TROJ_SPNV.03AR14

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Google>Chrome>Extensions
3. Still in the left panel, locate and delete the key:
   gjajpkikblccgefaibcafkfbanllpefi
4. In the left panel, double-click the following:
   HKEY_CURRENT_USER>SOFTWARE>Mozilla>Firefox
5. Still in the left panel, locate and delete the key:
   Extensions
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Mozilla>Firefox
7. Still in the left panel, locate and delete the key:
   Extensions
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Uninstall
9. Still in the left panel, locate and delete the key:
   7go
10. Again Still in the left panel, locate and delete the key:
    7Go Games
11. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer
12. Still in the left panel, locate and delete the key:
    MINIE
13. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software
14. Still in the left panel, locate and delete the key:
    7Go Games
15. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID
16. Still in the left panel, locate and delete the key:
    {A493779E-8D06-460A-9AB3-59EA2ED5396F}
17. Again Still in the left panel, locate and delete the key:
    ScriptHost.DLL
18. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT
19. Still in the left panel, locate and delete the key:
    7Go Games.ScriptHostObject.1
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>7Go Games.ScriptHostObject.1
21. Still in the left panel, locate and delete the key:
    CLSID
22. Again Still in the left panel, locate and delete the key:
    7Go Games.ScriptHostObject
23. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>7Go Games.ScriptHostObject
24. Still in the left panel, locate and delete the key:
    CLSID
25. Again Still in the left panel, locate and delete the key:
    CurVer
26. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
27. Still in the left panel, locate and delete the key:
    {FF103732-4528-4322-AA8B-F7849AB7776B}
28. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{FF103732-4528-4322-AA8B-F7849AB7776B}
29. Still in the left panel, locate and delete the key:
    ProgID
30. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
31. Again Still in the left panel, locate and delete the key:
    Programmable
32. Again Still in the left panel, locate and delete the key:
    InprocServer32
33. Again Still in the left panel, locate and delete the key:
    TypeLib
34. Again Still in the left panel, locate and delete the key:
    7Go Games.Tool.1
35. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>7Go Games.Tool.1
36. Still in the left panel, locate and delete the key:
    CLSID
37. Again Still in the left panel, locate and delete the key:
    7Go Games.Tool
38. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>7Go Games.Tool
39. Still in the left panel, locate and delete the key:
    CLSID
40. Again Still in the left panel, locate and delete the key:
    CurVer
41. Again Still in the left panel, locate and delete the key:
    {A3632F95-2BB4-4DC6-95E0-16FCF5C4EB4C}
42. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{A3632F95-2BB4-4DC6-95E0-16FCF5C4EB4C}
43. Still in the left panel, locate and delete the key:
    ProgID
44. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
45. Again Still in the left panel, locate and delete the key:
    Programmable
46. Again Still in the left panel, locate and delete the key:
    InprocServer32
47. Again Still in the left panel, locate and delete the key:
    TypeLib
48. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
49. Still in the left panel, locate and delete the key:
    {B6C39D5B-210D-416C-8487-A30A477AC424}
50. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{B6C39D5B-210D-416C-8487-A30A477AC424}
51. Still in the left panel, locate and delete the key:
    1.0
52. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{B6C39D5B-210D-416C-8487-A30A477AC424}>1.0
53. Still in the left panel, locate and delete the key:
    FLAGS
54. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{B6C39D5B-210D-416C-8487-A30A477AC424}>1.0>0
55. Still in the left panel, locate and delete the key:
    win32
56. Again Still in the left panel, locate and delete the key:
    HELPDIR
57. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
58. Still in the left panel, locate and delete the key:
    {458BD324-E5D0-412C-954D-EDFD69A59ED9}
59. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{458BD324-E5D0-412C-954D-EDFD69A59ED9}
60. Still in the left panel, locate and delete the key:
    ProxyStubClsid
61. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
62. Again Still in the left panel, locate and delete the key:
    TypeLib
63. Again Still in the left panel, locate and delete the key:
    7Go Games.Navbar.1
64. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>7Go Games.Navbar.1
65. Still in the left panel, locate and delete the key:
    CLSID
66. Again Still in the left panel, locate and delete the key:
    7Go Games.Navbar
67. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>7Go Games.Navbar
68. Still in the left panel, locate and delete the key:
    CLSID
69. Again Still in the left panel, locate and delete the key:
    CurVer
70. Again Still in the left panel, locate and delete the key:
    {6F876588-5EFF-4194-AC5D-548630BB3BA2}
71. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{6F876588-5EFF-4194-AC5D-548630BB3BA2}
72. Still in the left panel, locate and delete the key:
    ProgID
73. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
74. Again Still in the left panel, locate and delete the key:
    Programmable
75. Again Still in the left panel, locate and delete the key:
    InprocServer32
76. Again Still in the left panel, locate and delete the key:
    TypeLib
77. Again Still in the left panel, locate and delete the key:
    ButtonSite.DLL
78. Again Still in the left panel, locate and delete the key:
    {0069D032-00A9-4EEB-AD62-342FB59185A4}
79. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{0069D032-00A9-4EEB-AD62-342FB59185A4}
80. Still in the left panel, locate and delete the key:
    1.0
81. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{0069D032-00A9-4EEB-AD62-342FB59185A4}>1.0
82. Still in the left panel, locate and delete the key:
    FLAGS
83. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{0069D032-00A9-4EEB-AD62-342FB59185A4}>1.0>0
84. Still in the left panel, locate and delete the key:
    win32
85. Again Still in the left panel, locate and delete the key:
    HELPDIR
86. Again Still in the left panel, locate and delete the key:
    {EDC8EEB4-F3CF-46BD-A5F8-49A8314F549A}
87. Again Still in the left panel, locate and delete the key:
    AddonsFramework.DLL
88. Again Still in the left panel, locate and delete the key:
    {F6C6A088-BA3F-46AB-8B0A-15459A96BC43}
89. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{F6C6A088-BA3F-46AB-8B0A-15459A96BC43}
90. Still in the left panel, locate and delete the key:
    1.0
91. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{F6C6A088-BA3F-46AB-8B0A-15459A96BC43}>1.0
92. Still in the left panel, locate and delete the key:
    FLAGS
93. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{F6C6A088-BA3F-46AB-8B0A-15459A96BC43}>1.0>0
94. Still in the left panel, locate and delete the key:
    win32
95. Again Still in the left panel, locate and delete the key:
    HELPDIR
96. Again Still in the left panel, locate and delete the key:
    {B5445928-B77D-474B-84F6-6F1323CA5701}
97. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B5445928-B77D-474B-84F6-6F1323CA5701}
98. Still in the left panel, locate and delete the key:
    ProxyStubClsid
99. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
100. Again Still in the left panel, locate and delete the key:
     TypeLib
101. Again Still in the left panel, locate and delete the key:
     {F4F96034-2761-4BAF-B906-E4B59E5D50EA}
102. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{F4F96034-2761-4BAF-B906-E4B59E5D50EA}
103. Still in the left panel, locate and delete the key:
     ProxyStubClsid
104. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
105. Again Still in the left panel, locate and delete the key:
     TypeLib
106. Again Still in the left panel, locate and delete the key:
     {BE6C7021-0352-4A7E-8A5B-46126353049E}
107. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BE6C7021-0352-4A7E-8A5B-46126353049E}
108. Still in the left panel, locate and delete the key:
     ProxyStubClsid
109. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
110. Again Still in the left panel, locate and delete the key:
     TypeLib
111. Again Still in the left panel, locate and delete the key:
     {FE42F7F2-D931-40CD-ACE7-7B47383ACE25}
112. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{FE42F7F2-D931-40CD-ACE7-7B47383ACE25}
113. Still in the left panel, locate and delete the key:
     ProxyStubClsid
114. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
115. Again Still in the left panel, locate and delete the key:
     TypeLib
116. Again Still in the left panel, locate and delete the key:
     {D2AA22AE-2103-4D78-9C0D-46DE64EE0ED7}
117. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{D2AA22AE-2103-4D78-9C0D-46DE64EE0ED7}
118. Still in the left panel, locate and delete the key:
     ProxyStubClsid
119. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
120. Again Still in the left panel, locate and delete the key:
     TypeLib
121. Again Still in the left panel, locate and delete the key:
     {2D017725-74A0-4513-913D-2939ADF6D0F3}
122. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{2D017725-74A0-4513-913D-2939ADF6D0F3}
123. Still in the left panel, locate and delete the key:
     ProxyStubClsid
124. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
125. Again Still in the left panel, locate and delete the key:
     TypeLib
126. Again Still in the left panel, locate and delete the key:
     {D94BA844-0355-4F02-97F2-6856CD94FE66}
127. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{D94BA844-0355-4F02-97F2-6856CD94FE66}
128. Still in the left panel, locate and delete the key:
     ProxyStubClsid
129. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
130. Again Still in the left panel, locate and delete the key:
     TypeLib
131. Again Still in the left panel, locate and delete the key:
     {DFBED68E-BBF6-454A-940F-C84C7E7B4CE6}
132. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{DFBED68E-BBF6-454A-940F-C84C7E7B4CE6}
133. Still in the left panel, locate and delete the key:
     ProxyStubClsid
134. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
135. Again Still in the left panel, locate and delete the key:
     TypeLib
136. Again Still in the left panel, locate and delete the key:
     {A70CA55D-8EE5-4997-8BC3-B341E36ACBBA}
137. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A70CA55D-8EE5-4997-8BC3-B341E36ACBBA}
138. Still in the left panel, locate and delete the key:
     ProxyStubClsid
139. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
140. Again Still in the left panel, locate and delete the key:
     TypeLib
141. Again Still in the left panel, locate and delete the key:
     {9275FE6D-8F84-4CA5-97E7-DD3AFD5E4BDE}
142. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{9275FE6D-8F84-4CA5-97E7-DD3AFD5E4BDE}
143. Still in the left panel, locate and delete the key:
     ProxyStubClsid
144. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
145. Again Still in the left panel, locate and delete the key:
     TypeLib
146. Again Still in the left panel, locate and delete the key:
     {806ED5AF-3ED0-454C-BE4E-6644DD7BEDD1}
147. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{806ED5AF-3ED0-454C-BE4E-6644DD7BEDD1}
148. Still in the left panel, locate and delete the key:
     ProxyStubClsid
149. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
150. Again Still in the left panel, locate and delete the key:
     TypeLib
151. Again Still in the left panel, locate and delete the key:
     {9ADA5C62-B227-45A9-9D77-E5609A43E943}
152. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{9ADA5C62-B227-45A9-9D77-E5609A43E943}
153. Still in the left panel, locate and delete the key:
     ProxyStubClsid
154. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
155. Again Still in the left panel, locate and delete the key:
     TypeLib
156. Again Still in the left panel, locate and delete the key:
     {A37DD83A-DABA-4EF0-98AA-CDDA88839172}
157. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A37DD83A-DABA-4EF0-98AA-CDDA88839172}
158. Still in the left panel, locate and delete the key:
     ProxyStubClsid
159. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
160. Again Still in the left panel, locate and delete the key:
     TypeLib
161. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Ext>Settings
162. Still in the left panel, locate and delete the key:
     {FF103732-4528-4322-AA8B-F7849AB7776B}
163. Again Still in the left panel, locate and delete the key:
     Approved Extensions
164. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Internet Settings
3. In the right panel, locate and delete the entry:
   CertificateRevocation = "0"
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Google>Chrome>Extensions>gjajpkikblccgefaibcafkfbanllpefi
5. In the right panel, locate and delete the entry:
   path = "%User Profile%\7go\7go.crx"
6. Again In the right panel, locate and delete the entry:
   version = "1.0.0.2"
7. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Mozilla>Firefox>Extensions
8. In the right panel, locate and delete the entry:
   7go@7go.com = "%User Profile%\Extensions\7go@7go.com"
9. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Mozilla>Firefox>Extensions
10. In the right panel, locate and delete the entry:
    7go@7go.com = "%User Profile%\Extensions\7go@7go.com"
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>7go
12. In the right panel, locate and delete the entry:
    UninstallString = "%Program Files%\7go\uninst.exe"
13. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>7Go Games
14. In the right panel, locate and delete the entry:
    DisplayName = "7Go Games"
15. Again In the right panel, locate and delete the entry:
    UninstallString = "%Program Files%\7Go Games\uninstall.exe"
16. Again In the right panel, locate and delete the entry:
    DisplayVersion = "1.0.0.0"
17. Again In the right panel, locate and delete the entry:
    Publisher = "7go.com"
18. Again In the right panel, locate and delete the entry:
    URLInfoAbout = "http://www.{BLOCKED}o.com"
19. Again In the right panel, locate and delete the entry:
    DisplayIcon = "%Program Files%\7Go Games\uninstall.exe"
20. Again In the right panel, locate and delete the entry:
    InstDir = "%Program Files%\7Go Games"
21. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>MINIE
22. In the right panel, locate and delete the entry:
    CommandBarEnabled = "1"
23. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>7Go Games
24. In the right panel, locate and delete the entry:
    installId = "5B20C292-17B9-4597-9629-B7C88AE556F0"
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>ScriptHost.DLL
26. In the right panel, locate and delete the entry:
    AppID = "{A493779E-8D06-460A-9AB3-59EA2ED5396F}"
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Browser Helper Objects>{FF103732-4528-4322-AA8B-F7849AB7776B}
28. In the right panel, locate and delete the entry:
    NoExplorer = "1"
29. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{FF103732-4528-4322-AA8B-F7849AB7776B}>InprocServer32
30. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{A3632F95-2BB4-4DC6-95E0-16FCF5C4EB4C}>InprocServer32
32. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
33. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{458BD324-E5D0-412C-954D-EDFD69A59ED9}>TypeLib
34. In the right panel, locate and delete the entry:
    Version = "1.0"
35. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{6F876588-5EFF-4194-AC5D-548630BB3BA2}>InprocServer32
36. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
37. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>ButtonSite.DLL
38. In the right panel, locate and delete the entry:
    AppID = "{A493779E-8D06-460A-9AB3-59EA2ED5396F}"
39. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>AddonsFramework.DLL
40. In the right panel, locate and delete the entry:
    AppID = "{EDC8EEB4-F3CF-46BD-A5F8-49A8314F549A}"
41. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B5445928-B77D-474B-84F6-6F1323CA5701}>TypeLib
42. In the right panel, locate and delete the entry:
    Version = "1.0"
43. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{F4F96034-2761-4BAF-B906-E4B59E5D50EA}>TypeLib
44. In the right panel, locate and delete the entry:
    Version = "1.0"
45. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BE6C7021-0352-4A7E-8A5B-46126353049E}>TypeLib
46. In the right panel, locate and delete the entry:
    Version = "1.0"
47. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{FE42F7F2-D931-40CD-ACE7-7B47383ACE25}>TypeLib
48. In the right panel, locate and delete the entry:
    Version = "1.0"
49. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{D2AA22AE-2103-4D78-9C0D-46DE64EE0ED7}>TypeLib
50. In the right panel, locate and delete the entry:
    Version = "1.0"
51. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{2D017725-74A0-4513-913D-2939ADF6D0F3}>TypeLib
52. In the right panel, locate and delete the entry:
    Version = "1.0"
53. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{D94BA844-0355-4F02-97F2-6856CD94FE66}>TypeLib
54. In the right panel, locate and delete the entry:
    Version = "1.0"
55. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{DFBED68E-BBF6-454A-940F-C84C7E7B4CE6}>TypeLib
56. In the right panel, locate and delete the entry:
    Version = "1.0"
57. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A70CA55D-8EE5-4997-8BC3-B341E36ACBBA}>TypeLib
58. In the right panel, locate and delete the entry:
    Version = "1.0"
59. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{9275FE6D-8F84-4CA5-97E7-DD3AFD5E4BDE}>TypeLib
60. In the right panel, locate and delete the entry:
    Version = "1.0"
61. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{806ED5AF-3ED0-454C-BE4E-6644DD7BEDD1}>TypeLib
62. In the right panel, locate and delete the entry:
    Version = "1.0"
63. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{9ADA5C62-B227-45A9-9D77-E5609A43E943}>TypeLib
64. In the right panel, locate and delete the entry:
    Version = "1.0"
65. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A37DD83A-DABA-4EF0-98AA-CDDA88839172}>TypeLib
66. In the right panel, locate and delete the entry:
    Version = "1.0"
67. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Ext>Settings>{FF103732-4528-4322-AA8B-F7849AB7776B}
68. In the right panel, locate and delete the entry:
    Flags = "0"
69. Again In the right panel, locate and delete the entry:
    Version = "*"
70. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Approved Extensions
71. In the right panel, locate and delete the entry:
    {FF103732-4528-4322-AA8B-F7849AB7776B} = "{random values}"
72. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %User Temp%\icon.ico
   • %Desktop%\7go.lnk
   • %User Temp%\7go.exe
   • %User Temp%\install_helper.exe
   • %User Profile%\7go\7go.crx
   • %User Profile%\7go\chrome_install.exe
   • %User Temp%\7go.xpi
   • %User Temp%\nsk40.tmp\nsisunz.dll
   • %User Profile%\content\background.html
   • %User Profile%\content\bg.js
   • %User Profile%\content\button.xml
   • %User Profile%\content\config.js
   • %User Profile%\content\content.js
   • %User Profile%\content\framework.js
   • %User Profile%\content\framework.png
   • %User Profile%\content\framework.xul
   • %User Profile%\content\icon128.ico
   • %User Profile%\content\icon128.png
   • %User Profile%\content\icon16.ico
   • %User Profile%\content\icon16.png
   • %User Profile%\content\icon18.ico
   • %User Profile%\content\icon18.png
   • %User Profile%\content\icon24.ico
   • %User Profile%\content\icon24.png
   • %User Profile%\content\icon32.ico
   • %User Profile%\content\icon32.png
   • %User Profile%\content\icon48.ico
   • %User Profile%\content\icon48.png
   • %User Profile%\content\icon64.ico
   • %User Profile%\content\icon64.png
   • %User Profile%\content\jquery-1.9.1.min.js
   • %User Profile%\mz\background.js
   • %User Profile%\mz\content.js
   • %User Profile%\content\options.xul
   • %User Profile%\content\settings.json
   • %User Profile%\skin\framework.css
   • %User Profile%\7go@7go.com\chrome.manifest
   • %User Profile%\7go@7go.com\install.rdf
   • %Program Files%\7go\uninst.exe
   • %User Temp%\nsiA.tmp\help_page.ini
   • %User Temp%\nsiA.tmp\ie9install.bmp
   • %User Temp%\nsiA.tmp\UAC.dll
   • %Program Files%\7Go Games\AddonsFramework.Typelib.dll
   • %Program Files%\7Go Games\AddonsFramework.Typelib64.dll
   • %Program Files%\7Go Games\BackgroundHost.exe
   • %Program Files%\7Go Games\BackgroundHost64.exe
   • %Program Files%\7Go Games\ButtonSite.dll
   • %Program Files%\7Go Games\ButtonSite64.dll
   • %Program Files%\7Go Games\ScriptHost.dll
   • %Program Files%\7Go Games\ScriptHost64.dll
   • %Program Files%\7Go Games\background.html
   • %Program Files%\7Go Games\bg.js
   • %Program Files%\7Go Games\config.xml
   • %Program Files%\7Go Games\content.js
   • %Program Files%\7Go Games\icon128.ico
   • %Program Files%\7Go Games\icon128.png
   • %Program Files%\7Go Games\icon16.ico
   • %Program Files%\7Go Games\icon16.png
   • %Program Files%\7Go Games\icon18.ico
   • %Program Files%\7Go Games\icon18.png
   • %Program Files%\7Go Games\icon24.ico
   • %Program Files%\7Go Games\icon24.png
   • %Program Files%\7Go Games\icon32.ico
   • %Program Files%\7Go Games\icon32.png
   • %Program Files%\7Go Games\icon48.ico
   • %Program Files%\7Go Games\icon48.png
   • %Program Files%\7Go Games\icon64.ico
   • %Program Files%\7Go Games\icon64.png
   • %Program Files%\7Go Games\jquery-1.9.1.min.js
   • %Program Files%\7Go Games\json2.min.js
   • %Program Files%\7Go Games\options.htm
   • %Program Files%\7Go Games\updater.js
   • %Program Files%\7Go Games\updaterWrapper.js
   • %Program Files%\7Go Games\mz\background.js
   • %Program Files%\7Go Games\mz\content.js
   • %Program Files%\7Go Games\uninstall.exe
   • %User Temp%\nsiA.tmp\System.dll
   • %User Temp%\che38.tmp
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %User Temp%\icon.ico
   • %Desktop%\7go.lnk
   • %User Temp%\7go.exe
   • %User Temp%\install_helper.exe
   • %User Profile%\7go\7go.crx
   • %User Profile%\7go\chrome_install.exe
   • %User Temp%\7go.xpi
   • %User Temp%\nsk40.tmp\nsisunz.dll
   • %User Profile%\content\background.html
   • %User Profile%\content\bg.js
   • %User Profile%\content\button.xml
   • %User Profile%\content\config.js
   • %User Profile%\content\content.js
   • %User Profile%\content\framework.js
   • %User Profile%\content\framework.png
   • %User Profile%\content\framework.xul
   • %User Profile%\content\icon128.ico
   • %User Profile%\content\icon128.png
   • %User Profile%\content\icon16.ico
   • %User Profile%\content\icon16.png
   • %User Profile%\content\icon18.ico
   • %User Profile%\content\icon18.png
   • %User Profile%\content\icon24.ico
   • %User Profile%\content\icon24.png
   • %User Profile%\content\icon32.ico
   • %User Profile%\content\icon32.png
   • %User Profile%\content\icon48.ico
   • %User Profile%\content\icon48.png
   • %User Profile%\content\icon64.ico
   • %User Profile%\content\icon64.png
   • %User Profile%\content\jquery-1.9.1.min.js
   • %User Profile%\mz\background.js
   • %User Profile%\mz\content.js
   • %User Profile%\content\options.xul
   • %User Profile%\content\settings.json
   • %User Profile%\skin\framework.css
   • %User Profile%\7go@7go.com\chrome.manifest
   • %User Profile%\7go@7go.com\install.rdf
   • %Program Files%\7go\uninst.exe
   • %User Temp%\nsiA.tmp\help_page.ini
   • %User Temp%\nsiA.tmp\ie9install.bmp
   • %User Temp%\nsiA.tmp\UAC.dll
   • %Program Files%\7Go Games\AddonsFramework.Typelib.dll
   • %Program Files%\7Go Games\AddonsFramework.Typelib64.dll
   • %Program Files%\7Go Games\BackgroundHost.exe
   • %Program Files%\7Go Games\BackgroundHost64.exe
   • %Program Files%\7Go Games\ButtonSite.dll
   • %Program Files%\7Go Games\ButtonSite64.dll
   • %Program Files%\7Go Games\ScriptHost.dll
   • %Program Files%\7Go Games\ScriptHost64.dll
   • %Program Files%\7Go Games\background.html
   • %Program Files%\7Go Games\bg.js
   • %Program Files%\7Go Games\config.xml
   • %Program Files%\7Go Games\content.js
   • %Program Files%\7Go Games\icon128.ico
   • %Program Files%\7Go Games\icon128.png
   • %Program Files%\7Go Games\icon16.ico
   • %Program Files%\7Go Games\icon16.png
   • %Program Files%\7Go Games\icon18.ico
   • %Program Files%\7Go Games\icon18.png
   • %Program Files%\7Go Games\icon24.ico
   • %Program Files%\7Go Games\icon24.png
   • %Program Files%\7Go Games\icon32.ico
   • %Program Files%\7Go Games\icon32.png
   • %Program Files%\7Go Games\icon48.ico
   • %Program Files%\7Go Games\icon48.png
   • %Program Files%\7Go Games\icon64.ico
   • %Program Files%\7Go Games\icon64.png
   • %Program Files%\7Go Games\jquery-1.9.1.min.js
   • %Program Files%\7Go Games\json2.min.js
   • %Program Files%\7Go Games\options.htm
   • %Program Files%\7Go Games\updater.js
   • %Program Files%\7Go Games\updaterWrapper.js
   • %Program Files%\7Go Games\mz\background.js
   • %Program Files%\7Go Games\mz\content.js
   • %Program Files%\7Go Games\uninstall.exe
   • %User Temp%\nsiA.tmp\System.dll
   • %User Temp%\che38.tmp
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\Wilbert
   • %User Profile%\LOCALS~1
   • %System Root%\Documents and Settings\Wilbert
   • %User Profile%\Application Data\7go
   • %User Profile%\Application Data\Mozilla
   • %User Profile%\Mozilla\Extensions
   • %User Profile%\Extensions\7go@7go.com
   • %User Temp%\nsk40.tmp
   • %User Profile%\7go@7go.com\chrome
   • %User Profile%\chrome\content
   • %User Profile%\content\mz
   • %User Profile%\chrome\skin
   • %User Temp%\nsiA.tmp
   • %Program Files%\7Go Games
   • %Program Files%\7Go Games\mz
   • %Application Data%\Google\Chrome\User Data\Default\Extensions
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\gjajpkikblccgefaibcafkfbanllpefi
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\gjajpkikblccgefaibcafkfbanllpefi\1.0.0.2
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\Wilbert
   • %User Profile%\LOCALS~1
   • %System Root%\Documents and Settings\Wilbert
   • %User Profile%\Application Data\7go
   • %User Profile%\Application Data\Mozilla
   • %User Profile%\Mozilla\Extensions
   • %User Profile%\Extensions\7go@7go.com
   • %User Temp%\nsk40.tmp
   • %User Profile%\7go@7go.com\chrome
   • %User Profile%\chrome\content
   • %User Profile%\content\mz
   • %User Profile%\chrome\skin
   • %User Temp%\nsiA.tmp
   • %Program Files%\7Go Games
   • %Program Files%\7Go Games\mz
   • %Application Data%\Google\Chrome\User Data\Default\Extensions
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\gjajpkikblccgefaibcafkfbanllpefi
   • %Application Data%\Google\Chrome\User Data\Default\Extensions\gjajpkikblccgefaibcafkfbanllpefi\1.0.0.2