TROJ_WARSPY.A

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall
3. Still in the left panel, locate and delete the key:
   Internet Connection Update and HomeP KB234087
4. In the left panel, double-click the following:
   HKEY_CLASSES_ROOT>CLSID>{D56A1203-1452-EBA1-7294-EE3377770000}
5. Still in the left panel, locate and delete the key:
   InProcServer32
6. In the left panel, double-click the following:
   HKEY_CLASSES_ROOT
7. Still in the left panel, locate and delete the key:
   Serch_hook.transURL.1
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Serch_hook.transURL.1
9. Still in the left panel, locate and delete the key:
   CLSID
10. Again Still in the left panel, locate and delete the key:
    Serch_hook.transURL
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Serch_hook.transURL
12. Still in the left panel, locate and delete the key:
    CLSID
13. Again Still in the left panel, locate and delete the key:
    CurVer
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
15. Still in the left panel, locate and delete the key:
    {C7EDAB2E-D7F9-11D8-BA48-C79B0C409D70}
16. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{C7EDAB2E-D7F9-11D8-BA48-C79B0C409D70}
17. Still in the left panel, locate and delete the key:
    ProgID
18. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
19. Again Still in the left panel, locate and delete the key:
    Programmable
20. Again Still in the left panel, locate and delete the key:
    InprocServer32
21. Again Still in the left panel, locate and delete the key:
    TypeLib
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
23. Still in the left panel, locate and delete the key:
    {C7EDAB21-D7F9-11D8-BA48-C79B0C409D70}
24. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{C7EDAB21-D7F9-11D8-BA48-C79B0C409D70}
25. Still in the left panel, locate and delete the key:
    1.0
26. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{C7EDAB21-D7F9-11D8-BA48-C79B0C409D70}>1.0
27. Still in the left panel, locate and delete the key:
    FLAGS
28. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{C7EDAB21-D7F9-11D8-BA48-C79B0C409D70}>1.0>0
29. Still in the left panel, locate and delete the key:
    win32
30. Again Still in the left panel, locate and delete the key:
    HELPDIR
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
32. Still in the left panel, locate and delete the key:
    {C7EDAB2D-D7F9-11D8-BA48-C79B0C409D70}
33. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C7EDAB2D-D7F9-11D8-BA48-C79B0C409D70}
34. Still in the left panel, locate and delete the key:
    ProxyStubClsid
35. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
36. Again Still in the left panel, locate and delete the key:
    TypeLib
37. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>Internet Connection Update and HomeP KB234087
3. In the right panel, locate and delete the entry:
   DisplayName = "Internet Connection Update and HomeP KB234087"
4. Again In the right panel, locate and delete the entry:
   UninstallString = "%System%\guninst.exe"
5. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{D56A1203-1452-EBA1-7294-EE3377770000}>InProcServer32
6. In the right panel, locate and delete the entry:
   ThreadingModel = "Apartment"
7. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>SharedTaskScheduler
8. In the right panel, locate and delete the entry:
   {D56A1203-1452-EBA1-7294-EE3377770000} = "Interlinking Memory Support"
9. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{C7EDAB2E-D7F9-11D8-BA48-C79B0C409D70}>InprocServer32
10. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C7EDAB2D-D7F9-11D8-BA48-C79B0C409D70}>TypeLib
12. In the right panel, locate and delete the entry:
    Version = "1.0"
13. Close Registry Editor.

To restore the registry value this malware/grayware/spyware modified:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Main
3. In the right panel, locate the registry value:
   Start Page = "http://www.{BLOCKED}ers.info/ad0352"
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   Start Page = http://www.microsoft.com/isapi/redir.dll?prd
5. Close Registry Editor.

To delete malware/grayware component files:

1. Search for the following files:
   
   • %System%\param32.dll
   • %System%\searchdll.dll
   • %System%\guninst.exe
   • %System%\popup_bl.dll
   • %System%\Air Tickets.ico
   • %System%\Online Betting.ico
   • %System%\BlackJack.ico
   • %System%\Car Insurance.ico
   • %System%\Cruises.ico
   • %System%\Remove Spyware.ico
   • %System%\Cheap Cigarettes.ico
   • %System%\Phentermine.ico
   • %System%\Online Casino.ico
   • %System%\Viagra.ico
   • %System%\MP3.ico
   • %System%\Party Poker.ico
   • %System%\Credit Card.ico
   • %System%\Pharmacy.ico
   • %System%\Currency Trading.ico
   • %System%\Britney Spears.ico
   • %System%\Big Tits.ico
   • %System%\Pornstars.ico
   • %System%\Lesbian Sex.ico
   • %System%\Oral Sex.ico
   • %Desktop%\Air Tickets.url
   • %Desktop%\Online Betting.url
   • %Desktop%\BlackJack.url
   • %Desktop%\Car Insurance.url
   • %Desktop%\Cruises.url
   • %Desktop%\Remove Spyware.url
   • %Desktop%\Cheap Cigarettes.url
   • %Desktop%\Phentermine.url
   • %Desktop%\Online Casino.url
   • %Desktop%\Viagra.url
   • %Desktop%\MP3.url
   • %Desktop%\Party Poker.url
   • %Desktop%\Credit Card.url
   • %Desktop%\Pharmacy.url
   • %Desktop%\Currency Trading.url
   • %Desktop%\Britney Spears.url
   • %Desktop%\Big Tits.url
   • %Desktop%\Pornstars.url
   • %Desktop%\Lesbian Sex.url
   • %Desktop%\Oral Sex.url
   
   Note: To do a search for the following files, right-click Start then click Search... or Find..., depending on the version of Windows you are running. For each file to be deleted, type its file name in the Named input box. In the Look In drop-down list, select My Computer, then press Enter.
2. Once located, select the file then press SHIFT+DELETE to permanently delete the file.
3. Repeat the said steps for all files listed.