PE_FIDAMEG.A

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>FestiveBar_3gEI
3. Still in the left panel, locate and delete the key:
   Installer
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion
5. Still in the left panel, locate and delete the key:
   Ext
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext
7. Still in the left panel, locate and delete the key:
   PreApproved
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext>PreApproved
9. Still in the left panel, locate and delete the key:
   {bd5d30a4-4f8b-4a03-b894-1750ac37fa26}
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE
11. Still in the left panel, locate and delete the key:
    MozillaPlugins
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>MozillaPlugins
13. Still in the left panel, locate and delete the key:
    @ei.FestiveBar_3g.com/Plugin
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>MozillaPlugins>@ei.FestiveBar_3g.com/Plugin
15. Still in the left panel, locate and delete the key:
    MimeTypes
16. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>MozillaPlugins>@ei.FestiveBar_3g.com/Plugin>MimeTypes
17. Still in the left panel, locate and delete the key:
    application/x-festivebar_3gpluginei
18. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT
19. Still in the left panel, locate and delete the key:
    FestiveBar_3gInstaller.Start.1
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>FestiveBar_3gInstaller.Start.1
21. Still in the left panel, locate and delete the key:
    CLSID
22. Again Still in the left panel, locate and delete the key:
    FestiveBar_3gInstaller.Start
23. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>FestiveBar_3gInstaller.Start
24. Still in the left panel, locate and delete the key:
    CLSID
25. Again Still in the left panel, locate and delete the key:
    CurVer
26. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
27. Still in the left panel, locate and delete the key:
    {bd5d30a4-4f8b-4a03-b894-1750ac37fa26}
28. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{bd5d30a4-4f8b-4a03-b894-1750ac37fa26}
29. Still in the left panel, locate and delete the key:
    ProgID
30. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
31. Again Still in the left panel, locate and delete the key:
    Programmable
32. Again Still in the left panel, locate and delete the key:
    InprocServer32
33. Again Still in the left panel, locate and delete the key:
    Control
34. Again Still in the left panel, locate and delete the key:
    MiscStatus
35. Again Still in the left panel, locate and delete the key:
    TypeLib
36. Again Still in the left panel, locate and delete the key:
    Version
37. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
38. Still in the left panel, locate and delete the key:
    {9A5EFD2D-A3C2-46B3-A2F0-E5676D719865}
39. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{9A5EFD2D-A3C2-46B3-A2F0-E5676D719865}
40. Still in the left panel, locate and delete the key:
    1.0
41. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{9A5EFD2D-A3C2-46B3-A2F0-E5676D719865}>1.0
42. Still in the left panel, locate and delete the key:
    FLAGS
43. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{9A5EFD2D-A3C2-46B3-A2F0-E5676D719865}>1.0>0
44. Still in the left panel, locate and delete the key:
    win32
45. Again Still in the left panel, locate and delete the key:
    HELPDIR
46. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
47. Still in the left panel, locate and delete the key:
    {68C9C909-880E-4F9F-ACFF-B0A7B8AA79D0}
48. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{68C9C909-880E-4F9F-ACFF-B0A7B8AA79D0}
49. Still in the left panel, locate and delete the key:
    ProxyStubClsid
50. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
51. Again Still in the left panel, locate and delete the key:
    TypeLib
52. Again Still in the left panel, locate and delete the key:
    {70EF03D3-88F4-4FD6-B394-1C43109BC500}
53. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{70EF03D3-88F4-4FD6-B394-1C43109BC500}
54. Still in the left panel, locate and delete the key:
    ProxyStubClsid
55. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
56. Again Still in the left panel, locate and delete the key:
    TypeLib
57. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>FestiveBar_3gEI>Installer
3. In the right panel, locate and delete the entry:
   un = "FestiveBar"
4. Again In the right panel, locate and delete the entry:
   Dir = "%Program Files%\FestiveBar_3gEI\Installr\"
5. Again In the right panel, locate and delete the entry:
   PluginPath = "%Program Files%\FestiveBar_3gEI\Installr\1.bin\"
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>MozillaPlugins>@ei.FestiveBar_3g.com/Plugin
7. In the right panel, locate and delete the entry:
   Description = "FestiveBar Plugin"
8. Again In the right panel, locate and delete the entry:
   Path = "%Program Files%\FestiveBar_3gEI\Installr\1.bin\NP3gEISB.dll"
9. Again In the right panel, locate and delete the entry:
   vendor = "FULLCOMPANYNAME_DDE0BB24-8F8C-44e9-B962-8289B302DEF9"
10. Again In the right panel, locate and delete the entry:
    version = "1.1.0.0"
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>MozillaPlugins>@ei.FestiveBar_3g.com/Plugin>MimeTypes>application/x-festivebar_3gpluginei
12. In the right panel, locate and delete the entry:
    Description = "FestiveBar Plugin"
13. Again In the right panel, locate and delete the entry:
    Suffixes = "3gi"
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{bd5d30a4-4f8b-4a03-b894-1750ac37fa26}>InprocServer32
15. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
16. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{68C9C909-880E-4F9F-ACFF-B0A7B8AA79D0}>TypeLib
17. In the right panel, locate and delete the entry:
    Version = "1.0"
18. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{70EF03D3-88F4-4FD6-B394-1C43109BC500}>TypeLib
19. In the right panel, locate and delete the entry:
    Version = "1.0"
20. Again In the right panel, locate and delete the entry:
    CurInstall = "1"
21. Again In the right panel, locate and delete the entry:
    sr = "0"
22. Again In the right panel, locate and delete the entry:
    pl = "9"
23. Close Registry Editor.

To delete malware/grayware/spyware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %Program Files%\FestiveBar_3gEI
   • %Program Files%\FestiveBar_3gEI\Installr
   • %Program Files%\FestiveBar_3gEI\Installr\
   • %Program Files%\FestiveBar_3gEI\Installr\1.bin\
   • %Program Files%\FestiveBar_3gEI\Installr\1.bin\chrome\
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %Program Files%\FestiveBar_3gEI
   • %Program Files%\FestiveBar_3gEI\Installr
   • %Program Files%\FestiveBar_3gEI\Installr\
   • %Program Files%\FestiveBar_3gEI\Installr\1.bin\
   • %Program Files%\FestiveBar_3gEI\Installr\1.bin\chrome\

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %System%\5a572b08ac985215116e7e952b6fd7ec3cc9a75e_54f850f5559ebe7ee0a9b166e713.exe
   • %Program Files%\FestiveBar_3gEI\Installr\1.bin\NP3gEISb.dl_
   • %Program Files%\FestiveBar_3gEI\Installr\1.bin\NP3gEISb.dll
   • %Program Files%\FestiveBar_3gEI\Installr\1.bin\3gEIPlug.dl_
   • %Program Files%\FestiveBar_3gEI\Installr\1.bin\3gEIPlug.dll
   • %Program Files%\FestiveBar_3gEI\Installr\1.bin\3gEZSETP.dl_
   • %Program Files%\FestiveBar_3gEI\Installr\1.bin\3gEZSETP.dll
   • %System Root%\vcredist_x86.exe
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %System%\5a572b08ac985215116e7e952b6fd7ec3cc9a75e_54f850f5559ebe7ee0a9b166e713.exe
   • %Program Files%\FestiveBar_3gEI\Installr\1.bin\NP3gEISb.dl_
   • %Program Files%\FestiveBar_3gEI\Installr\1.bin\NP3gEISb.dll
   • %Program Files%\FestiveBar_3gEI\Installr\1.bin\3gEIPlug.dl_
   • %Program Files%\FestiveBar_3gEI\Installr\1.bin\3gEIPlug.dll
   • %Program Files%\FestiveBar_3gEI\Installr\1.bin\3gEZSETP.dl_
   • %Program Files%\FestiveBar_3gEI\Installr\1.bin\3gEZSETP.dll
   • %System Root%\vcredist_x86.exe
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.