JS_PALEVO.ARJ

To delete the registry value this malware created:

1. Open Registry Editor. To do this, click Start>Run, type regedit in the text box provided, then press Enter.
2. In the left panel of the Registry Editor window, double-click the following:
   HKEY_CURRENT_USER>Software>Local AppWizard-Generated Applications>PJM
3. In the right panel, locate and delete the entry:
   Recent File List = "(Default Value)"
4. Again In the right panel, locate and delete the entry:
   Settings = "(Default Value)"
5. In the left panel of the Registry Editor window, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Windows>ShellNoRoam>MUICache>c:>users>public
6. In the right panel, locate and delete the entry:
   t.exe = "Microsoft"
7. In the left panel of the Registry Editor window, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>MJ
8. In the right panel, locate and delete the entry:
   CLSID = "{Random Hex Values}"
9. Close Registry Editor.

To delete registry keys this malware/grayware created:

1. Open Registry Editor. To do this, click Start>Run, type regedit in the text box provided, then press Enter.
2. In the left panel of the Registry Editor window, double-click the following:
   HKEY_CURRENT_USER>Software
3. Still in the left panel, locate and delete the key:
   Local AppWizard-Generated Applications = ""
4. In the left panel of the Registry Editor window, double-click the following:
   HKEY_CURRENT_USER>Software>Local AppWizard-Generated Applications
5. Still in the left panel, locate and delete the key:
   PJM = ""
6. In the left panel of the Registry Editor window, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes
7. Still in the left panel, locate and delete the key:
   MJ = ""
8. Close Registry Editor.

• c:\users\public\12.vbs
• c:\users\public\t.exe

To delete malware/grayware component files:

1. Search for the following files:
   
    
   • c:\users\public\12.vbs
   • c:\users\public\t.exe
   
   
   
   Note: To do a search for the following files, right-click Start then click Search... or Find..., depending on the version of Windows you are running. For each file to be deleted, type its file name in the Named input box. In the Look In drop-down list, select My Computer, then press Enter.
2. Once located, select the file then press SHIFT+DELETE to permanently delete the file.
3. Repeat the said steps for all files listed.

To reset Internet security settings:

1. Close all Internet browser windows.
2. Open Control Panel. To do this:
   • On Windows 2000
   Click Start>Settings>Control Panel
   • On Windows XP, Server 2003, Vista, and 7
   Click Start>Control Panel
3. Double-click Internet Options.
4. In the Internet Properties window, click the Security tab.
5. For each Web content zone, click on the Default Level button to set each zone to the default setting.
6. Click OK.