TROJ_AGENT.SMFG

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>uusee
3. Still in the left panel, locate and delete the key:
   UUPlayer_2008
4. Again Still in the left panel, locate and delete the key:
   UUPlayer_2010
5. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
6. Still in the left panel, locate and delete the key:
   {34A24C1F-46A0-46B1-92C9-210132D85E60}
7. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{34A24C1F-46A0-46B1-92C9-210132D85E60}
8. Still in the left panel, locate and delete the key:
   1.0
9. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{34A24C1F-46A0-46B1-92C9-210132D85E60}>1.0
10. Still in the left panel, locate and delete the key:
    FLAGS
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{34A24C1F-46A0-46B1-92C9-210132D85E60}>1.0>0
12. Still in the left panel, locate and delete the key:
    win32
13. Again Still in the left panel, locate and delete the key:
    HELPDIR
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
15. Still in the left panel, locate and delete the key:
    {263BE21D-D834-4971-8097-1F5954995C18}
16. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{263BE21D-D834-4971-8097-1F5954995C18}
17. Still in the left panel, locate and delete the key:
    ProxyStubClsid
18. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
19. Again Still in the left panel, locate and delete the key:
    TypeLib
20. Again Still in the left panel, locate and delete the key:
    {56ABD0A3-FEA0-420E-A72C-6D4D7C3DBB2D}
21. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{56ABD0A3-FEA0-420E-A72C-6D4D7C3DBB2D}
22. Still in the left panel, locate and delete the key:
    ProxyStubClsid
23. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
24. Again Still in the left panel, locate and delete the key:
    TypeLib
25. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID
26. Still in the left panel, locate and delete the key:
    {1185448F-CD61-4FD0-A728-F62407D354AA}
27. Again Still in the left panel, locate and delete the key:
    {6C348EAC-3600-45D3-B477-DFEDDFB78472}
28. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT
29. Still in the left panel, locate and delete the key:
    UUWEBPLAYER.UUWebPlayerCtrl.1
30. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>Media Type>{E436EB83-524F-11CE-9F53-0020AF0BA770}
31. Still in the left panel, locate and delete the key:
    {F070A0E8-B213-47E4-8991-252AC82EE6A1}
32. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>Media Type>Extensions
33. Still in the left panel, locate and delete the key:
    .ucf
34. Again Still in the left panel, locate and delete the key:
    {48CF8992-4161-49D6-9A9B-F1FDB3BAE74D}
35. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{48CF8992-4161-49D6-9A9B-F1FDB3BAE74D}
36. Still in the left panel, locate and delete the key:
    InprocServer32
37. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID>{083863F1-70DE-11D0-BD40-00A0C911CE86}>Instance
38. Still in the left panel, locate and delete the key:
    {48CF8992-4161-49D6-9A9B-F1FDB3BAE74D}
39. Again Still in the left panel, locate and delete the key:
    {17413BA0-0160-4C1F-BA66-679436BCA89B}
40. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{17413BA0-0160-4C1F-BA66-679436BCA89B}
41. Still in the left panel, locate and delete the key:
    InprocServer32
42. Again Still in the left panel, locate and delete the key:
    {17413BA0-0160-4C1F-BA66-679436BCA89B}
43. Again Still in the left panel, locate and delete the key:
    {91AD598F-876B-4790-8857-ABFE5ED6159F}
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{91AD598F-876B-4790-8857-ABFE5ED6159F}
45. Still in the left panel, locate and delete the key:
    InprocServer32
46. Again Still in the left panel, locate and delete the key:
    {E7F18B7F-9F1F-4AE6-9866-AB7E1A81ECCA}
47. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{E7F18B7F-9F1F-4AE6-9866-AB7E1A81ECCA}
48. Still in the left panel, locate and delete the key:
    InprocServer32
49. Again Still in the left panel, locate and delete the key:
    {A2113517-E452-43A3-977D-28BA30D5E389}
50. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{A2113517-E452-43A3-977D-28BA30D5E389}
51. Still in the left panel, locate and delete the key:
    InprocServer32
52. Again Still in the left panel, locate and delete the key:
    {0583926D-C114-4605-8DF3-770402F50E61}
53. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{0583926D-C114-4605-8DF3-770402F50E61}
54. Still in the left panel, locate and delete the key:
    InprocServer32
55. Again Still in the left panel, locate and delete the key:
    {91AD598F-876B-4790-8857-ABFE5ED6159F}
56. Again Still in the left panel, locate and delete the key:
    {E7F18B7F-9F1F-4AE6-9866-AB7E1A81ECCA}
57. Again Still in the left panel, locate and delete the key:
    {A2113517-E452-43A3-977D-28BA30D5E389}
58. Again Still in the left panel, locate and delete the key:
    {0583926D-C114-4605-8DF3-770402F50E61}
59. Again Still in the left panel, locate and delete the key:
    {754EFA30-C752-4F45-8890-6250A53FD512}
60. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{754EFA30-C752-4F45-8890-6250A53FD512}
61. Still in the left panel, locate and delete the key:
    1.0
62. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{754EFA30-C752-4F45-8890-6250A53FD512}>1.0
63. Still in the left panel, locate and delete the key:
    FLAGS
64. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{754EFA30-C752-4F45-8890-6250A53FD512}>1.0>0
65. Still in the left panel, locate and delete the key:
    win32
66. Again Still in the left panel, locate and delete the key:
    HELPDIR
67. Again Still in the left panel, locate and delete the key:
    {770B88B4-DCD8-4857-8E82-62C650F58545}
68. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{770B88B4-DCD8-4857-8E82-62C650F58545}
69. Still in the left panel, locate and delete the key:
    ProxyStubClsid
70. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
71. Again Still in the left panel, locate and delete the key:
    TypeLib
72. Again Still in the left panel, locate and delete the key:
    {BE61BB61-0E51-4080-8B6D-8F1FE00ABE38}
73. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BE61BB61-0E51-4080-8B6D-8F1FE00ABE38}
74. Still in the left panel, locate and delete the key:
    ProxyStubClsid
75. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
76. Again Still in the left panel, locate and delete the key:
    TypeLib
77. Again Still in the left panel, locate and delete the key:
    {945E37E3-156F-4757-AA1F-CBA338DDFBE9}
78. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>CoreCodec
79. Still in the left panel, locate and delete the key:
    CoreAVC Pro 2.x
80. Again Still in the left panel, locate and delete the key:
    CoreAVC Pro
81. Again Still in the left panel, locate and delete the key:
    UPLAYER.UPlayerCtrl.1
82. Again Still in the left panel, locate and delete the key:
    {41E77C38-9383-404C-BC49-EDF2AEA4E163}
83. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{41E77C38-9383-404C-BC49-EDF2AEA4E163}
84. Still in the left panel, locate and delete the key:
    1.0
85. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{41E77C38-9383-404C-BC49-EDF2AEA4E163}>1.0
86. Still in the left panel, locate and delete the key:
    FLAGS
87. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{41E77C38-9383-404C-BC49-EDF2AEA4E163}>1.0>0
88. Still in the left panel, locate and delete the key:
    win32
89. Again Still in the left panel, locate and delete the key:
    HELPDIR
90. Again Still in the left panel, locate and delete the key:
    {B9587E96-9349-4F58-A7D5-77E53811BDFD}
91. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B9587E96-9349-4F58-A7D5-77E53811BDFD}
92. Still in the left panel, locate and delete the key:
    ProxyStubClsid
93. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
94. Again Still in the left panel, locate and delete the key:
    TypeLib
95. Again Still in the left panel, locate and delete the key:
    {E9475D64-4461-4A22-BD58-132AF1D7D565}
96. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{E9475D64-4461-4A22-BD58-132AF1D7D565}
97. Still in the left panel, locate and delete the key:
    ProxyStubClsid
98. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
99. Again Still in the left panel, locate and delete the key:
    TypeLib
100. Again Still in the left panel, locate and delete the key:
     {28966B43-B5D0-4694-9E79-F5B4099F02D4}
101. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>uusee>UUPlayer_2008
3. In the right panel, locate and delete the entry:
   InstallName = "uusee_vip1_setup_2010.exe*010000000000000@{malware file name}"
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>uusee>UUPlayer_2010
5. In the right panel, locate and delete the entry:
   InstallName = "uusee_vip1_setup_2010.exe*010000000000000@{malware file name}"
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{263BE21D-D834-4971-8097-1F5954995C18}>TypeLib
7. In the right panel, locate and delete the entry:
   Version = "1.0"
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{56ABD0A3-FEA0-420E-A72C-6D4D7C3DBB2D}>TypeLib
9. In the right panel, locate and delete the entry:
   Version = "1.0"
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{1185448F-CD61-4FD0-A728-F62407D354AA}
11. In the right panel, locate and delete the entry:
    InprocServer32 = "%Program Files%\COMMON~1\uusee\UUWEBP~1.OCX"
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>UUWEBPLAYER.UUWebPlayerCtrl.1
13. In the right panel, locate and delete the entry:
    CLSID = "{6C348EAC-3600-45D3-B477-DFEDDFB78472}"
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{6C348EAC-3600-45D3-B477-DFEDDFB78472}
15. In the right panel, locate and delete the entry:
    ProgID = "UUWEBPLAYER.UUWebPlayerCtrl.1"
16. Again In the right panel, locate and delete the entry:
    InprocServer32 = "%Program Files%\COMMON~1\uusee\UUWEBP~1.OCX"
17. Again In the right panel, locate and delete the entry:
    ToolboxBitmap32 = "%Program Files%\COMMON~1\uusee\UUWEBP~1.OCX, 1"
18. Again In the right panel, locate and delete the entry:
    MiscStatus = "0"
19. Again In the right panel, locate and delete the entry:
    MiscStatus\1 = "131473"
20. Again In the right panel, locate and delete the entry:
    TypeLib = "{34A24C1F-46A0-46B1-92C9-210132D85E60}"
21. Again In the right panel, locate and delete the entry:
    Version = "1.0"
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{6C348EAC-3600-45D3-B477-DFEDDFB78472}>InprocServer32
23. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
24. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Media Type>{e436eb83-524f-11ce-9f53-0020af0ba770}>{F070A0E8-B213-47E4-8991-252AC82EE6A1}
25. In the right panel, locate and delete the entry:
    Source Filter = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"
26. Again In the right panel, locate and delete the entry:
    0 = "0,4,,46494c45"
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Media Type>Extensions>.ucf
28. In the right panel, locate and delete the entry:
    Source Filter = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"
29. Again In the right panel, locate and delete the entry:
    Media Type = "{E436EB83-524F-11CE-9F53-0020AF0BA770}"
30. Again In the right panel, locate and delete the entry:
    Subtype = "{F070A0E8-B213-47E4-8991-252AC82EE6A1}"
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{48CF8992-4161-49D6-9A9B-F1FDB3BAE74D}>InprocServer32
32. In the right panel, locate and delete the entry:
    ThreadingModel = "Both"
33. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{083863F1-70DE-11d0-BD40-00A0C911CE86}>Instance>{48CF8992-4161-49D6-9A9B-F1FDB3BAE74D}
34. In the right panel, locate and delete the entry:
    FriendlyName = "UUSEE DeMultiplexer"
35. Again In the right panel, locate and delete the entry:
    CLSID = "{48CF8992-4161-49D6-9A9B-F1FDB3BAE74D}"
36. Again In the right panel, locate and delete the entry:
    FilterData = "{random values}"
37. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{17413BA0-0160-4C1F-BA66-679436BCA89B}>InprocServer32
38. In the right panel, locate and delete the entry:
    ThreadingModel = "Both"
39. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{083863F1-70DE-11d0-BD40-00A0C911CE86}>Instance>{17413BA0-0160-4C1F-BA66-679436BCA89B}
40. In the right panel, locate and delete the entry:
    FriendlyName = "UUSEE Source"
41. Again In the right panel, locate and delete the entry:
    CLSID = "{17413BA0-0160-4C1F-BA66-679436BCA89B}"
42. Again In the right panel, locate and delete the entry:
    FilterData = "{random values}"
43. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{91AD598F-876B-4790-8857-ABFE5ED6159F}>InprocServer32
44. In the right panel, locate and delete the entry:
    ThreadingModel = "Both"
45. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{E7F18B7F-9F1F-4AE6-9866-AB7E1A81ECCA}>InprocServer32
46. In the right panel, locate and delete the entry:
    ThreadingModel = "Both"
47. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{A2113517-E452-43A3-977D-28BA30D5E389}>InprocServer32
48. In the right panel, locate and delete the entry:
    ThreadingModel = "Both"
49. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{0583926D-C114-4605-8DF3-770402F50E61}>InprocServer32
50. In the right panel, locate and delete the entry:
    ThreadingModel = "Both"
51. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{083863F1-70DE-11d0-BD40-00A0C911CE86}>Instance>{91AD598F-876B-4790-8857-ABFE5ED6159F}
52. In the right panel, locate and delete the entry:
    FriendlyName = "RealMedia Splitter"
53. Again In the right panel, locate and delete the entry:
    CLSID = "{91AD598F-876B-4790-8857-ABFE5ED6159F}"
54. Again In the right panel, locate and delete the entry:
    FilterData = "{random values}"
55. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{083863F1-70DE-11d0-BD40-00A0C911CE86}>Instance>{E7F18B7F-9F1F-4AE6-9866-AB7E1A81ECCA}
56. In the right panel, locate and delete the entry:
    FriendlyName = "RealMedia Source"
57. Again In the right panel, locate and delete the entry:
    CLSID = "{E7F18B7F-9F1F-4AE6-9866-AB7E1A81ECCA}"
58. Again In the right panel, locate and delete the entry:
    FilterData = "{random values}"
59. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{083863F1-70DE-11d0-BD40-00A0C911CE86}>Instance>{A2113517-E452-43A3-977D-28BA30D5E389}
60. In the right panel, locate and delete the entry:
    FriendlyName = "RealVideo Decoder"
61. Again In the right panel, locate and delete the entry:
    CLSID = "{A2113517-E452-43A3-977D-28BA30D5E389}"
62. Again In the right panel, locate and delete the entry:
    FilterData = "{random values}"
63. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{083863F1-70DE-11d0-BD40-00A0C911CE86}>Instance>{0583926D-C114-4605-8DF3-770402F50E61}
64. In the right panel, locate and delete the entry:
    FriendlyName = "RealAudio Decoder"
65. Again In the right panel, locate and delete the entry:
    CLSID = "{0583926D-C114-4605-8DF3-770402F50E61}"
66. Again In the right panel, locate and delete the entry:
    FilterData = "{random values}"
67. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{770B88B4-DCD8-4857-8E82-62C650F58545}>TypeLib
68. In the right panel, locate and delete the entry:
    Version = "1.0"
69. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BE61BB61-0E51-4080-8B6D-8F1FE00ABE38}>TypeLib
70. In the right panel, locate and delete the entry:
    Version = "1.0"
71. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{945E37E3-156F-4757-AA1F-CBA338DDFBE9}
72. In the right panel, locate and delete the entry:
    InprocServer32 = "%Program Files%\COMMON~1\uusee\SEEPLA~1.OCX"
73. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>CoreCodec>CoreAVC Pro 2.x
74. In the right panel, locate and delete the entry:
    User = "ryomikai33@gundam.eu"
75. Again In the right panel, locate and delete the entry:
    Serial = "3TDVPV-XCNFDT-VAZVCD-17JVPC-16DCLL"
76. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>CoreCodec>CoreAVC Pro
77. In the right panel, locate and delete the entry:
    User = "Registered User"
78. Again In the right panel, locate and delete the entry:
    Serial = "IQIKB-6F7KD-CORE-IXRJW-IGUHC"
79. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>UPLAYER.UPlayerCtrl.1
80. In the right panel, locate and delete the entry:
    CLSID = "{EAB7A1CC-C77B-45E5-9AC2-AD037D047BCC}"
81. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{EAB7A1CC-C77B-45E5-9AC2-AD037D047BCC}
82. In the right panel, locate and delete the entry:
    ProgID = "UPLAYER.UPlayerCtrl.1"
83. Again In the right panel, locate and delete the entry:
    InprocServer32 = "%Program Files%\COMMON~1\uusee\SEEPLA~1.OCX"
84. Again In the right panel, locate and delete the entry:
    ToolboxBitmap32 = "%Program Files%\COMMON~1\uusee\SEEPLA~1.OCX, 1"
85. Again In the right panel, locate and delete the entry:
    MiscStatus = "0"
86. Again In the right panel, locate and delete the entry:
    MiscStatus\1 = "131473"
87. Again In the right panel, locate and delete the entry:
    TypeLib = "{754EFA30-C752-4F45-8890-6250A53FD512}"
88. Again In the right panel, locate and delete the entry:
    Version = "1.0"
89. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{EAB7A1CC-C77B-45E5-9AC2-AD037D047BCC}>InprocServer32
90. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
91. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B9587E96-9349-4F58-A7D5-77E53811BDFD}>TypeLib
92. In the right panel, locate and delete the entry:
    Version = "1.0"
93. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{E9475D64-4461-4A22-BD58-132AF1D7D565}>TypeLib
94. In the right panel, locate and delete the entry:
    Version = "1.0"
95. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{28966B43-B5D0-4694-9E79-F5B4099F02D4}
96. In the right panel, locate and delete the entry:
    InprocServer32 = "%Program Files%\COMMON~1\uusee\UUPlayer.ocx"
97. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %User Profile%\setup\app1.tmp
   • %User Profile%\setup\app2.tmp
   • %User Temp%\nsq2.tmp\System.dll
   • %User Temp%\nsq2.tmp\FindProcDLL.dll
   • %User Temp%\upercent.gif
   • %User Temp%\nsq2.tmp\AnimGif.dll
   • %System%\nsis_loader.dll
   • %Program Files%\Common Files\uusee\UUWebPlayer.ocx
   • %Program Files%\Common Files\uusee\kumidesktop.ico
   • %Program Files%\Common Files\uusee\mp4demux.ax
   • %Program Files%\Common Files\uusee\UFDeMux.ax
   • %Program Files%\Common Files\uusee\UFSource.ax
   • %Program Files%\Common Files\uusee\rmsp011.ax
   • %Program Files%\Common Files\uusee\UUPlayer.ocx
   • %Program Files%\Common Files\uusee\check_cmd.exe
   • %Program Files%\Common Files\uusee\UUPlayer.exe
   • %Program Files%\Common Files\uusee\download.dll
   • %Program Files%\Common Files\uusee\videoAccDll.dll
   • %Program Files%\Common Files\uusee\ENet.dll
   • %Program Files%\Common Files\uusee\UUNet.dll
   • %Program Files%\Common Files\uusee\updll.dll
   • %Program Files%\Common Files\uusee\EnetDep.dll
   • %Program Files%\Common Files\uusee\EnetDepNee.dll
   • %Program Files%\Common Files\uusee\Microsoft.VC90.CRT.manifest
   • %Program Files%\Common Files\uusee\msvcp90.dll
   • %Program Files%\Common Files\uusee\msvcr90.dll
   • %Program Files%\Common Files\uusee\CoCode.dll
   • %Program Files%\Common Files\uusee\in_net.dll
   • %Program Files%\Common Files\uusee\out_mmshttp.dll
   • %Program Files%\Common Files\uusee\UUUpgrade.exe
   • %Program Files%\Common Files\uusee\UUUpgrade.ocx
   • %Program Files%\Common Files\uusee\UUUpgrade.dll
   • %Program Files%\Common Files\uusee\Localserver.dll
   • %Program Files%\Common Files\uusee\recommend.dll
   • %Program Files%\Common Files\uusee\b_taobao.ico
   • %Program Files%\Common Files\uusee\seeplayer.ocx
   • %Program Files%\Common Files\uusee\trafficlight.dll
   • %Program Files%\Common Files\uusee\UUSeeMediaCenter.exe
   • %Program Files%\Common Files\uusee\npuuseep.dll
   • %Program Files%\Common Files\uusee\MediaCenter.ini
   • %Program Files%\Common Files\uusee\UUUpgrade.ini
   • %Program Files%\Common Files\uusee\review\bf_bg.gif
   • %Program Files%\Common Files\uusee\review\local.htm
   • %Program Files%\Common Files\uusee\review\skin1_bufferbar.gif
   • %Program Files%\Common Files\uusee\review\skin1_bufferbg0.gif
   • %Program Files%\Common Files\uusee\review\skin1_bufferbg1.gif
   • %Program Files%\Common Files\uusee\review\skin_fullscreen.gif
   • %Program Files%\Common Files\uusee\review\skin_mute.gif
   • %Program Files%\Common Files\uusee\review\skin_pause.gif
   • %Program Files%\Common Files\uusee\review\skin_play.gif
   • %Program Files%\Common Files\uusee\review\skin_qback.gif
   • %Program Files%\Common Files\uusee\review\skin_qnext.gif
   • %Program Files%\Common Files\uusee\review\skin_share.gif
   • %Program Files%\Common Files\uusee\review\skin_stop.gif
   • %Program Files%\Common Files\uusee\review\skin_volume.gif
   • %Program Files%\Common Files\uusee\review\skin_volumebar.gif
   • %Program Files%\Common Files\uusee\review\skin_volumebarbg.gif
   • %Program Files%\Common Files\uusee\review\skin_volumebarbg2.gif
   • %Program Files%\Common Files\uusee\uninst.exe
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %User Profile%\setup\app1.tmp
   • %User Profile%\setup\app2.tmp
   • %User Temp%\nsq2.tmp\System.dll
   • %User Temp%\nsq2.tmp\FindProcDLL.dll
   • %User Temp%\upercent.gif
   • %User Temp%\nsq2.tmp\AnimGif.dll
   • %System%\nsis_loader.dll
   • %Program Files%\Common Files\uusee\UUWebPlayer.ocx
   • %Program Files%\Common Files\uusee\kumidesktop.ico
   • %Program Files%\Common Files\uusee\mp4demux.ax
   • %Program Files%\Common Files\uusee\UFDeMux.ax
   • %Program Files%\Common Files\uusee\UFSource.ax
   • %Program Files%\Common Files\uusee\rmsp011.ax
   • %Program Files%\Common Files\uusee\UUPlayer.ocx
   • %Program Files%\Common Files\uusee\check_cmd.exe
   • %Program Files%\Common Files\uusee\UUPlayer.exe
   • %Program Files%\Common Files\uusee\download.dll
   • %Program Files%\Common Files\uusee\videoAccDll.dll
   • %Program Files%\Common Files\uusee\ENet.dll
   • %Program Files%\Common Files\uusee\UUNet.dll
   • %Program Files%\Common Files\uusee\updll.dll
   • %Program Files%\Common Files\uusee\EnetDep.dll
   • %Program Files%\Common Files\uusee\EnetDepNee.dll
   • %Program Files%\Common Files\uusee\Microsoft.VC90.CRT.manifest
   • %Program Files%\Common Files\uusee\msvcp90.dll
   • %Program Files%\Common Files\uusee\msvcr90.dll
   • %Program Files%\Common Files\uusee\CoCode.dll
   • %Program Files%\Common Files\uusee\in_net.dll
   • %Program Files%\Common Files\uusee\out_mmshttp.dll
   • %Program Files%\Common Files\uusee\UUUpgrade.exe
   • %Program Files%\Common Files\uusee\UUUpgrade.ocx
   • %Program Files%\Common Files\uusee\UUUpgrade.dll
   • %Program Files%\Common Files\uusee\Localserver.dll
   • %Program Files%\Common Files\uusee\recommend.dll
   • %Program Files%\Common Files\uusee\b_taobao.ico
   • %Program Files%\Common Files\uusee\seeplayer.ocx
   • %Program Files%\Common Files\uusee\trafficlight.dll
   • %Program Files%\Common Files\uusee\UUSeeMediaCenter.exe
   • %Program Files%\Common Files\uusee\npuuseep.dll
   • %Program Files%\Common Files\uusee\MediaCenter.ini
   • %Program Files%\Common Files\uusee\UUUpgrade.ini
   • %Program Files%\Common Files\uusee\review\bf_bg.gif
   • %Program Files%\Common Files\uusee\review\local.htm
   • %Program Files%\Common Files\uusee\review\skin1_bufferbar.gif
   • %Program Files%\Common Files\uusee\review\skin1_bufferbg0.gif
   • %Program Files%\Common Files\uusee\review\skin1_bufferbg1.gif
   • %Program Files%\Common Files\uusee\review\skin_fullscreen.gif
   • %Program Files%\Common Files\uusee\review\skin_mute.gif
   • %Program Files%\Common Files\uusee\review\skin_pause.gif
   • %Program Files%\Common Files\uusee\review\skin_play.gif
   • %Program Files%\Common Files\uusee\review\skin_qback.gif
   • %Program Files%\Common Files\uusee\review\skin_qnext.gif
   • %Program Files%\Common Files\uusee\review\skin_share.gif
   • %Program Files%\Common Files\uusee\review\skin_stop.gif
   • %Program Files%\Common Files\uusee\review\skin_volume.gif
   • %Program Files%\Common Files\uusee\review\skin_volumebar.gif
   • %Program Files%\Common Files\uusee\review\skin_volumebarbg.gif
   • %Program Files%\Common Files\uusee\review\skin_volumebarbg2.gif
   • %Program Files%\Common Files\uusee\uninst.exe
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\ADMINI~1
   • %User Profile%\LOCALS~1
   • %User Temp%\nsq2.tmp
   • %Program Files%\uusee
   • %Program Files%\Common Files\uusee
   • %Program Files%\Common Files\uusee\review
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\ADMINI~1
   • %User Profile%\LOCALS~1
   • %User Temp%\nsq2.tmp
   • %Program Files%\uusee
   • %Program Files%\Common Files\uusee
   • %Program Files%\Common Files\uusee\review