BKDR_ZEGOST.ML

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CLASSES_ROOT
3. Still in the left panel, locate and delete the key:
   QMDispatch.QMFunction.1
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>QMDispatch.QMFunction.1
5. Still in the left panel, locate and delete the key:
   CLSID
6. Again Still in the left panel, locate and delete the key:
   QMDispatch.QMFunction
7. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>QMDispatch.QMFunction
8. Still in the left panel, locate and delete the key:
   CLSID
9. Again Still in the left panel, locate and delete the key:
   CurVer
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
11. Still in the left panel, locate and delete the key:
    {EF94624F-EAAE-47CA-BE5B-86FDBF0B2BBA}
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{EF94624F-EAAE-47CA-BE5B-86FDBF0B2BBA}
13. Still in the left panel, locate and delete the key:
    ProgID
14. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
15. Again Still in the left panel, locate and delete the key:
    Programmable
16. Again Still in the left panel, locate and delete the key:
    InprocServer32
17. Again Still in the left panel, locate and delete the key:
    TypeLib
18. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
19. Still in the left panel, locate and delete the key:
    {5FD5723F-D6F6-4F31-A7D0-318E72D28E80}
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}
21. Still in the left panel, locate and delete the key:
    1.0
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}>1.0
23. Still in the left panel, locate and delete the key:
    FLAGS
24. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}>1.0>0
25. Still in the left panel, locate and delete the key:
    win32
26. Again Still in the left panel, locate and delete the key:
    HELPDIR
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
28. Still in the left panel, locate and delete the key:
    {DF4F905C-0961-4464-8460-DD2A1F274D1F}
29. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{DF4F905C-0961-4464-8460-DD2A1F274D1F}
30. Still in the left panel, locate and delete the key:
    ProxyStubClsid
31. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
32. Again Still in the left panel, locate and delete the key:
    TypeLib
33. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBScript
34. Still in the left panel, locate and delete the key:
    OLEScript
35. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBS
36. Still in the left panel, locate and delete the key:
    OLEScript
37. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B54F3741-5B07-11cf-A4B0-00AA004A55E8}
38. Still in the left panel, locate and delete the key:
    OLEScript
39. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBScript Author
40. Still in the left panel, locate and delete the key:
    OLEScript
41. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBS Author
42. Still in the left panel, locate and delete the key:
    OLEScript
43. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B54F3742-5B07-11cf-A4B0-00AA004A55E8}
44. Still in the left panel, locate and delete the key:
    OLEScript
45. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBScript.Encode
46. Still in the left panel, locate and delete the key:
    OLEScript
47. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B54F3743-5B07-11cf-A4B0-00AA004A55E8}
48. Still in the left panel, locate and delete the key:
    OLEScript
49. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBScript.RegExp
50. Still in the left panel, locate and delete the key:
    OLEScript
51. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{3F4DACA4-160D-11D2-A8E9-00104B365C9F}
52. Still in the left panel, locate and delete the key:
    OLEScript
53. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software
54. Still in the left panel, locate and delete the key:
    MacroMgr
55. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>MacroMgr
56. Still in the left panel, locate and delete the key:
    QMacro6
57. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>MacroMgr>QMacro6
58. Still in the left panel, locate and delete the key:
    Settings
59. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID
60. Still in the left panel, locate and delete the key:
    {EBEB87A4-E151-4054-AB45-A6E094C5334B}
61. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID>{EBEB87A4-E151-4054-AB45-A6E094C5334B}
62. Still in the left panel, locate and delete the key:
    ProgID
63. Again Still in the left panel, locate and delete the key:
    InprocHandler32
64. Again Still in the left panel, locate and delete the key:
    LocalServer32
65. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>MacroMgr>QMacro6>Settings
66. Still in the left panel, locate and delete the key:
    ControlBars-Summary
67. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>International
68. Still in the left panel, locate and delete the key:
    CpMRU
69. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{EF94624F-EAAE-47CA-BE5B-86FDBF0B2BBA}>InprocServer32
3. In the right panel, locate and delete the entry:
   ThreadingModel = "Apartment"
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{DF4F905C-0961-4464-8460-DD2A1F274D1F}>TypeLib
5. In the right panel, locate and delete the entry:
   Version = "1.0"
6. In the left panel, double-click the following:
   HKEY_CLASSES_ROOT
7. In the right panel, locate and delete the entry:
   VBScript = "VB Script Language"
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBScript
9. In the right panel, locate and delete the entry:
   CLSID = "{B54F3741-5B07-11cf-A4B0-00AA004A55E8}"
10. Again In the right panel, locate and delete the entry:
    VBS = "VB Script Language"
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBS
12. In the right panel, locate and delete the entry:
    CLSID = "{B54F3741-5B07-11cf-A4B0-00AA004A55E8}"
13. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
14. In the right panel, locate and delete the entry:
    {B54F3741-5B07-11cf-A4B0-00AA004A55E8} = "VB Script Language"
15. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B54F3741-5B07-11cf-A4B0-00AA004A55E8}
16. In the right panel, locate and delete the entry:
    ProgID = "VBScript"
17. Again In the right panel, locate and delete the entry:
    InprocServer32 = "%System%\VBScript.dll"
18. Again In the right panel, locate and delete the entry:
    VBScript Author = "VB Script Language Authoring"
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBScript Author
20. In the right panel, locate and delete the entry:
    CLSID = "{B54F3742-5B07-11cf-A4B0-00AA004A55E8}"
21. Again In the right panel, locate and delete the entry:
    VBS Author = "VB Script Language Authoring"
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBS Author
23. In the right panel, locate and delete the entry:
    CLSID = "{B54F3742-5B07-11cf-A4B0-00AA004A55E8}"
24. Again In the right panel, locate and delete the entry:
    {B54F3742-5B07-11cf-A4B0-00AA004A55E8} = "VB Script Language Authoring"
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B54F3742-5B07-11cf-A4B0-00AA004A55E8}
26. In the right panel, locate and delete the entry:
    ProgID = "VBScript Author"
27. Again In the right panel, locate and delete the entry:
    InprocServer32 = "%System%\VBScript.dll"
28. Again In the right panel, locate and delete the entry:
    VBScript.Encode = "VBScript Language Encoding"
29. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBScript.Encode
30. In the right panel, locate and delete the entry:
    CLSID = "{B54F3743-5B07-11cf-A4B0-00AA004A55E8}"
31. Again In the right panel, locate and delete the entry:
    {B54F3743-5B07-11cf-A4B0-00AA004A55E8} = "VBScript Language Encoding"
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B54F3743-5B07-11cf-A4B0-00AA004A55E8}
33. In the right panel, locate and delete the entry:
    ProgID = "VBScript.Encode"
34. Again In the right panel, locate and delete the entry:
    InprocServer32 = "%System%\VBScript.dll"
35. Again In the right panel, locate and delete the entry:
    VBScript.RegExp = "VBScript Regular Expression"
36. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBScript.RegExp
37. In the right panel, locate and delete the entry:
    CLSID = "{3F4DACA4-160D-11D2-A8E9-00104B365C9F}"
38. Again In the right panel, locate and delete the entry:
    {3F4DACA4-160D-11D2-A8E9-00104B365C9F} = "VBScript Regular Expression"
39. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{3F4DACA4-160D-11D2-A8E9-00104B365C9F}
40. In the right panel, locate and delete the entry:
    ProgID = "VBScript.RegExp"
41. Again In the right panel, locate and delete the entry:
    InprocServer32 = "%System%\VBScript.dll"
42. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer
43. In the right panel, locate and delete the entry:
    Ver = "e27d7400"
44. Again In the right panel, locate and delete the entry:
    QMCore.QMEngine = "QMCore.QMEngine"
45. Again In the right panel, locate and delete the entry:
    CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B} = "QMCore.QMEngine"
46. Again In the right panel, locate and delete the entry:
    QMCore.QMEngine\CLSID = "{EBEB87A4-E151-4054-AB45-A6E094C5334B}"
47. Again In the right panel, locate and delete the entry:
    CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\ProgID = "QMCore.QMEngine"
48. Again In the right panel, locate and delete the entry:
    CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\InprocHandler32 = "ole32.dll"
49. Again In the right panel, locate and delete the entry:
    CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\LocalServer32 = "%Program Files%\QMacro6.exe"
50. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>International>CpMRU
51. In the right panel, locate and delete the entry:
    Enable = "1"
52. Again In the right panel, locate and delete the entry:
    Size = "a"
53. Again In the right panel, locate and delete the entry:
    InitHits = "64"
54. Again In the right panel, locate and delete the entry:
    Factor = "14"
55. Close Registry Editor.

To restore registry values this malware/grayware modified:

1. Open Registry Editor. To do this:
   
   • On Windows 2000, XP, and Server 2003:
     Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
   • On Windows Vista and 7:
     Click the Start button, type REGEDIT in the Search input field then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{0E59F1D5-1FBE-11D0-8FF2-00A0D10038BC}>InprocServer32
3. In the right panel, locate the registry value:
   ThreadingModel = "Apartment"
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   ThreadingModel = "Apartment"
5. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B54F3741-5B07-11cf-A4B0-00AA004A55E8}>InprocServer32
6. In the right panel, locate the registry value:
   ThreadingModel = "Both"
7. Right-click on the value name and choose Modify. Change the value data of this entry to:
   ThreadingModel = "Both"
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B54F3742-5B07-11cf-A4B0-00AA004A55E8}>InprocServer32
9. In the right panel, locate the registry value:
   ThreadingModel = "Both"
10. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Both"
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B54F3743-5B07-11cf-A4B0-00AA004A55E8}>InprocServer32
12. In the right panel, locate the registry value:
    ThreadingModel = "Both"
13. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Both"
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{3F4DACA4-160D-11D2-A8E9-00104B365C9F}>InprocServer32
15. In the right panel, locate the registry value:
    ThreadingModel = "Apartment"
16. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Apartment"
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{3F4DACA0-160D-11D2-A8E9-00104B365C9F}>TypeLib
18. In the right panel, locate the registry value:
    Version = "1.0"
19. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "5.5"
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{3F4DACA1-160D-11D2-A8E9-00104B365C9F}>TypeLib
21. In the right panel, locate the registry value:
    Version = "1.0"
22. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "5.5"
23. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{3F4DACA2-160D-11D2-A8E9-00104B365C9F}>TypeLib
24. In the right panel, locate the registry value:
    Version = "1.0"
25. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "5.5"
26. Again In the right panel, locate the registry value:
    Version = "5.5"
27. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "5.5"
28. Again In the right panel, locate the registry value:
    Version = "5.5"
29. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "5.5"
30. Again In the right panel, locate the registry value:
    Version = "5.5"
31. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "5.5"
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Active Setup>Installed Components>{4f645220-306d-11d2-995d-00c04f98bbc9}
33. In the right panel, locate the registry value:
    IsInstalled = "1"
34. Right-click on the value name and choose Modify. Change the value data of this entry to:
    IsInstalled = "1"
35. Again In the right panel, locate the registry value:
    Version = "5,6,0,8820"
36. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "5,6,0,8820"
37. Again In the right panel, locate the registry value:
    Locale = "EN"
38. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Locale = "EN"
39. Again In the right panel, locate the registry value:
    ComponentID = "MSVBScript"
40. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ComponentID = "MSVBScript"
41. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %User Temp%\nsj3.tmp\System.dll
   • %System Root%\ºñ±ØÀ̱î²á ¸ÅÅ©·Î½ÇÇà.exe
   • %System Root%\svchost.exe
   • %System%\tmpad.xml
   • %Program Files%\script\stdlib.vbs
   • %Windows%\QMDispatch.dll
   • %System%\tdf.dll
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %User Temp%\nsj3.tmp\System.dll
   • %System Root%\ºñ±ØÀ̱î²á ¸ÅÅ©·Î½ÇÇà.exe
   • %System Root%\svchost.exe
   • %System%\tmpad.xml
   • %Program Files%\script\stdlib.vbs
   • %Windows%\QMDispatch.dll
   • %System%\tdf.dll
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\Wilbert
   • %User Profile%\LOCALS~1
   • %User Temp%\nsj3.tmp
   • %Program Files%\script
   • %User Temp%\BLiveUp
   • %User Temp%\BLiveUp\0
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\Wilbert
   • %User Profile%\LOCALS~1
   • %User Temp%\nsj3.tmp
   • %Program Files%\script
   • %User Temp%\BLiveUp
   • %User Temp%\BLiveUp\0