PUA.Win32.Montiera.AB

To terminate the malware/grayware/spyware process:

1. Scan your computer with your Trend Micro product and take note of the name of the malware/grayware/spyware detected.
2. Open Windows Task Manager. To do this, press CTRL+SHIFT+ESC.
3. View the list of all running programs. To do this:
   • For Windows 7 and Server 2008 (R2) users, click the Processes tab.
   • For Windows 8, 8.1, 10, and Server 2012 (R2) users, click the Details tab.
4. In the list of running programs, locate a malware/grayware/spyware file detected earlier.
5. Select the detected files, then press either the End Task or the End Process button, depending on the version of Windows you are using.
6. Do the same for the remaining detected malware/grayware/spyware files in the list of running programs.
7. To check if the malware/grayware/spyware process has been terminated, close Task Manager, and then open it again.
8. Close Task Manager.

To delete the registry key this malware/grayware created:

1. Open Registry Editor.
   » For Windows 7 and Windows Server 2008 (R2) users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2) users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_CLASSES_ROOT>AppID>{2768469C-717B-401F-8532-C6D88BAE0339}>instl
3. Still in the left panel, locate and delete the key:
   data
4. In the left panel, double-click the following:
   HKEY_CURRENT_USER>SOFTWARE
5. Still in the left panel, locate and delete the key:
   tuvaro
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID
7. Still in the left panel, locate and delete the key:
   {4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
8. Again Still in the left panel, locate and delete the key:
   escorTlbr.DLL
9. In the left panel, double-click the following:
   HKEY_CLASSES_ROOT
10. Still in the left panel, locate and delete the key:
    tuvaro.tuvarodskBnd.1
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>tuvaro.tuvarodskBnd.1
12. Still in the left panel, locate and delete the key:
    CLSID
13. Again Still in the left panel, locate and delete the key:
    tuvaro.tuvarodskBnd
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>tuvaro.tuvarodskBnd
15. Still in the left panel, locate and delete the key:
    CLSID
16. Again Still in the left panel, locate and delete the key:
    CurVer
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID
18. Still in the left panel, locate and delete the key:
    {6F001652-AF51-45C6-B029-86E0265A1851}
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{6F001652-AF51-45C6-B029-86E0265A1851}
20. Still in the left panel, locate and delete the key:
    ProgID
21. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
22. Again Still in the left panel, locate and delete the key:
    Programmable
23. Again Still in the left panel, locate and delete the key:
    InprocServer32
24. Again Still in the left panel, locate and delete the key:
    TypeLib
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Microsoft>Internet Explorer
26. Still in the left panel, locate and delete the key:
    Toolbar
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Low Rights>ElevationPolicy
28. Still in the left panel, locate and delete the key:
    {E40E840E-5A15-4A29-9C51-9A060EEB192B}
29. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Wow6432Node>Microsoft>Windows>CurrentVersion>explorer>Browser Helper Objects
30. Still in the left panel, locate and delete the key:
    {5CB02877-EFBC-4317-B608-9E24B11BAB40}
31. Again Still in the left panel, locate and delete the key:
    {09C554C3-109B-483C-A06B-F14172F1A947}
32. Again Still in the left panel, locate and delete the key:
    escort.DLL
33. Again Still in the left panel, locate and delete the key:
    escort.escortIEPane.1
34. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>escort.escortIEPane.1
35. Still in the left panel, locate and delete the key:
    CLSID
36. Again Still in the left panel, locate and delete the key:
    escort.escortIEPane
37. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>escort.escortIEPane
38. Still in the left panel, locate and delete the key:
    CLSID
39. Again Still in the left panel, locate and delete the key:
    CurVer
40. Again Still in the left panel, locate and delete the key:
    {2A3FF0D3-4417-492B-8929-11AB24EA0A90}
41. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{2A3FF0D3-4417-492B-8929-11AB24EA0A90}
42. Still in the left panel, locate and delete the key:
    ProgID
43. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
44. Again Still in the left panel, locate and delete the key:
    Programmable
45. Again Still in the left panel, locate and delete the key:
    InprocServer32
46. Again Still in the left panel, locate and delete the key:
    TypeLib
47. Again Still in the left panel, locate and delete the key:
    tuvaro.tuvaroHlpr.1
48. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>tuvaro.tuvaroHlpr.1
49. Still in the left panel, locate and delete the key:
    CLSID
50. Again Still in the left panel, locate and delete the key:
    tuvaro.tuvaroHlpr
51. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>tuvaro.tuvaroHlpr
52. Still in the left panel, locate and delete the key:
    CLSID
53. Again Still in the left panel, locate and delete the key:
    CurVer
54. Again Still in the left panel, locate and delete the key:
    {5CB02877-EFBC-4317-B608-9E24B11BAB40}
55. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{5CB02877-EFBC-4317-B608-9E24B11BAB40}
56. Still in the left panel, locate and delete the key:
    ProgID
57. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
58. Again Still in the left panel, locate and delete the key:
    Programmable
59. Again Still in the left panel, locate and delete the key:
    InprocServer32
60. Again Still in the left panel, locate and delete the key:
    TypeLib
61. Again Still in the left panel, locate and delete the key:
    {D7EE8177-D51E-4F89-92B6-83EA2EC40800}
62. Again Still in the left panel, locate and delete the key:
    escortApp.DLL
63. Again Still in the left panel, locate and delete the key:
    tuvaro.tuvaroappCore.1
64. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>tuvaro.tuvaroappCore.1
65. Still in the left panel, locate and delete the key:
    CLSID
66. Again Still in the left panel, locate and delete the key:
    tuvaro.tuvaroappCore
67. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>tuvaro.tuvaroappCore
68. Still in the left panel, locate and delete the key:
    CLSID
69. Again Still in the left panel, locate and delete the key:
    CurVer
70. Again Still in the left panel, locate and delete the key:
    {9389BE07-565A-45A0-B1A3-3DE01AA1C5CA}
71. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{9389BE07-565A-45A0-B1A3-3DE01AA1C5CA}
72. Still in the left panel, locate and delete the key:
    ProgID
73. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
74. Again Still in the left panel, locate and delete the key:
    Programmable
75. Again Still in the left panel, locate and delete the key:
    InprocServer32
76. Again Still in the left panel, locate and delete the key:
    TypeLib
77. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface
78. Still in the left panel, locate and delete the key:
    {240A6AD4-4868-4513-A8DD-3ABF47E1F146}
79. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{240A6AD4-4868-4513-A8DD-3ABF47E1F146}
80. Still in the left panel, locate and delete the key:
    ProxyStubClsid32
81. Again Still in the left panel, locate and delete the key:
    TypeLib
82. Again Still in the left panel, locate and delete the key:
    {DD973375-0904-4886-8F63-6FC3A2BE6544}
83. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{DD973375-0904-4886-8F63-6FC3A2BE6544}
84. Still in the left panel, locate and delete the key:
    ProxyStubClsid32
85. Again Still in the left panel, locate and delete the key:
    TypeLib
86. Again Still in the left panel, locate and delete the key:
    {C6712CEF-79A8-440E-A7AC-4EF00C856922}
87. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{C6712CEF-79A8-440E-A7AC-4EF00C856922}
88. Still in the left panel, locate and delete the key:
    ProxyStubClsid32
89. Again Still in the left panel, locate and delete the key:
    TypeLib
90. Again Still in the left panel, locate and delete the key:
    {23D1685B-A018-430F-B3AB-F517B471569E}
91. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{23D1685B-A018-430F-B3AB-F517B471569E}
92. Still in the left panel, locate and delete the key:
    ProxyStubClsid32
93. Again Still in the left panel, locate and delete the key:
    TypeLib
94. Again Still in the left panel, locate and delete the key:
    {427F9EE7-35CB-4EC6-ACCA-122AE77C68B8}
95. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{427F9EE7-35CB-4EC6-ACCA-122AE77C68B8}
96. Still in the left panel, locate and delete the key:
    ProxyStubClsid32
97. Again Still in the left panel, locate and delete the key:
    TypeLib
98. Again Still in the left panel, locate and delete the key:
    {033998B0-0745-472D-8F2B-EB55EBA42F58}
99. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{033998B0-0745-472D-8F2B-EB55EBA42F58}
100. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
101. Again Still in the left panel, locate and delete the key:
     TypeLib
102. Again Still in the left panel, locate and delete the key:
     {B98D2F59-0329-4A5A-B112-B989B4D4BACA}
103. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{B98D2F59-0329-4A5A-B112-B989B4D4BACA}
104. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
105. Again Still in the left panel, locate and delete the key:
     TypeLib
106. Again Still in the left panel, locate and delete the key:
     {4F3868C3-C08B-490E-93AD-834413F7FD22}
107. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{4F3868C3-C08B-490E-93AD-834413F7FD22}
108. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
109. Again Still in the left panel, locate and delete the key:
     TypeLib
110. Again Still in the left panel, locate and delete the key:
     {F77B6A63-1EC9-45FB-A7AB-F9930CBBAD32}
111. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{F77B6A63-1EC9-45FB-A7AB-F9930CBBAD32}
112. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
113. Again Still in the left panel, locate and delete the key:
     TypeLib
114. Again Still in the left panel, locate and delete the key:
     {4C694E60-4549-466D-83FB-C4C162FB53E2}
115. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{4C694E60-4549-466D-83FB-C4C162FB53E2}
116. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
117. Again Still in the left panel, locate and delete the key:
     TypeLib
118. Again Still in the left panel, locate and delete the key:
     {A88A4515-66BC-413B-9526-3FF53B5F21C8}
119. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{A88A4515-66BC-413B-9526-3FF53B5F21C8}
120. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
121. Again Still in the left panel, locate and delete the key:
     TypeLib
122. Again Still in the left panel, locate and delete the key:
     {6BE4B879-4E7D-4AE8-A356-DCBD7029612E}
123. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{6BE4B879-4E7D-4AE8-A356-DCBD7029612E}
124. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
125. Again Still in the left panel, locate and delete the key:
     TypeLib
126. Again Still in the left panel, locate and delete the key:
     {33278AD4-8305-49E1-A58B-E5A9057BFDC3}
127. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{33278AD4-8305-49E1-A58B-E5A9057BFDC3}
128. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
129. Again Still in the left panel, locate and delete the key:
     TypeLib
130. Again Still in the left panel, locate and delete the key:
     {B12E99ED-69BD-437C-86BE-C862B9E5444D}
131. Again Still in the left panel, locate and delete the key:
     escortEng.DLL
132. Again Still in the left panel, locate and delete the key:
     t
133. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>t
134. Still in the left panel, locate and delete the key:
     CLSID
135. Again Still in the left panel, locate and delete the key:
     CurVer
136. Again Still in the left panel, locate and delete the key:
     {4CBF0FC8-4222-435B-9E57-0DE807350D39}
137. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{4CBF0FC8-4222-435B-9E57-0DE807350D39}
138. Still in the left panel, locate and delete the key:
     ProgID
139. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
140. Again Still in the left panel, locate and delete the key:
     Programmable
141. Again Still in the left panel, locate and delete the key:
     InprocServer32
142. Again Still in the left panel, locate and delete the key:
     TypeLib
143. Again Still in the left panel, locate and delete the key:
     dfltLng
144. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Google>chrome>Extensions
145. Still in the left panel, locate and delete the key:
     omgjkafaoidbgamjoklhaiiciahohkbh
146. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>tuvaro>tuvaro
147. Still in the left panel, locate and delete the key:
     Instl
148. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Uninstall
149. Still in the left panel, locate and delete the key:
     tuvaro
150. Again Still in the left panel, locate and delete the key:
     {2792F312-417E-4517-A824-7F55A2F18BE5}
151. Again Still in the left panel, locate and delete the key:
     esrv.EXE
152. Again Still in the left panel, locate and delete the key:
     esrv.tuvaroESrvc.1
153. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>esrv.tuvaroESrvc.1
154. Still in the left panel, locate and delete the key:
     CLSID
155. Again Still in the left panel, locate and delete the key:
     esrv.tuvaroESrvc
156. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>esrv.tuvaroESrvc
157. Still in the left panel, locate and delete the key:
     CLSID
158. Again Still in the left panel, locate and delete the key:
     CurVer
159. Again Still in the left panel, locate and delete the key:
     {1E8F8EDE-EB73-4CA9-A139-6DA2B576FD69}
160. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{1E8F8EDE-EB73-4CA9-A139-6DA2B576FD69}
161. Still in the left panel, locate and delete the key:
     ProgID
162. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
163. Again Still in the left panel, locate and delete the key:
     Programmable
164. Again Still in the left panel, locate and delete the key:
     LocalServer32
165. Again Still in the left panel, locate and delete the key:
     TypeLib
166. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor.
   » For Windows 7 and Windows Server 2008 (R2) users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2) users, right-click on the lower-left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>{2768469C-717B-401F-8532-C6D88BAE0339}>instl>data
3. In the right panel, locate and delete the entry:
   trace = "0"
4. Again In the right panel, locate and delete the entry:
   cam = ""
5. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>tuvaro>tuvaro
6. In the right panel, locate and delete the entry:
   tlbrSrchUrl = "{random characters}"
7. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
8. In the right panel, locate and delete the entry:
   (Default) = "escorTlbr"
9. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>escorTlbr.DLL
10. In the right panel, locate and delete the entry:
    AppID = "{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}"
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>tuvaro.tuvarodskBnd.1
12. In the right panel, locate and delete the entry:
    (Default) = "CDskBnd Object"
13. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>tuvaro.tuvarodskBnd.1>CLSID
14. In the right panel, locate and delete the entry:
    (Default) = "{6F001652-AF51-45C6-B029-86E0265A1851}"
15. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>tuvaro.tuvarodskBnd
16. In the right panel, locate and delete the entry:
    (Default) = "CDskBnd Object"
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>tuvaro.tuvarodskBnd>CLSID
18. In the right panel, locate and delete the entry:
    (Default) = "{6F001652-AF51-45C6-B029-86E0265A1851}"
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>tuvaro.tuvarodskBnd>CurVer
20. In the right panel, locate and delete the entry:
    (Default) = "tuvaro.tuvarodskBnd.1"
21. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{6F001652-AF51-45C6-B029-86E0265A1851}
22. In the right panel, locate and delete the entry:
    (Default) = "CDskBnd Object"
23. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{6F001652-AF51-45C6-B029-86E0265A1851}>ProgID
24. In the right panel, locate and delete the entry:
    (Default) = "tuvaro.tuvarodskBnd.1"
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{6F001652-AF51-45C6-B029-86E0265A1851}>VersionIndependentProgID
26. In the right panel, locate and delete the entry:
    (Default) = "tuvaro.tuvarodskBnd"
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{6F001652-AF51-45C6-B029-86E0265A1851}>InprocServer32
28. In the right panel, locate and delete the entry:
    (Default) = "%Program Files%\tuvaro\tuvaro\1.8.12.7\tuvaroTlbr.dll"
29. Again In the right panel, locate and delete the entry:
    ThreadingModel = "apartment"
30. Again In the right panel, locate and delete the entry:
    AppID = "{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}"
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{6F001652-AF51-45C6-B029-86E0265A1851}>TypeLib
32. In the right panel, locate and delete the entry:
    (Default) = "{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}"
33. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Wow6432Node>Microsoft>Internet Explorer>Toolbar
34. In the right panel, locate and delete the entry:
    {6F001652-AF51-45C6-B029-86E0265A1851} = "Tuvaro Toolbar"
35. Again In the right panel, locate and delete the entry:
    (Default) = "Tuvaro Toolbar"
36. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Wow6432Node>Microsoft>Internet Explorer>Low Rights>ElevationPolicy>{E40E840E-5A15-4A29-9C51-9A060EEB192B}
37. In the right panel, locate and delete the entry:
    Policy = "3"
38. Again In the right panel, locate and delete the entry:
    AppName = "tuvarosrv.exe"
39. Again In the right panel, locate and delete the entry:
    AppPath = "%Program Files%\tuvaro\tuvaro\1.8.12.7"
40. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Wow6432Node>Microsoft>Windows>CurrentVersion>explorer>Browser Helper Objects>{5CB02877-EFBC-4317-B608-9E24B11BAB40}
41. In the right panel, locate and delete the entry:
    (Default) = "tuvaro Helper Object"
42. Again In the right panel, locate and delete the entry:
    NoExplorer = "1"
43. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>{09C554C3-109B-483C-A06B-F14172F1A947}
44. In the right panel, locate and delete the entry:
    (Default) = "escort"
45. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>escort.DLL
46. In the right panel, locate and delete the entry:
    AppID = "{09C554C3-109B-483C-A06B-F14172F1A947}"
47. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>escort.escortIEPane.1
48. In the right panel, locate and delete the entry:
    (Default) = "escortIEPane Object"
49. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>escort.escortIEPane.1>CLSID
50. In the right panel, locate and delete the entry:
    (Default) = "{2A3FF0D3-4417-492B-8929-11AB24EA0A90}"
51. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>escort.escortIEPane
52. In the right panel, locate and delete the entry:
    (Default) = "escortIEPane Object"
53. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>escort.escortIEPane>CLSID
54. In the right panel, locate and delete the entry:
    (Default) = "{2A3FF0D3-4417-492B-8929-11AB24EA0A90}"
55. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>escort.escortIEPane>CurVer
56. In the right panel, locate and delete the entry:
    (Default) = "escort.escortIEPane.1"
57. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{2A3FF0D3-4417-492B-8929-11AB24EA0A90}
58. In the right panel, locate and delete the entry:
    (Default) = "escortIEPane Object"
59. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{2A3FF0D3-4417-492B-8929-11AB24EA0A90}>ProgID
60. In the right panel, locate and delete the entry:
    (Default) = "escort.escortIEPane.1"
61. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{2A3FF0D3-4417-492B-8929-11AB24EA0A90}>VersionIndependentProgID
62. In the right panel, locate and delete the entry:
    (Default) = "escort.escortIEPane"
63. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{2A3FF0D3-4417-492B-8929-11AB24EA0A90}>InprocServer32
64. In the right panel, locate and delete the entry:
    (Default) = "%Program Files%\tuvaro\tuvaro\1.8.12.7\bh\tuvaro.dll"
65. Again In the right panel, locate and delete the entry:
    ThreadingModel = "apartment"
66. Again In the right panel, locate and delete the entry:
    AppID = "{09C554C3-109B-483C-A06B-F14172F1A947}"
67. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{2A3FF0D3-4417-492B-8929-11AB24EA0A90}>TypeLib
68. In the right panel, locate and delete the entry:
    (Default) = "{09C554C3-109B-483C-A06B-F14172F1A947}"
69. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>tuvaro.tuvaroHlpr.1
70. In the right panel, locate and delete the entry:
    (Default) = "CescrtHlpr Object"
71. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>tuvaro.tuvaroHlpr.1>CLSID
72. In the right panel, locate and delete the entry:
    (Default) = "{5CB02877-EFBC-4317-B608-9E24B11BAB40}"
73. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>tuvaro.tuvaroHlpr
74. In the right panel, locate and delete the entry:
    (Default) = "CescrtHlpr Object"
75. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>tuvaro.tuvaroHlpr>CLSID
76. In the right panel, locate and delete the entry:
    (Default) = "{5CB02877-EFBC-4317-B608-9E24B11BAB40}"
77. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>tuvaro.tuvaroHlpr>CurVer
78. In the right panel, locate and delete the entry:
    (Default) = "tuvaro.tuvaroHlpr.1"
79. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{5CB02877-EFBC-4317-B608-9E24B11BAB40}
80. In the right panel, locate and delete the entry:
    (Default) = "CescrtHlpr Object"
81. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{5CB02877-EFBC-4317-B608-9E24B11BAB40}>ProgID
82. In the right panel, locate and delete the entry:
    (Default) = "tuvaro.tuvaroHlpr.1"
83. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{5CB02877-EFBC-4317-B608-9E24B11BAB40}>VersionIndependentProgID
84. In the right panel, locate and delete the entry:
    (Default) = "tuvaro.tuvaroHlpr"
85. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{5CB02877-EFBC-4317-B608-9E24B11BAB40}>InprocServer32
86. In the right panel, locate and delete the entry:
    (Default) = "%Program Files%\tuvaro\tuvaro\1.8.12.7\bh\tuvaro.dll"
87. Again In the right panel, locate and delete the entry:
    ThreadingModel = "apartment"
88. Again In the right panel, locate and delete the entry:
    AppID = "{09C554C3-109B-483C-A06B-F14172F1A947}"
89. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{5CB02877-EFBC-4317-B608-9E24B11BAB40}>TypeLib
90. In the right panel, locate and delete the entry:
    (Default) = "{09C554C3-109B-483C-A06B-F14172F1A947}"
91. Again In the right panel, locate and delete the entry:
    (Default) = "tuvaro Helper Object"
92. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
93. In the right panel, locate and delete the entry:
    (Default) = "escortApp"
94. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>escortApp.DLL
95. In the right panel, locate and delete the entry:
    AppID = "{D7EE8177-D51E-4F89-92B6-83EA2EC40800}"
96. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>tuvaro.tuvaroappCore.1
97. In the right panel, locate and delete the entry:
    (Default) = "appCore Object"
98. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>tuvaro.tuvaroappCore.1>CLSID
99. In the right panel, locate and delete the entry:
    (Default) = "{9389BE07-565A-45A0-B1A3-3DE01AA1C5CA}"
100. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>tuvaro.tuvaroappCore
101. In the right panel, locate and delete the entry:
     (Default) = "appCore Object"
102. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>tuvaro.tuvaroappCore>CLSID
103. In the right panel, locate and delete the entry:
     (Default) = "{9389BE07-565A-45A0-B1A3-3DE01AA1C5CA}"
104. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>tuvaro.tuvaroappCore>CurVer
105. In the right panel, locate and delete the entry:
     (Default) = "tuvaro.tuvaroappCore.1"
106. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{9389BE07-565A-45A0-B1A3-3DE01AA1C5CA}
107. In the right panel, locate and delete the entry:
     (Default) = "appCore Object"
108. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{9389BE07-565A-45A0-B1A3-3DE01AA1C5CA}>ProgID
109. In the right panel, locate and delete the entry:
     (Default) = "tuvaro.tuvaroappCore.1"
110. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{9389BE07-565A-45A0-B1A3-3DE01AA1C5CA}>VersionIndependentProgID
111. In the right panel, locate and delete the entry:
     (Default) = "tuvaro.tuvaroappCore"
112. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{9389BE07-565A-45A0-B1A3-3DE01AA1C5CA}>InprocServer32
113. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\tuvaro\tuvaro\1.8.12.7\tuvaroApp.dll"
114. Again In the right panel, locate and delete the entry:
     ThreadingModel = "apartment"
115. Again In the right panel, locate and delete the entry:
     AppID = "{D7EE8177-D51E-4F89-92B6-83EA2EC40800}"
116. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{9389BE07-565A-45A0-B1A3-3DE01AA1C5CA}>TypeLib
117. In the right panel, locate and delete the entry:
     (Default) = "{D7EE8177-D51E-4F89-92B6-83EA2EC40800}"
118. Again In the right panel, locate and delete the entry:
     hrdId = "1cca0df5000000000000005056bc6dd2"
119. Again In the right panel, locate and delete the entry:
     instlDay = "18098"
120. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{240A6AD4-4868-4513-A8DD-3ABF47E1F146}
121. In the right panel, locate and delete the entry:
     (Default) = "Ixtrnlmain"
122. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{240A6AD4-4868-4513-A8DD-3ABF47E1F146}>ProxyStubClsid32
123. In the right panel, locate and delete the entry:
     (Default) = "{00020424-0000-0000-C000-000000000046}"
124. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{240A6AD4-4868-4513-A8DD-3ABF47E1F146}>TypeLib
125. In the right panel, locate and delete the entry:
     (Default) = "{A02005FA-FFF4-4099-9D14-E097378574C4}"
126. Again In the right panel, locate and delete the entry:
     Version = "1.0"
127. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{DD973375-0904-4886-8F63-6FC3A2BE6544}
128. In the right panel, locate and delete the entry:
     (Default) = "IappCore"
129. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{DD973375-0904-4886-8F63-6FC3A2BE6544}>ProxyStubClsid32
130. In the right panel, locate and delete the entry:
     (Default) = "{00020424-0000-0000-C000-000000000046}"
131. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{DD973375-0904-4886-8F63-6FC3A2BE6544}>TypeLib
132. In the right panel, locate and delete the entry:
     (Default) = "{A02005FA-FFF4-4099-9D14-E097378574C4}"
133. Again In the right panel, locate and delete the entry:
     Version = "1.0"
134. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{C6712CEF-79A8-440E-A7AC-4EF00C856922}
135. In the right panel, locate and delete the entry:
     (Default) = "IXtrnlBsc"
136. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{C6712CEF-79A8-440E-A7AC-4EF00C856922}>ProxyStubClsid32
137. In the right panel, locate and delete the entry:
     (Default) = "{00020424-0000-0000-C000-000000000046}"
138. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{C6712CEF-79A8-440E-A7AC-4EF00C856922}>TypeLib
139. In the right panel, locate and delete the entry:
     (Default) = "{A02005FA-FFF4-4099-9D14-E097378574C4}"
140. Again In the right panel, locate and delete the entry:
     Version = "1.0"
141. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{23D1685B-A018-430F-B3AB-F517B471569E}
142. In the right panel, locate and delete the entry:
     (Default) = "IEHostWnd"
143. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{23D1685B-A018-430F-B3AB-F517B471569E}>ProxyStubClsid32
144. In the right panel, locate and delete the entry:
     (Default) = "{00020424-0000-0000-C000-000000000046}"
145. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{23D1685B-A018-430F-B3AB-F517B471569E}>TypeLib
146. In the right panel, locate and delete the entry:
     (Default) = "{A02005FA-FFF4-4099-9D14-E097378574C4}"
147. Again In the right panel, locate and delete the entry:
     Version = "1.0"
148. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{427F9EE7-35CB-4EC6-ACCA-122AE77C68B8}
149. In the right panel, locate and delete the entry:
     (Default) = "IXmlCnfg"
150. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{427F9EE7-35CB-4EC6-ACCA-122AE77C68B8}>ProxyStubClsid32
151. In the right panel, locate and delete the entry:
     (Default) = "{00020424-0000-0000-C000-000000000046}"
152. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{427F9EE7-35CB-4EC6-ACCA-122AE77C68B8}>TypeLib
153. In the right panel, locate and delete the entry:
     (Default) = "{A02005FA-FFF4-4099-9D14-E097378574C4}"
154. Again In the right panel, locate and delete the entry:
     Version = "1.0"
155. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{033998B0-0745-472D-8F2B-EB55EBA42F58}
156. In the right panel, locate and delete the entry:
     (Default) = "IRegmapDisp"
157. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{033998B0-0745-472D-8F2B-EB55EBA42F58}>ProxyStubClsid32
158. In the right panel, locate and delete the entry:
     (Default) = "{00020424-0000-0000-C000-000000000046}"
159. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{033998B0-0745-472D-8F2B-EB55EBA42F58}>TypeLib
160. In the right panel, locate and delete the entry:
     (Default) = "{A02005FA-FFF4-4099-9D14-E097378574C4}"
161. Again In the right panel, locate and delete the entry:
     Version = "1.0"
162. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{B98D2F59-0329-4A5A-B112-B989B4D4BACA}
163. In the right panel, locate and delete the entry:
     (Default) = "IIEWndFct"
164. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{B98D2F59-0329-4A5A-B112-B989B4D4BACA}>ProxyStubClsid32
165. In the right panel, locate and delete the entry:
     (Default) = "{00020424-0000-0000-C000-000000000046}"
166. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{B98D2F59-0329-4A5A-B112-B989B4D4BACA}>TypeLib
167. In the right panel, locate and delete the entry:
     (Default) = "{A02005FA-FFF4-4099-9D14-E097378574C4}"
168. Again In the right panel, locate and delete the entry:
     Version = "1.0"
169. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{4F3868C3-C08B-490E-93AD-834413F7FD22}
170. In the right panel, locate and delete the entry:
     (Default) = "IxpEmphszr"
171. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{4F3868C3-C08B-490E-93AD-834413F7FD22}>ProxyStubClsid32
172. In the right panel, locate and delete the entry:
     (Default) = "{00020424-0000-0000-C000-000000000046}"
173. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{4F3868C3-C08B-490E-93AD-834413F7FD22}>TypeLib
174. In the right panel, locate and delete the entry:
     (Default) = "{A02005FA-FFF4-4099-9D14-E097378574C4}"
175. Again In the right panel, locate and delete the entry:
     Version = "1.0"
176. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{F77B6A63-1EC9-45FB-A7AB-F9930CBBAD32}
177. In the right panel, locate and delete the entry:
     (Default) = "IwebAtrbts"
178. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{F77B6A63-1EC9-45FB-A7AB-F9930CBBAD32}>ProxyStubClsid32
179. In the right panel, locate and delete the entry:
     (Default) = "{00020424-0000-0000-C000-000000000046}"
180. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{F77B6A63-1EC9-45FB-A7AB-F9930CBBAD32}>TypeLib
181. In the right panel, locate and delete the entry:
     (Default) = "{A02005FA-FFF4-4099-9D14-E097378574C4}"
182. Again In the right panel, locate and delete the entry:
     Version = "1.0"
183. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{4C694E60-4549-466D-83FB-C4C162FB53E2}
184. In the right panel, locate and delete the entry:
     (Default) = "IEvntCntr"
185. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{4C694E60-4549-466D-83FB-C4C162FB53E2}>ProxyStubClsid32
186. In the right panel, locate and delete the entry:
     (Default) = "{00020424-0000-0000-C000-000000000046}"
187. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{4C694E60-4549-466D-83FB-C4C162FB53E2}>TypeLib
188. In the right panel, locate and delete the entry:
     (Default) = "{A02005FA-FFF4-4099-9D14-E097378574C4}"
189. Again In the right panel, locate and delete the entry:
     Version = "1.0"
190. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{A88A4515-66BC-413B-9526-3FF53B5F21C8}
191. In the right panel, locate and delete the entry:
     (Default) = "IesrvXtrnl"
192. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{A88A4515-66BC-413B-9526-3FF53B5F21C8}>ProxyStubClsid32
193. In the right panel, locate and delete the entry:
     (Default) = "{00020424-0000-0000-C000-000000000046}"
194. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{A88A4515-66BC-413B-9526-3FF53B5F21C8}>TypeLib
195. In the right panel, locate and delete the entry:
     (Default) = "{A02005FA-FFF4-4099-9D14-E097378574C4}"
196. Again In the right panel, locate and delete the entry:
     Version = "1.0"
197. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{6BE4B879-4E7D-4AE8-A356-DCBD7029612E}
198. In the right panel, locate and delete the entry:
     (Default) = "IEscortFctry"
199. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{6BE4B879-4E7D-4AE8-A356-DCBD7029612E}>ProxyStubClsid32
200. In the right panel, locate and delete the entry:
     (Default) = "{00020424-0000-0000-C000-000000000046}"
201. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{6BE4B879-4E7D-4AE8-A356-DCBD7029612E}>TypeLib
202. In the right panel, locate and delete the entry:
     (Default) = "{A02005FA-FFF4-4099-9D14-E097378574C4}"
203. Again In the right panel, locate and delete the entry:
     Version = "1.0"
204. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{33278AD4-8305-49E1-A58B-E5A9057BFDC3}
205. In the right panel, locate and delete the entry:
     (Default) = "IescrtSrvc"
206. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{33278AD4-8305-49E1-A58B-E5A9057BFDC3}>ProxyStubClsid32
207. In the right panel, locate and delete the entry:
     (Default) = "{00020424-0000-0000-C000-000000000046}"
208. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{33278AD4-8305-49E1-A58B-E5A9057BFDC3}>TypeLib
209. In the right panel, locate and delete the entry:
     (Default) = "{A02005FA-FFF4-4099-9D14-E097378574C4}"
210. Again In the right panel, locate and delete the entry:
     Version = "1.0"
211. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>{B12E99ED-69BD-437C-86BE-C862B9E5444D}
212. In the right panel, locate and delete the entry:
     (Default) = "escortEng"
213. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>escortEng.DLL
214. In the right panel, locate and delete the entry:
     AppID = "{B12E99ED-69BD-437C-86BE-C862B9E5444D}"
215. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>t
216. In the right panel, locate and delete the entry:
     (Default) = "escrtAx Object"
217. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>t>CLSID
218. In the right panel, locate and delete the entry:
     (Default) = "{4CBF0FC8-4222-435B-9E57-0DE807350D39}"
219. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>t>CurVer
220. In the right panel, locate and delete the entry:
     (Default) = "t"
221. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{4CBF0FC8-4222-435B-9E57-0DE807350D39}
222. In the right panel, locate and delete the entry:
     (Default) = "escrtAx Object"
223. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{4CBF0FC8-4222-435B-9E57-0DE807350D39}>ProgID
224. In the right panel, locate and delete the entry:
     (Default) = "t"
225. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{4CBF0FC8-4222-435B-9E57-0DE807350D39}>VersionIndependentProgID
226. In the right panel, locate and delete the entry:
     (Default) = "t"
227. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{4CBF0FC8-4222-435B-9E57-0DE807350D39}>InprocServer32
228. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\tuvaro\tuvaro\1.8.12.7\tuvaroEng.dll"
229. Again In the right panel, locate and delete the entry:
     ThreadingModel = "apartment"
230. Again In the right panel, locate and delete the entry:
     AppID = "{B12E99ED-69BD-437C-86BE-C862B9E5444D}"
231. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{4CBF0FC8-4222-435B-9E57-0DE807350D39}>TypeLib
232. In the right panel, locate and delete the entry:
     (Default) = "{B12E99ED-69BD-437C-86BE-C862B9E5444D}"
233. Again In the right panel, locate and delete the entry:
     vrsni = "1.8.12.7"
234. Again In the right panel, locate and delete the entry:
     afltId = "orgnl"
235. Again In the right panel, locate and delete the entry:
     aflt = "orgnl"
236. Again In the right panel, locate and delete the entry:
     smplGrp = "none"
237. Again In the right panel, locate and delete the entry:
     tlbrId = "base"
238. Again In the right panel, locate and delete the entry:
     instlRef = ""
239. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>{2768469C-717B-401F-8532-C6D88BAE0339}>instl>dfltLng
240. In the right panel, locate and delete the entry:
     dfltLng = ""
241. Again In the right panel, locate and delete the entry:
     vrsnTs = "1.8.12.77:29:30"
242. Again In the right panel, locate and delete the entry:
     tlbrSrchUrl = "{random characters}"
243. Again In the right panel, locate and delete the entry:
     uninstallAll = "false"
244. Again In the right panel, locate and delete the entry:
     autoRvrt = "false"
245. Again In the right panel, locate and delete the entry:
     rvrt = "false"
246. Again In the right panel, locate and delete the entry:
     admin = "false"
247. Again In the right panel, locate and delete the entry:
     postUninstall = ""
248. Again In the right panel, locate and delete the entry:
     newTab = "false"
249. Again In the right panel, locate and delete the entry:
     dpblck = ""
250. Again In the right panel, locate and delete the entry:
     ds_url = "{random characters}"
251. Again In the right panel, locate and delete the entry:
     excTlbr = "false"
252. Again In the right panel, locate and delete the entry:
     ffxUnstlRst = "false"
253. Again In the right panel, locate and delete the entry:
     chrInstl = "all"
254. Again In the right panel, locate and delete the entry:
     ffxInstl = "all"
255. Again In the right panel, locate and delete the entry:
     ieInstl = "all"
256. Again In the right panel, locate and delete the entry:
     uninstExt = "false"
257. Again In the right panel, locate and delete the entry:
     hp_url = "{random characters}"
258. Again In the right panel, locate and delete the entry:
     hp_chrm = "{random characters}"
259. Again In the right panel, locate and delete the entry:
     hp_ffx = "{random characters}"
260. Again In the right panel, locate and delete the entry:
     nt_url = "{random characters}"
261. Again In the right panel, locate and delete the entry:
     dsIE = ""
262. Again In the right panel, locate and delete the entry:
     dsFFX = "Tuvaro"
263. Again In the right panel, locate and delete the entry:
     dpk = "a3f0955cbf5582a1c1e9b51b717c3b0f"
264. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Wow6432Node>Google
265. In the right panel, locate and delete the entry:
     (Default) = ""
266. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Wow6432Node>Google>Chrome
267. In the right panel, locate and delete the entry:
     (Default) = ""
268. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Wow6432Node>Google>Chrome>Extensions
269. In the right panel, locate and delete the entry:
     (Default) = ""
270. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Wow6432Node>Google>Chrome>Extensions>omgjkafaoidbgamjoklhaiiciahohkbh
271. In the right panel, locate and delete the entry:
     path = "%Program Files%\tuvaro\tuvaro\1.8.12.7\tuvaro.crx"
272. Again In the right panel, locate and delete the entry:
     version = "1.0"
273. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Wow6432Node>tuvaro>tuvaro>Instl
274. In the right panel, locate and delete the entry:
     InstallDir = "%Program Files%\tuvaro\tuvaro\1.8.12.7"
275. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Wow6432Node>Microsoft>Windows>CurrentVersion>Uninstall>tuvaro
276. In the right panel, locate and delete the entry:
     DisplayName = "Tuvaro toolbar on IE and Chrome"
277. Again In the right panel, locate and delete the entry:
     UninstallString = "%Program Files%\tuvaro\tuvaro\1.8.12.7\uninstall.exe"
278. Again In the right panel, locate and delete the entry:
     DisplayIcon = "%Program Files%\tuvaro\tuvaro\1.8.12.7\tuvarosrv.exe"
279. Again In the right panel, locate and delete the entry:
     DisplayVersion = "1.8.12.7"
280. Again In the right panel, locate and delete the entry:
     Comments = "Tuvaro toolbar "
281. Again In the right panel, locate and delete the entry:
     Publisher = "tuvaro"
282. Again In the right panel, locate and delete the entry:
     NoModify = "1"
283. Again In the right panel, locate and delete the entry:
     NoRepair = "1"
284. Again In the right panel, locate and delete the entry:
     EstimatedSize = "2500"
285. Again In the right panel, locate and delete the entry:
     uninstaller = "%Program Files%\tuvaro\tuvaro\1.8.12.7\uninstall.exe"
286. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>{2792F312-417E-4517-A824-7F55A2F18BE5}
287. In the right panel, locate and delete the entry:
     (Default) = "esrv"
288. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>esrv.EXE
289. In the right panel, locate and delete the entry:
     AppID = "{2792F312-417E-4517-A824-7F55A2F18BE5}"
290. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>esrv.tuvaroESrvc.1
291. In the right panel, locate and delete the entry:
     (Default) = "escrtSrvc Object"
292. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>esrv.tuvaroESrvc.1>CLSID
293. In the right panel, locate and delete the entry:
     (Default) = "{1E8F8EDE-EB73-4CA9-A139-6DA2B576FD69}"
294. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>esrv.tuvaroESrvc
295. In the right panel, locate and delete the entry:
     (Default) = "escrtSrvc Object"
296. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>esrv.tuvaroESrvc>CLSID
297. In the right panel, locate and delete the entry:
     (Default) = "{1E8F8EDE-EB73-4CA9-A139-6DA2B576FD69}"
298. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>esrv.tuvaroESrvc>CurVer
299. In the right panel, locate and delete the entry:
     (Default) = "esrv.tuvaroESrvc.1"
300. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{1E8F8EDE-EB73-4CA9-A139-6DA2B576FD69}
301. In the right panel, locate and delete the entry:
     (Default) = "escrtSrvc Object"
302. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{1E8F8EDE-EB73-4CA9-A139-6DA2B576FD69}>ProgID
303. In the right panel, locate and delete the entry:
     (Default) = "esrv.tuvaroESrvc.1"
304. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{1E8F8EDE-EB73-4CA9-A139-6DA2B576FD69}>VersionIndependentProgID
305. In the right panel, locate and delete the entry:
     (Default) = "esrv.tuvaroESrvc"
306. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{1E8F8EDE-EB73-4CA9-A139-6DA2B576FD69}>LocalServer32
307. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\tuvaro\tuvaro\1.8.12.7\tuvarosrv.exe"
308. Again In the right panel, locate and delete the entry:
     ThreadingModel = "apartment"
309. Again In the right panel, locate and delete the entry:
     AppID = "{2792F312-417E-4517-A824-7F55A2F18BE5}"
310. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{1E8F8EDE-EB73-4CA9-A139-6DA2B576FD69}>TypeLib
311. In the right panel, locate and delete the entry:
     (Default) = "{2792F312-417E-4517-A824-7F55A2F18BE5}"
312. Close Registry Editor.

To manually delete a malware/grayware file from an affected system:

•For Windows 7, Windows Server 2008 (R2), Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2):

1. Open a Windows Explorer window.
   • For Windows 7 and Server 2008 (R2) users, click Start>Computer.
   • For Windows 8, 8.1, 10, and Server 2012 (R2) users, right-click on the lower-left corner of the screen,then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\user.js
   • %User Temp%\tuvaro\tuvaro\1.8.12.7\tuvaro4ie.exe
   • %Program Files%\tuvaro\tuvaro\1.8.12.7\tuvaroTlbr.dll
   • %Program Files%\tuvaro\tuvaro\1.8.12.7\tuvaro.crx
   • %Program Files%\tuvaro\tuvaro\1.8.12.7\bh\tuvaro.dll
   • %Program Files%\tuvaro\tuvaro\1.8.12.7\tuvarosrv.exe
   • %User Temp%\tuvaro\tuvaro\1.8.12.7\nsis.js
   • %User Temp%\mt_ffx\tuvaro\tuvaro\1.8.12.7\tuvaro.xpi
   • %Program Files%\tuvaro\tuvaro\1.8.12.7\escortShld.dll
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\searchplugins\tuvaro.xml
   • %Program Files%\tuvaro\tuvaro\1.8.12.7\tuvaroApp.dll
   • %User Temp%\tuvaro\tuvaro\1.8.12.7\C\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\lj5mikyj.default\user.js
   • %Program Files%\tuvaro\tuvaro\1.8.12.7\uninstall.exe
   • %System Root%\user.js
   • %Application Data%\tuvaro\sqlite3.dll
   • %Program Files%\tuvaro\tuvaro\1.8.12.7\tuvaroEng.dll
   • %User Temp%\tuvaro\tuvaro\1.8.12.7\tuvaro4ffx.exe
3. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7 and Windows Server 2008 (R2).

To delete malware/grayware/spyware folders:

For Windows 7, Windows Server 2008 (R2), Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2):

1. Open a Windows Explorer window.
   • For Windows 7 and Server 2008 (R2) users, click Start>Computer.
   • For Windows 8, 8.1, 10, and Server 2012 (R2) users, right-click on the lower-left corner of the screen,then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %Application Data%\Mozilla\Firefox\Profiles
   • %Program Files%\tuvaro\tuvaro\1.8.12.7\bh
   • %User Temp%\tuvaro\tuvaro
   • %User Temp%\mt_ffx
   • %User Temp%\mt_ffx\tuvaro\tuvaro
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\extensions
   • %User Temp%\mt_ffx\tuvaro\tuvaro\1.8.12.7
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default
   • %User Temp%\mt_ffx\tuvaro
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\searchplugins
   • %System Root%\Users
   • %Application Data%\Mozilla\Firefox
   • %Application Data%\Mozilla
   • %User Temp%\tuvaro
   • %Program Files%\tuvaro\tuvaro
   • %Program Files%\tuvaro
   • %Application Data%\tuvaro
   • %Program Files%\tuvaro\tuvaro\1.8.12.7
   • %User Temp%\tuvaro\tuvaro\1.8.12.7
   • %User Profile%\AppData
3. Once located, select the file then press SHIFT+DELETE to permanently delete the folder.
4. Repeat steps 2-3 for the remaining folders:
   • %Application Data%\Mozilla\Firefox\Profiles
   • %Program Files%\tuvaro\tuvaro\1.8.12.7\bh
   • %User Temp%\tuvaro\tuvaro
   • %User Temp%\mt_ffx
   • %User Temp%\mt_ffx\tuvaro\tuvaro
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\extensions
   • %User Temp%\mt_ffx\tuvaro\tuvaro\1.8.12.7
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default
   • %User Temp%\mt_ffx\tuvaro
   • %Application Data%\Mozilla\Firefox\Profiles\lj5mikyj.default\searchplugins
   • %System Root%\Users
   • %Application Data%\Mozilla\Firefox
   • %Application Data%\Mozilla
   • %User Temp%\tuvaro
   • %Program Files%\tuvaro\tuvaro
   • %Program Files%\tuvaro
   • %Application Data%\tuvaro
   • %Program Files%\tuvaro\tuvaro\1.8.12.7
   • %User Temp%\tuvaro\tuvaro\1.8.12.7
   • %User Profile%\AppData
   *Note: Read the following Microsoft page if these steps do not work on Windows 7 and Server 2008 (R2).