Worm.Win32.DOTEX.AD

To terminate the malware/grayware/spyware process:

1. Scan your computer with your Trend Micro product and take note of the name of the malware/grayware/spyware detected.
2. Open Windows Task Manager. To do this, press CTRL+SHIFT+ESC.
3. View the list of all running programs. To do this:
   • For Windows 2000, XP, Server 2003, Vista, 7 and Server 2008 users, click the Processes tab.
   • For Windows 8, 8.1 and Server 2012 users, click the Details tab.
4. In the list of running programs, locate a malware/grayware/spyware file detected earlier.
5. Select the detected files, then press either the End Task or the End Process button, depending on the version of Windows you are using.
6. Do the same for the remaining detected malware/grayware/spyware files in the list of running programs.
7. To check if the malware/grayware/spyware process has been terminated, close Task Manager, and then open it again.
8. Close Task Manager.

To delete the registry value this malware/grayware created:

1. Open Registry Editor.
   » For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run, type regedit in the text box provided, and then press Enter.
   » For Windows Vista, Windows 7, and Windows Server 2008 users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, and Windows Server 2012 users, right-click on the lower-left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>Ras.exe
3. In the right panel, locate and delete the entry:
   Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>avp.com
5. In the right panel, locate and delete the entry:
   Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>avp.exe
7. In the right panel, locate and delete the entry:
   Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>runiep.exe
9. In the right panel, locate and delete the entry:
   Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>PFW.exe
11. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>FYFireWall.exe
13. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>rfwmain.exe
15. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
16. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>rfwsrv.exe
17. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
18. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KAVPF.exe
19. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KPFW32.exe
21. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>nod32kui.exe
23. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
24. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>nod32.exe
25. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
26. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>Navapsvc.exe
27. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
28. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>Navapw32.exe
29. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
30. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>avconsol.exe
31. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>webscanx.exe
33. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
34. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>NPFMntor.exe
35. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
36. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>vsstat.exe
37. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
38. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KPfwSvc.exe
39. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
40. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>RavTask.exe
41. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
42. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>Rav.exe
43. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>RavMon.exe
45. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
46. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>mmsk.exe
47. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
48. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>WoptiClean.exe
49. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
50. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>QQKav.exe
51. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
52. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>QQDoctor.exe
53. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
54. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>EGHOST.exe
55. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
56. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>360Safe.exe
57. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
58. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>iparmo.exe
59. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
60. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>adam.exe
61. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
62. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>IceSword.exe
63. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
64. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>360rpt.exe
65. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
66. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>360tray.exe
67. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
68. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>AgentSvr.exe
69. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
70. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>AppSvc32.exe
71. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
72. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>autoruns.exe
73. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
74. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>avgrssvc.exe
75. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
76. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>AvMonitor.exe
77. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
78. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>CCenter.exe
79. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
80. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>ccSvcHst.exe
81. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
82. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>FileDsty.exe
83. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
84. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>FTCleanerShell.exe
85. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
86. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>HijackThis.exe
87. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
88. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>Iparmor.exe
89. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
90. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>isPwdSvc.exe
91. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
92. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>kabaload.exe
93. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
94. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KaScrScn.SCR
95. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
96. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KASMain.exe
97. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
98. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KASTask.exe
99. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
100. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KAV32.exe
101. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
102. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KAVDX.exe
103. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
104. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KAVPFW.exe
105. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
106. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KAVSetup.exe
107. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
108. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KAVStart.exe
109. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
110. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KISLnchr.exe
111. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
112. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KMailMon.exe
113. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
114. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KMFilter.exe
115. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
116. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KPFW32X.exe
117. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
118. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KRegEx.exe
119. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
120. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KRepair.com
121. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
122. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KsLoader.exe
123. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
124. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KVCenter.kxp
125. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
126. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KvDetect.exe
127. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
128. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KvfwMcl.exe
129. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
130. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KVMonXP.kxp
131. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
132. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KVMonXP_1.kxp
133. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
134. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>kvol.exe
135. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
136. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>kvolself.exe
137. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
138. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KvReport.kxp
139. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
140. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KVScan.kxp
141. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
142. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KVSrvXP.exe
143. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
144. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KVStub.kxp
145. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
146. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>kvupload.exe
147. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
148. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>kvwsc.exe
149. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
150. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KvXP.kxp
151. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
152. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KvXP_1.kxp
153. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
154. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KWatch.exe
155. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
156. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KWatch9x.exe
157. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
158. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KWatchX.exe
159. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
160. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>loaddll.exe
161. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
162. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>MagicSet.exe
163. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
164. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>mcconsol.exe
165. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
166. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>mmqczj.exe
167. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
168. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>nod32krn.exe
169. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
170. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>PFWLiveUpdate.exe
171. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
172. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>QHSET.exe
173. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
174. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>RavMonD.exe
175. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
176. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>RavStub.exe
177. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
178. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>RegClean.exe
179. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
180. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>rfwcfg.exe
181. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
182. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>RsAgent.exe
183. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
184. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>Rsaupd.exe
185. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
186. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>safelive.exe
187. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
188. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>scan32.exe
189. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
190. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>shcfg32.exe
191. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
192. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>SmartUp.exe
193. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
194. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>SREng.EXE
195. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
196. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>symlcsvc.exe
197. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
198. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>SysSafe.exe
199. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
200. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>TrojanDetector.exe
201. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
202. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>Trojanwall.exe
203. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
204. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>TrojDie.kxp
205. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
206. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>UIHost.exe
207. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
208. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>UmxAgent.exe
209. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
210. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>UmxAttachment.exe
211. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
212. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>UmxCfg.exe
213. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
214. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>UmxFwHlp.exe
215. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
216. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>UmxPol.exe
217. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
218. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>UpLive.exe
219. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
220. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>upiea.exe
221. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
222. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>AST.exe
223. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
224. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>ArSwp.exe
225. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
226. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>USBCleaner.exe
227. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
228. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>rstrui.exe
229. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
230. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>QQLiveUpdate.exe
231. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
232. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>QQUpdateCenter.exe
233. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
234. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>Timwp.exe
235. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
236. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>services>SharedAccess
237. In the right panel, locate and delete the entry:
     Start = 4
238. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Advanced>Folder>Hidden>SHOWALL
239. In the right panel, locate and delete the entry:
     CheckedValue = 0
240. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Policies>Explorer
241. In the right panel, locate and delete the entry:
     NoDriveTypeAutoRun = 145
242. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>services>wscsvc
243. In the right panel, locate and delete the entry:
     Start = 4
244. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>services>wuauserv
245. In the right panel, locate and delete the entry:
     Start = 4
246. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>nggaed
247. In the right panel, locate and delete the entry:
     fhhwrrc = %Program Files%\Common Files\System\katbwff.exe
248. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>evphnt
249. In the right panel, locate and delete the entry:
     tkqwijl = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
250. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>pmfwaq
251. In the right panel, locate and delete the entry:
     tkqwijl = %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
252. Close Registry Editor.

To delete malware/grayware files:

For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the File name* input box, type
   
   • %Program Files%\1.hiv
   • %Program Files%\2.hiv
   • %Program Files%\Common Files\System\fhhwrrc.inf
   • %Program Files%\3.hiv
   • %Program Files%\4.hiv
   • %Program Files%\Common Files\Microsoft Shared\fhhwrrc.inf
   • %Program Files%\Common Files\System\katbwff.exe
   • %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
   • %Program Files%\meex.exe
   • %System%\jqvetms
   • %System%\jqvetms.3
   • %System%\jqvetms.4
   • %System%\jqvetms.6
   • %System%\jqvetms.5
   • %System%\jqvetms.1
   • %System%\jqvetms.2
   • %System%\com\jqvetms
   • %System%\IME\jqvetms
   • %System%\com\jqvetms.1
   • %System%\bsmains.exe
   • %System%\sexit.dat
   • %System%\verclsids.exe
   • %Windows%\debug\jqvetms
   • %Windows%\tools\jqvetms
   • %Windows%\Web\jqvetms
   • %Program Files%\Common Files\jqvetms
   • %Program Files%\Common Files\jqvetms.1
   • %Program Files%\Internet Explorer\jqvetms
   • %Program Files%\Internet Explorer\PLUGINS\jqvetms
   • %Program Files%\Internet Explorer\PLUGINS\jqvetms.1
   • %Program Files%\Internet Explorer\PLUGINS\jqvetms.2
   • {Removable drives}\jqvetms
   • {Removable drives}\jqvetms.bak
   • {Removable drives}\tkqwijl.exe
   • {Removable drives}\mxunxou
   • {Removable drives}\mxunxou.bak
   • {Removable drives}\tkqwijl.exe
   • {Removable drives}\autorun.inf
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.
   *Note: The file name input box title varies depending on the Windows version (e.g. Search for files or folders named or All or part of the file name.).

For Windows Vista, Windows 7, Windows Server 2008, Windows 8, Windows 8.1, and Windows Server 2012:

1. Open a Windows Explorer window.
   • For Windows Vista, 7, and Server 2008 users, click Start>Computer.
   • For Windows 8, 8.1, and Server 2012 users, right-click on the lower left corner of the screen, then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %Program Files%\1.hiv
   • %Program Files%\2.hiv
   • %Program Files%\Common Files\System\fhhwrrc.inf
   • %Program Files%\3.hiv
   • %Program Files%\4.hiv
   • %Program Files%\Common Files\Microsoft Shared\fhhwrrc.inf
   • %Program Files%\Common Files\System\katbwff.exe
   • %Program Files%\Common Files\Microsoft Shared\oskgivw.exe
   • %Program Files%\meex.exe
   • %System%\jqvetms
   • %System%\jqvetms.3
   • %System%\jqvetms.4
   • %System%\jqvetms.6
   • %System%\jqvetms.5
   • %System%\jqvetms.1
   • %System%\jqvetms.2
   • %System%\com\jqvetms
   • %System%\IME\jqvetms
   • %System%\com\jqvetms.1
   • %System%\bsmains.exe
   • %System%\sexit.dat
   • %System%\verclsids.exe
   • %Windows%\debug\jqvetms
   • %Windows%\tools\jqvetms
   • %Windows%\Web\jqvetms
   • %Program Files%\Common Files\jqvetms
   • %Program Files%\Common Files\jqvetms.1
   • %Program Files%\Internet Explorer\jqvetms
   • %Program Files%\Internet Explorer\PLUGINS\jqvetms
   • %Program Files%\Internet Explorer\PLUGINS\jqvetms.1
   • %Program Files%\Internet Explorer\PLUGINS\jqvetms.2
   • {Removable drives}\jqvetms
   • {Removable drives}\jqvetms.bak
   • {Removable drives}\tkqwijl.exe
   • {Removable drives}\mxunxou
   • {Removable drives}\mxunxou.bak
   • {Removable drives}\tkqwijl.exe
   • {Removable drives}\autorun.inf
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.