %Program Files%\Wavesor\Temp\{random}.tmp\SWUpdaterCrashHandler64.exe
   • %Program Files%\Wavesor\Temp\{random}.tmp\SWUpdaterCore.exe
   • %Program Files%\Wavesor\Temp\{random}.tmp\swupdaterres_en.dll
   • %Program Files%\Wavesor\Temp\{random}.tmp\SWUpdaterSetup.exe
   • %User Profile%\Wavesor Software\SWUpdater\1.3.107.0\SWUpdater.exe
   • %User Profile%\Wavesor Software\SWUpdater\1.3.107.0\swupdater.dll
   • %User Profile%\Wavesor Software\SWUpdater\1.3.107.0\SWUpdaterCore.exe
   • %User Profile%\Wavesor Software\SWUpdater\1.3.107.0\SWUpdaterCrashHandler.exe
   • %User Profile%\Wavesor Software\SWUpdater\1.3.107.0\SWUpdaterCrashHandler64.exe
   • %User Profile%\Wavesor Software\SWUpdater\1.3.107.0\SWUpdaterComRegisterShell64.exe
   • %User Profile%\Wavesor Software\SWUpdater\1.3.107.0\swupdaterres_en.dll
   • %User Profile%\Wavesor Software\SWUpdater\1.3.107.0\psuser.dll
   • %User Profile%\Wavesor Software\SWUpdater\1.3.107.0\psuser_64.dll
   • %User Profile%\Wavesor Software\SWUpdater\1.3.107.0\psmachine.dll
   • %User Profile%\Wavesor Software\SWUpdater\1.3.107.0\psmachine_64.dll
   • %User Profile%\Wavesor Software\SWUpdater\SWUpdater.exe
   • %User Profile%\Wavesor Software\SWUpdater\1.3.107.0\SWUpdaterSetup.exe
   • %User Profile%\Wavesor Software\SWUpdater\1.3.107.0\SWUpdaterBroker.exe
   • %User Profile%\Wavesor Software\SWUpdater\1.3.107.0\SWUpdaterOnDemand.exe
3. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7 and Windows Server 2008 (R2).

To delete the malware/grayware folder:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %Program Files%\Wavesor
   • %Program Files%\Wavesor\Temp
   • %User Profile%\Wavesor Software
   • %User Profile%\Wavesor Software\SWUpdater
   • %User Profile%\Wavesor Software\SWUpdater\1.3.107.0
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.