TROJ_WAUCHOS.YSJC

To delete the registry key this malware/grayware created:

1. Open Registry Editor.
   » For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run, type regedit in the text box provided, and then press Enter.
   » For Windows Vista, Windows 7, and Windows Server 2008 users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, and Windows Server 2012 users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Google>Update>ClientState
3. Still in the left panel, locate and delete the key:
   {8A69D345-D564-463C-AFF1-A69D9E530F96}
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Google>Update
5. Still in the left panel, locate and delete the key:
   Clients
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Google>Update>Clients
7. Still in the left panel, locate and delete the key:
   {430FD4D0-B729-4F61-AA34-91526481799D}
8. Again Still in the left panel, locate and delete the key:
   {430FD4D0-B729-4F61-AA34-91526481799D}
9. Again Still in the left panel, locate and delete the key:
   ClientStateMedium
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options
11. Still in the left panel, locate and delete the key:
    GoogleUpdate.exe
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>MozillaPlugins
13. Still in the left panel, locate and delete the key:
    @tools.google.com/Google Update;version = 9
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>MozillaPlugins>@tools.google.com/Google Update;version=9
15. Still in the left panel, locate and delete the key:
    MimeTypes
16. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>MozillaPlugins>@tools.google.com/Google Update;version=9>MimeTypes
17. Still in the left panel, locate and delete the key:
    application/x-vnd.google.oneclickctrl.9
18. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion
19. Still in the left panel, locate and delete the key:
    Ext
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext
21. Still in the left panel, locate and delete the key:
    PreApproved
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext>PreApproved
23. Still in the left panel, locate and delete the key:
    {C442AC41-9200-4770-8CC0-7CDB4F245C55}
24. Again Still in the left panel, locate and delete the key:
    Stats
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext>Stats
26. Still in the left panel, locate and delete the key:
    {C442AC41-9200-4770-8CC0-7CDB4F245C55}
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext>Stats>{C442AC41-9200-4770-8CC0-7CDB4F245C55}
28. Still in the left panel, locate and delete the key:
    iexplore
29. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext>Stats>{C442AC41-9200-4770-8CC0-7CDB4F245C55}>iexplore
30. Still in the left panel, locate and delete the key:
    AllowedDomains
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext>Stats>{C442AC41-9200-4770-8CC0-7CDB4F245C55}>iexplore>AllowedDomains
32. Still in the left panel, locate and delete the key:
    *
33. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Low Rights>ElevationPolicy
34. Still in the left panel, locate and delete the key:
    {C442AC41-9200-4770-8CC0-7CDB4F245C55}
35. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes
36. Still in the left panel, locate and delete the key:
    Google.OneClickCtrl.9
37. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Google.OneClickCtrl.9
38. Still in the left panel, locate and delete the key:
    CLSID
39. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
40. Still in the left panel, locate and delete the key:
    {C442AC41-9200-4770-8CC0-7CDB4F245C55}
41. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{C442AC41-9200-4770-8CC0-7CDB4F245C55}
42. Still in the left panel, locate and delete the key:
    ProgID
43. Again Still in the left panel, locate and delete the key:
    InprocServer32
44. Again Still in the left panel, locate and delete the key:
    Implemented Categories
45. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{C442AC41-9200-4770-8CC0-7CDB4F245C55}>Implemented Categories
46. Still in the left panel, locate and delete the key:
    {59FB2056-D625-48D0-A944-1A85B5AB2640}
47. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>MIME>Database>Content Type
48. Still in the left panel, locate and delete the key:
    application/x-vnd.google.oneclickctrl.9
49. Again Still in the left panel, locate and delete the key:
    @tools.google.com/Google Update;version = 3
50. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>MozillaPlugins>@tools.google.com/Google Update;version=3
51. Still in the left panel, locate and delete the key:
    MimeTypes
52. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>MozillaPlugins>@tools.google.com/Google Update;version=3>MimeTypes
53. Still in the left panel, locate and delete the key:
    application/x-vnd.google.update3webcontrol.3
54. Again Still in the left panel, locate and delete the key:
    {C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}
55. Again Still in the left panel, locate and delete the key:
    {C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}
56. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext>Stats>{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}
57. Still in the left panel, locate and delete the key:
    iexplore
58. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext>Stats>{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}>iexplore
59. Still in the left panel, locate and delete the key:
    AllowedDomains
60. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext>Stats>{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}>iexplore>AllowedDomains
61. Still in the left panel, locate and delete the key:
    *
62. Again Still in the left panel, locate and delete the key:
    {C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}
63. Again Still in the left panel, locate and delete the key:
    Google.Update3WebControl.3
64. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Google.Update3WebControl.3
65. Still in the left panel, locate and delete the key:
    CLSID
66. Again Still in the left panel, locate and delete the key:
    {C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}
67. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}
68. Still in the left panel, locate and delete the key:
    ProgID
69. Again Still in the left panel, locate and delete the key:
    InprocServer32
70. Again Still in the left panel, locate and delete the key:
    Implemented Categories
71. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}>Implemented Categories
72. Still in the left panel, locate and delete the key:
    {59FB2056-D625-48D0-A944-1A85B5AB2640}
73. Again Still in the left panel, locate and delete the key:
    application/x-vnd.google.update3webcontrol.3
74. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID
75. Still in the left panel, locate and delete the key:
    {4EB61BAC-A3B6-4760-9581-655041EF4D69}
76. Again Still in the left panel, locate and delete the key:
    GoogleUpdate.exe
77. Again Still in the left panel, locate and delete the key:
    GoogleUpdate.Update3COMClassService.1.0
78. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.Update3COMClassService.1.0
79. Still in the left panel, locate and delete the key:
    CLSID
80. Again Still in the left panel, locate and delete the key:
    GoogleUpdate.Update3COMClassService
81. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.Update3COMClassService
82. Still in the left panel, locate and delete the key:
    CLSID
83. Again Still in the left panel, locate and delete the key:
    CurVer
84. Again Still in the left panel, locate and delete the key:
    {4EB61BAC-A3B6-4760-9581-655041EF4D69}
85. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{4EB61BAC-A3B6-4760-9581-655041EF4D69}
86. Still in the left panel, locate and delete the key:
    ProgID
87. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
88. Again Still in the left panel, locate and delete the key:
    {9465B4B4-5216-4042-9A2C-754D3BCDC410}
89. Again Still in the left panel, locate and delete the key:
    GoogleUpdate.OnDemandCOMClassSvc.1.0
90. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.OnDemandCOMClassSvc.1.0
91. Still in the left panel, locate and delete the key:
    CLSID
92. Again Still in the left panel, locate and delete the key:
    GoogleUpdate.OnDemandCOMClassSvc
93. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.OnDemandCOMClassSvc
94. Still in the left panel, locate and delete the key:
    CLSID
95. Again Still in the left panel, locate and delete the key:
    CurVer
96. Again Still in the left panel, locate and delete the key:
    {9465B4B4-5216-4042-9A2C-754D3BCDC410}
97. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{9465B4B4-5216-4042-9A2C-754D3BCDC410}
98. Still in the left panel, locate and delete the key:
    ProgID
99. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
100. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.Update3WebSvc.1.0
101. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.Update3WebSvc.1.0
102. Still in the left panel, locate and delete the key:
     CLSID
103. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.Update3WebSvc
104. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.Update3WebSvc
105. Still in the left panel, locate and delete the key:
     CLSID
106. Again Still in the left panel, locate and delete the key:
     CurVer
107. Again Still in the left panel, locate and delete the key:
     {534F5323-3569-4F42-919D-1E1CF93E5BF6}
108. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{534F5323-3569-4F42-919D-1E1CF93E5BF6}
109. Still in the left panel, locate and delete the key:
     ProgID
110. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
111. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.CoreClass.1
112. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.CoreClass.1
113. Still in the left panel, locate and delete the key:
     CLSID
114. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.CoreClass
115. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.CoreClass
116. Still in the left panel, locate and delete the key:
     CLSID
117. Again Still in the left panel, locate and delete the key:
     CurVer
118. Again Still in the left panel, locate and delete the key:
     {E225E692-4B47-4777-9BED-4FD7FE257F0E}
119. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{E225E692-4B47-4777-9BED-4FD7FE257F0E}
120. Still in the left panel, locate and delete the key:
     ProgID
121. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
122. Again Still in the left panel, locate and delete the key:
     {D580254F-5E17-4AE0-9C41-60A0526A8ED6}
123. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{D580254F-5E17-4AE0-9C41-60A0526A8ED6}
124. Still in the left panel, locate and delete the key:
     InprocHandler32
125. Again Still in the left panel, locate and delete the key:
     {9D6AA569-9F30-41AD-885A-346685C74928}
126. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{9D6AA569-9F30-41AD-885A-346685C74928}
127. Still in the left panel, locate and delete the key:
     InprocServer32
128. Again Still in the left panel, locate and delete the key:
     {F8BC3B89-DD15-4DA2-B936-CEA2B2A35053}
129. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{F8BC3B89-DD15-4DA2-B936-CEA2B2A35053}
130. Still in the left panel, locate and delete the key:
     InProcServer32
131. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
132. Still in the left panel, locate and delete the key:
     {2E629606-312A-482F-9B12-2C4ABF6F0B6D}
133. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{2E629606-312A-482F-9B12-2C4ABF6F0B6D}
134. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
135. Again Still in the left panel, locate and delete the key:
     NumMethods
136. Again Still in the left panel, locate and delete the key:
     {19692F10-ADD2-4EFF-BE54-E61C62E40D13}
137. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{19692F10-ADD2-4EFF-BE54-E61C62E40D13}
138. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
139. Again Still in the left panel, locate and delete the key:
     NumMethods
140. Again Still in the left panel, locate and delete the key:
     {31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}
141. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}
142. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
143. Again Still in the left panel, locate and delete the key:
     NumMethods
144. Again Still in the left panel, locate and delete the key:
     {8476CE12-AE1F-4198-805C-BA0F9B783F57}
145. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{8476CE12-AE1F-4198-805C-BA0F9B783F57}
146. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
147. Again Still in the left panel, locate and delete the key:
     NumMethods
148. Again Still in the left panel, locate and delete the key:
     {0CD01D1E-4A1C-489D-93B9-9B6672877C57}
149. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{0CD01D1E-4A1C-489D-93B9-9B6672877C57}
150. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
151. Again Still in the left panel, locate and delete the key:
     NumMethods
152. Again Still in the left panel, locate and delete the key:
     {4E223325-C16B-4EEB-AEDC-19AA99A237FA}
153. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{4E223325-C16B-4EEB-AEDC-19AA99A237FA}
154. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
155. Again Still in the left panel, locate and delete the key:
     NumMethods
156. Again Still in the left panel, locate and delete the key:
     {BCDCB538-01C0-46D1-A6A7-52F4D021C272}
157. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BCDCB538-01C0-46D1-A6A7-52F4D021C272}
158. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
159. Again Still in the left panel, locate and delete the key:
     NumMethods
160. Again Still in the left panel, locate and delete the key:
     {49D7563B-2DDB-4831-88C8-768A53833837}
161. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{49D7563B-2DDB-4831-88C8-768A53833837}
162. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
163. Again Still in the left panel, locate and delete the key:
     NumMethods
164. Again Still in the left panel, locate and delete the key:
     {DAB1D343-1B2A-47F9-B445-93DC50704BFE}
165. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{DAB1D343-1B2A-47F9-B445-93DC50704BFE}
166. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
167. Again Still in the left panel, locate and delete the key:
     NumMethods
168. Again Still in the left panel, locate and delete the key:
     {3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}
169. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}
170. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
171. Again Still in the left panel, locate and delete the key:
     NumMethods
172. Again Still in the left panel, locate and delete the key:
     {6DB17455-4E85-46E7-9D23-E555E4B005AF}
173. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{6DB17455-4E85-46E7-9D23-E555E4B005AF}
174. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
175. Again Still in the left panel, locate and delete the key:
     NumMethods
176. Again Still in the left panel, locate and delete the key:
     {DD42475D-6D46-496A-924E-BD5630B4CBBA}
177. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{DD42475D-6D46-496A-924E-BD5630B4CBBA}
178. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
179. Again Still in the left panel, locate and delete the key:
     NumMethods
180. Again Still in the left panel, locate and delete the key:
     {D106AB5F-A70E-400E-A21B-96208C1D8DBB}
181. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{D106AB5F-A70E-400E-A21B-96208C1D8DBB}
182. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
183. Again Still in the left panel, locate and delete the key:
     NumMethods
184. Again Still in the left panel, locate and delete the key:
     {B3A47570-0A85-4AEA-8270-529D47899603}
185. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B3A47570-0A85-4AEA-8270-529D47899603}
186. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
187. Again Still in the left panel, locate and delete the key:
     NumMethods
188. Again Still in the left panel, locate and delete the key:
     {18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}
189. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}
190. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
191. Again Still in the left panel, locate and delete the key:
     NumMethods
192. Again Still in the left panel, locate and delete the key:
     {2D363682-561D-4C3A-81C6-F2F82107562A}
193. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{2D363682-561D-4C3A-81C6-F2F82107562A}
194. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
195. Again Still in the left panel, locate and delete the key:
     NumMethods
196. Again Still in the left panel, locate and delete the key:
     {DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}
197. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}
198. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
199. Again Still in the left panel, locate and delete the key:
     NumMethods
200. Again Still in the left panel, locate and delete the key:
     {76F7B787-A67C-4C73-82C7-31F5E3AABC5C}
201. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}
202. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
203. Again Still in the left panel, locate and delete the key:
     NumMethods
204. Again Still in the left panel, locate and delete the key:
     {128C2DA6-2BC0-44C0-B3F6-4EC22E647964}
205. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}
206. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
207. Again Still in the left panel, locate and delete the key:
     NumMethods
208. Again Still in the left panel, locate and delete the key:
     {084D78A8-B084-4E14-A629-A2C419B0E3D9}
209. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{084D78A8-B084-4E14-A629-A2C419B0E3D9}
210. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
211. Again Still in the left panel, locate and delete the key:
     NumMethods
212. Again Still in the left panel, locate and delete the key:
     {909489C2-85A6-4322-AA56-D25278649D67}
213. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{909489C2-85A6-4322-AA56-D25278649D67}
214. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
215. Again Still in the left panel, locate and delete the key:
     NumMethods
216. Again Still in the left panel, locate and delete the key:
     {494B20CF-282E-4BDD-9F5D-B70CB09D351E}
217. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{494B20CF-282E-4BDD-9F5D-B70CB09D351E}
218. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
219. Again Still in the left panel, locate and delete the key:
     NumMethods
220. Again Still in the left panel, locate and delete the key:
     {5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}
221. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}
222. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
223. Again Still in the left panel, locate and delete the key:
     NumMethods
224. Again Still in the left panel, locate and delete the key:
     {FE908CDD-22BB-472A-9870-1A0390E42F36}
225. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{FE908CDD-22BB-472A-9870-1A0390E42F36}
226. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
227. Again Still in the left panel, locate and delete the key:
     NumMethods
228. Again Still in the left panel, locate and delete the key:
     {1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}
229. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}
230. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
231. Again Still in the left panel, locate and delete the key:
     NumMethods
232. Again Still in the left panel, locate and delete the key:
     {5CCCB0EF-7073-4516-8028-4C628D0C8AAB}
233. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{5CCCB0EF-7073-4516-8028-4C628D0C8AAB}
234. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
235. Again Still in the left panel, locate and delete the key:
     NumMethods
236. Again Still in the left panel, locate and delete the key:
     {247954F9-9EDC-4E68-8CC3-150C2B89EADF}
237. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{247954F9-9EDC-4E68-8CC3-150C2B89EADF}
238. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
239. Again Still in the left panel, locate and delete the key:
     NumMethods
240. Again Still in the left panel, locate and delete the key:
     {4DE778FE-F195-4EE3-9DAB-FE446C239221}
241. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{4DE778FE-F195-4EE3-9DAB-FE446C239221}
242. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
243. Again Still in the left panel, locate and delete the key:
     NumMethods
244. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.OnDemandCOMClassMachine.1.0
245. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.OnDemandCOMClassMachine.1.0
246. Still in the left panel, locate and delete the key:
     CLSID
247. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.OnDemandCOMClassMachine
248. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.OnDemandCOMClassMachine
249. Still in the left panel, locate and delete the key:
     CLSID
250. Again Still in the left panel, locate and delete the key:
     CurVer
251. Again Still in the left panel, locate and delete the key:
     {6F8BD55B-E83D-4A47-85BE-81FFA8057A69}
252. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}
253. Still in the left panel, locate and delete the key:
     ProgID
254. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
255. Again Still in the left panel, locate and delete the key:
     LocalServer32
256. Again Still in the left panel, locate and delete the key:
     Elevation
257. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.Update3WebMachine.1.0
258. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.Update3WebMachine.1.0
259. Still in the left panel, locate and delete the key:
     CLSID
260. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.Update3WebMachine
261. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.Update3WebMachine
262. Still in the left panel, locate and delete the key:
     CLSID
263. Again Still in the left panel, locate and delete the key:
     CurVer
264. Again Still in the left panel, locate and delete the key:
     {8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}
265. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}
266. Still in the left panel, locate and delete the key:
     ProgID
267. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
268. Again Still in the left panel, locate and delete the key:
     LocalServer32
269. Again Still in the left panel, locate and delete the key:
     Elevation
270. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.CoCreateAsync.1.0
271. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.CoCreateAsync.1.0
272. Still in the left panel, locate and delete the key:
     CLSID
273. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.CoCreateAsync
274. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.CoCreateAsync
275. Still in the left panel, locate and delete the key:
     CLSID
276. Again Still in the left panel, locate and delete the key:
     CurVer
277. Again Still in the left panel, locate and delete the key:
     {7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}
278. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}
279. Still in the left panel, locate and delete the key:
     ProgID
280. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
281. Again Still in the left panel, locate and delete the key:
     LocalServer32
282. Again Still in the left panel, locate and delete the key:
     Google.OneClickProcessLauncherMachine.1.0
283. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Google.OneClickProcessLauncherMachine.1.0
284. Still in the left panel, locate and delete the key:
     CLSID
285. Again Still in the left panel, locate and delete the key:
     Google.OneClickProcessLauncherMachine
286. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Google.OneClickProcessLauncherMachine
287. Still in the left panel, locate and delete the key:
     CLSID
288. Again Still in the left panel, locate and delete the key:
     CurVer
289. Again Still in the left panel, locate and delete the key:
     {AAD4AE2E-D834-46D4-8B09-490FAC9C722B}
290. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}
291. Still in the left panel, locate and delete the key:
     ProgID
292. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
293. Again Still in the left panel, locate and delete the key:
     LocalServer32
294. Again Still in the left panel, locate and delete the key:
     {AAD4AE2E-D834-46D4-8B09-490FAC9C722B}
295. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.ProcessLauncher.1.0
296. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.ProcessLauncher.1.0
297. Still in the left panel, locate and delete the key:
     CLSID
298. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.ProcessLauncher
299. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.ProcessLauncher
300. Still in the left panel, locate and delete the key:
     CLSID
301. Again Still in the left panel, locate and delete the key:
     CurVer
302. Again Still in the left panel, locate and delete the key:
     {ABC01078-F197-4B0B-ADBC-CFE684B39C82}
303. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{ABC01078-F197-4B0B-ADBC-CFE684B39C82}
304. Still in the left panel, locate and delete the key:
     ProgID
305. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
306. Again Still in the left panel, locate and delete the key:
     LocalServer32
307. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.CoreMachineClass.1
308. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.CoreMachineClass.1
309. Still in the left panel, locate and delete the key:
     CLSID
310. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.CoreMachineClass
311. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.CoreMachineClass
312. Still in the left panel, locate and delete the key:
     CLSID
313. Again Still in the left panel, locate and delete the key:
     CurVer
314. Again Still in the left panel, locate and delete the key:
     {9B2340A0-4068-43D6-B404-32E27217859D}
315. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{9B2340A0-4068-43D6-B404-32E27217859D}
316. Still in the left panel, locate and delete the key:
     ProgID
317. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
318. Again Still in the left panel, locate and delete the key:
     LocalServer32
319. Again Still in the left panel, locate and delete the key:
     Elevation
320. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.OnDemandCOMClassMachineFallback.1.0
321. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.OnDemandCOMClassMachineFallback.1.0
322. Still in the left panel, locate and delete the key:
     CLSID
323. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.OnDemandCOMClassMachineFallback
324. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.OnDemandCOMClassMachineFallback
325. Still in the left panel, locate and delete the key:
     CLSID
326. Again Still in the left panel, locate and delete the key:
     CurVer
327. Again Still in the left panel, locate and delete the key:
     {B3D28DBD-0DFA-40E4-8071-520767BADC7E}
328. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B3D28DBD-0DFA-40E4-8071-520767BADC7E}
329. Still in the left panel, locate and delete the key:
     ProgID
330. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
331. Again Still in the left panel, locate and delete the key:
     LocalServer32
332. Again Still in the left panel, locate and delete the key:
     Elevation
333. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.Update3WebMachineFallback.1.0
334. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.Update3WebMachineFallback.1.0
335. Still in the left panel, locate and delete the key:
     CLSID
336. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.Update3WebMachineFallback
337. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.Update3WebMachineFallback
338. Still in the left panel, locate and delete the key:
     CLSID
339. Again Still in the left panel, locate and delete the key:
     CurVer
340. Again Still in the left panel, locate and delete the key:
     {598FE0E5-E02D-465D-9A9D-37974A28FD42}
341. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{598FE0E5-E02D-465D-9A9D-37974A28FD42}
342. Still in the left panel, locate and delete the key:
     ProgID
343. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
344. Again Still in the left panel, locate and delete the key:
     LocalServer32
345. Again Still in the left panel, locate and delete the key:
     Elevation
346. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.CredentialDialogMachine.1.0
347. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.CredentialDialogMachine.1.0
348. Still in the left panel, locate and delete the key:
     CLSID
349. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.CredentialDialogMachine
350. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.CredentialDialogMachine
351. Still in the left panel, locate and delete the key:
     CLSID
352. Again Still in the left panel, locate and delete the key:
     CurVer
353. Again Still in the left panel, locate and delete the key:
     {25461599-633D-42B1-84FB-7CD68D026E53}
354. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{25461599-633D-42B1-84FB-7CD68D026E53}
355. Still in the left panel, locate and delete the key:
     ProgID
356. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
357. Again Still in the left panel, locate and delete the key:
     LocalServer32
358. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Google>Update
359. Still in the left panel, locate and delete the key:
     proxy
360. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor.
   » For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run, type regedit in the text box provided, and then press Enter.
   » For Windows Vista, Windows 7, and Windows Server 2008 users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, and Windows Server 2012 users, right-click on the lower-left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Google>Update>ClientState>{8A69D345-D564-463C-AFF1-A69D9E530F96}
3. In the right panel, locate and delete the entry:
   usagestats = "0"
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Google>Update
5. In the right panel, locate and delete the entry:
   path = "%Program Files%\Google\Update\GoogleUpdate.exe"
6. Again In the right panel, locate and delete the entry:
   UninstallCmdLine = "%Program Files%\Google\Update\GoogleUpdate.exe /uninstall"
7. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Google>Update>Clients>{430FD4D0-B729-4F61-AA34-91526481799D}
8. In the right panel, locate and delete the entry:
   pv = "1.3.29.5"
9. Again In the right panel, locate and delete the entry:
   name = "Google Update"
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Google>Update>ClientState>{430FD4D0-B729-4F61-AA34-91526481799D}
11. In the right panel, locate and delete the entry:
    pv = "1.3.29.5"
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>GoogleUpdate.exe
13. In the right panel, locate and delete the entry:
    DisableExceptionChainValidation = "0"
14. Again In the right panel, locate and delete the entry:
    IsMSIHelperRegistered = "0"
15. Again In the right panel, locate and delete the entry:
    LastOSVersion = "{random values}"
16. Again In the right panel, locate and delete the entry:
    version = "1.3.29.5"
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>MozillaPlugins>@tools.google.com/Google Update;version=9
18. In the right panel, locate and delete the entry:
    Path = "%Program Files%\Google\Update\1.3.29.5\npGoogleUpdate3.dll"
19. Again In the right panel, locate and delete the entry:
    Description = "Google Update"
20. Again In the right panel, locate and delete the entry:
    ProductName = "Google Update"
21. Again In the right panel, locate and delete the entry:
    Vendor = "Google Inc."
22. Again In the right panel, locate and delete the entry:
    Version = "9"
23. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Low Rights>ElevationPolicy>{C442AC41-9200-4770-8CC0-7CDB4F245C55}
24. In the right panel, locate and delete the entry:
    AppName = "GoogleUpdateWebPlugin.exe"
25. Again In the right panel, locate and delete the entry:
    AppPath = "%Program Files%\Google\Update\1.3.29.5"
26. Again In the right panel, locate and delete the entry:
    Policy = "3"
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{C442AC41-9200-4770-8CC0-7CDB4F245C55}>InprocServer32
28. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
29. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>MIME>Database>Content Type>application/x-vnd.google.oneclickctrl.9
30. In the right panel, locate and delete the entry:
    CLSID = "{C442AC41-9200-4770-8CC0-7CDB4F245C55}"
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>MozillaPlugins>@tools.google.com/Google Update;version=3
32. In the right panel, locate and delete the entry:
    Path = "%Program Files%\Google\Update\1.3.29.5\npGoogleUpdate3.dll"
33. Again In the right panel, locate and delete the entry:
    Description = "Google Update"
34. Again In the right panel, locate and delete the entry:
    ProductName = "Google Update"
35. Again In the right panel, locate and delete the entry:
    Vendor = "Google Inc."
36. Again In the right panel, locate and delete the entry:
    Version = "3"
37. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Low Rights>ElevationPolicy>{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}
38. In the right panel, locate and delete the entry:
    AppName = "GoogleUpdateBroker.exe"
39. Again In the right panel, locate and delete the entry:
    AppPath = "%Program Files%\Google\Update\1.3.29.5"
40. Again In the right panel, locate and delete the entry:
    Policy = "3"
41. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}>InprocServer32
42. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
43. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>MIME>Database>Content Type>application/x-vnd.google.update3webcontrol.3
44. In the right panel, locate and delete the entry:
    CLSID = "{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}"
45. Again In the right panel, locate and delete the entry:
    iid = "{4CDCD197-4C43-B5F9-EFFB-262372DCD6AC}"
46. Again In the right panel, locate and delete the entry:
    brand = "GGLS"
47. Again In the right panel, locate and delete the entry:
    InstallTime = "57b96f69"
48. Again In the right panel, locate and delete the entry:
    DayOfInstall = "ffffffff"
49. Again In the right panel, locate and delete the entry:
    DayOfLastActivity = "ffffffff"
50. Again In the right panel, locate and delete the entry:
    DayOfLastRollCall = "ffffffff"
51. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>GoogleUpdate.exe
52. In the right panel, locate and delete the entry:
    AppID = "{4EB61BAC-A3B6-4760-9581-655041EF4D69}"
53. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>{4EB61BAC-A3B6-4760-9581-655041EF4D69}
54. In the right panel, locate and delete the entry:
    LocalService = "gupdate"
55. Again In the right panel, locate and delete the entry:
    ServiceParameters = "/comsvc"
56. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{4EB61BAC-A3B6-4760-9581-655041EF4D69}
57. In the right panel, locate and delete the entry:
    AppID = "{4EB61BAC-A3B6-4760-9581-655041EF4D69}"
58. Again In the right panel, locate and delete the entry:
    AppID = "{9465B4B4-5216-4042-9A2C-754D3BCDC410}"
59. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>{9465B4B4-5216-4042-9A2C-754D3BCDC410}
60. In the right panel, locate and delete the entry:
    LocalService = "gupdatem"
61. Again In the right panel, locate and delete the entry:
    ServiceParameters = "/comsvc"
62. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{9465B4B4-5216-4042-9A2C-754D3BCDC410}
63. In the right panel, locate and delete the entry:
    AppID = "{9465B4B4-5216-4042-9A2C-754D3BCDC410}"
64. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{534F5323-3569-4F42-919D-1E1CF93E5BF6}
65. In the right panel, locate and delete the entry:
    AppID = "{9465B4B4-5216-4042-9A2C-754D3BCDC410}"
66. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{E225E692-4B47-4777-9BED-4FD7FE257F0E}
67. In the right panel, locate and delete the entry:
    AppID = "{9465B4B4-5216-4042-9A2C-754D3BCDC410}"
68. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{D580254F-5E17-4AE0-9C41-60A0526A8ED6}>InprocHandler32
69. In the right panel, locate and delete the entry:
    ThreadingModel = "Both"
70. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{9D6AA569-9F30-41AD-885A-346685C74928}>InprocServer32
71. In the right panel, locate and delete the entry:
    ThreadingModel = "Both"
72. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{F8BC3B89-DD15-4DA2-B936-CEA2B2A35053}>InProcServer32
73. In the right panel, locate and delete the entry:
    ThreadingModel = "Both"
74. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}
75. In the right panel, locate and delete the entry:
    LocalizedString = "@%Program Files%\Google\Update\1.3.29.5\goopdate.dll,-3000"
76. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}>Elevation
77. In the right panel, locate and delete the entry:
    Enabled = "1"
78. Again In the right panel, locate and delete the entry:
    IconReference = "@%Program Files%\Google\Update\1.3.29.5\goopdate.dll,-1004"
79. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}
80. In the right panel, locate and delete the entry:
    LocalizedString = "@%Program Files%\Google\Update\1.3.29.5\goopdate.dll,-3000"
81. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}>Elevation
82. In the right panel, locate and delete the entry:
    Enabled = "1"
83. Again In the right panel, locate and delete the entry:
    IconReference = "@%Program Files%\Google\Update\1.3.29.5\goopdate.dll,-1004"
84. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Low Rights>ElevationPolicy>{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}
85. In the right panel, locate and delete the entry:
    CLSID = "{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}"
86. Again In the right panel, locate and delete the entry:
    Policy = "3"
87. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{9B2340A0-4068-43D6-B404-32E27217859D}
88. In the right panel, locate and delete the entry:
    LocalizedString = "@%Program Files%\Google\Update\1.3.29.5\goopdate.dll,-3000"
89. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{9B2340A0-4068-43D6-B404-32E27217859D}>Elevation
90. In the right panel, locate and delete the entry:
    Enabled = "1"
91. Again In the right panel, locate and delete the entry:
    IconReference = "@%Program Files%\Google\Update\1.3.29.5\goopdate.dll,-1004"
92. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B3D28DBD-0DFA-40E4-8071-520767BADC7E}
93. In the right panel, locate and delete the entry:
    LocalizedString = "@%Program Files%\Google\Update\1.3.29.5\goopdate.dll,-3000"
94. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B3D28DBD-0DFA-40E4-8071-520767BADC7E}>Elevation
95. In the right panel, locate and delete the entry:
    Enabled = "1"
96. Again In the right panel, locate and delete the entry:
    IconReference = "@%Program Files%\Google\Update\1.3.29.5\goopdate.dll,-1004"
97. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{598FE0E5-E02D-465D-9A9D-37974A28FD42}
98. In the right panel, locate and delete the entry:
    LocalizedString = "@%Program Files%\Google\Update\1.3.29.5\goopdate.dll,-3000"
99. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{598FE0E5-E02D-465D-9A9D-37974A28FD42}>Elevation
100. In the right panel, locate and delete the entry:
     Enabled = "1"
101. Again In the right panel, locate and delete the entry:
     IconReference = "@%Program Files%\Google\Update\1.3.29.5\goopdate.dll,-1004"
102. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>DE28F4A4FFE5B92FA3C503D1A349A7F9962A8212
103. In the right panel, locate and delete the entry:
     Blob = "{random values}"
104. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Google>Update>proxy
105. In the right panel, locate and delete the entry:
     source = "auto"
106. Close Registry Editor.

To restore registry values this malware/grayware modified:

1. Open Registry Editor. To do this:
   
   • On Windows 2000, XP, and Server 2003:
     Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
   • On Windows Vista, 7, and Server 2008:
     Click the Start button, type REGEDIT in the Search input field then press Enter.
   • On Windows 8, 8.1, and Server 2012:
     Right-click on the lower left corner of the screen and click Run, type REGEDIT in the Run input field, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4EFCED9C6BDD0C985CA3C7D253063C5BE6FC620C
3. In the right panel, locate the registry value:
   Blob = "{random values}"
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   Blob = "{random values}"
5. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4EF2E6670AC9B5091FE06BE0E5483EAAD6BA32D9
6. In the right panel, locate the registry value:
   Blob = "{random values}"
7. Right-click on the value name and choose Modify. Change the value data of this entry to:
   Blob = "{random values}"
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4C95A9902ABE0777CED18D6ACCC3372D2748381E
9. In the right panel, locate the registry value:
   Blob = "{random values}"
10. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4BA7B9DDD68788E12FF852E1A024204BF286A8F6
12. In the right panel, locate the registry value:
    Blob = "{random values}"
13. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4B421F7515F6AE8A6ECEF97F6982A400A4D9224E
15. In the right panel, locate the registry value:
    Blob = "{random values}"
16. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>47AFB915CDA26D82467B97FA42914468726138DD
18. In the right panel, locate the registry value:
    Blob = "{random values}"
19. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4463C531D7CCC1006794612BB656D3BF8257846F
21. In the right panel, locate the registry value:
    Blob = "{random values}"
22. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
23. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>43F9B110D5BAFD48225231B0D0082B372FEF9A54
24. In the right panel, locate the registry value:
    Blob = "{random values}"
25. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
26. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>43DDB1FFF3B49B73831407F6BC8B975023D07C50
27. In the right panel, locate the registry value:
    Blob = "{random values}"
28. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
29. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>40E78C1D523D1CD9954FAC1A1AB3BD3CBAA15BFC
30. In the right panel, locate the registry value:
    Blob = "{random values}"
31. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4072BA31FEC351438480F62E6CB95508461EAB2F
33. In the right panel, locate the registry value:
    Blob = "{random values}"
34. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
35. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>3F85F2BB4A62B0B58BE1614ABB0D4631B4BEF8BA
36. In the right panel, locate the registry value:
    Blob = "{random values}"
37. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
38. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>394FF6850B06BE52E51856CC10E180E882B385CC
39. In the right panel, locate the registry value:
    Blob = "{random values}"
40. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
41. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>36863563FD5128C7BEA6F005CFE9B43668086CCE
42. In the right panel, locate the registry value:
    Blob = "{random values}"
43. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6
45. In the right panel, locate the registry value:
    Blob = "{random values}"
46. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
47. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>2F173F7DE99667AFA57AF80AA2D1B12FAC830338
48. In the right panel, locate the registry value:
    Blob = "{random values}"
49. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
50. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>284F55C41A1A7A3F8328D4C262FB376ED6096F24
51. In the right panel, locate the registry value:
    Blob = "{random values}"
52. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
53. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>273EE12457FDC4F90C55E82B56167F62F532E547
54. In the right panel, locate the registry value:
    Blob = "{random values}"
55. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
56. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>24BA6D6C8A5B5837A48DB5FAE919EA675C94D217
57. In the right panel, locate the registry value:
    Blob = "{random values}"
58. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
59. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>24A40A1F573643A67F0A4B0749F6A22BF28ABB6B
60. In the right panel, locate the registry value:
    Blob = "{random values}"
61. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
62. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>23E594945195F2414803B4D564D2A3A3F5D88B8C
63. In the right panel, locate the registry value:
    Blob = "{random values}"
64. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
65. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>216B2A29E62A00CE820146D8244141B92511B279
66. In the right panel, locate the registry value:
    Blob = "{random values}"
67. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
68. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>209900B63D955728140CD13622D8C687A4EB0085
69. In the right panel, locate the registry value:
    Blob = "{random values}"
70. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
71. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>1F55E8839BAC30728BE7108EDE7B0BB0D3298224
72. In the right panel, locate the registry value:
    Blob = "{random values}"
73. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
74. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>1331F48A5DA8E01DAACA1BB0C17044ACFEF755BB
75. In the right panel, locate the registry value:
    Blob = "{random values}"
76. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
77. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>0B77BEBBCB7AA24705DECC0FBD6A02FC7ABD9B52
78. In the right panel, locate the registry value:
    Blob = "{random values}"
79. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
80. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>049811056AFE9FD0F5BE01685AACE6A5D1C4454C
81. In the right panel, locate the registry value:
    Blob = "{random values}"
82. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
83. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>0483ED3399AC3608058722EDBC5E4600E3BEF9D7
84. In the right panel, locate the registry value:
    Blob = "{random values}"
85. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
86. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>00EA522C8A9C06AA3ECCE0B4FA6CDC21D92E8099
87. In the right panel, locate the registry value:
    Blob = "{random values}"
88. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
89. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>0048F8D37B153F6EA2798C323EF4F318A5624A9E
90. In the right panel, locate the registry value:
    Blob = "{random values}"
91. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
92. Close Registry Editor.

To manually delete a malware/grayware file from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the File name* input box, type the following:
   
   • __tmp_rar_sfx_access_check_52546
   • ChromeSetup.exe
   • KB153400.exe
   • %Program Files%\GUM5.tmp\GoogleUpdate.exe
   • %Program Files%\GUM5.tmp\GoogleCrashHandler.exe
   • %Program Files%\GUM5.tmp\goopdate.dll
   • %Program Files%\GUM5.tmp\npGoogleUpdate3.dll
   • %Program Files%\GUM5.tmp\GoogleUpdateHelper.msi
   • %Program Files%\GUM5.tmp\GoogleUpdateBroker.exe
   • %Program Files%\GUM5.tmp\GoogleUpdateOnDemand.exe
   • %Program Files%\GUM5.tmp\GoogleUpdateComRegisterShell64.exe
   • %Program Files%\GUM5.tmp\GoogleUpdateWebPlugin.exe
   • %Program Files%\GUM5.tmp\psmachine.dll
   • %Program Files%\GUM5.tmp\psmachine_64.dll
   • %Program Files%\GUM5.tmp\psuser.dll
   • %Program Files%\GUM5.tmp\psuser_64.dll
   • %Program Files%\GUM5.tmp\GoogleCrashHandler64.exe
   • %Program Files%\GUM5.tmp\goopdateres_am.dll
   • %Program Files%\GUM5.tmp\goopdateres_ar.dll
   • %Program Files%\GUM5.tmp\goopdateres_bg.dll
   • %Program Files%\GUM5.tmp\goopdateres_bn.dll
   • %Program Files%\GUM5.tmp\goopdateres_ca.dll
   • %Program Files%\GUM5.tmp\goopdateres_cs.dll
   • %Program Files%\GUM5.tmp\goopdateres_da.dll
   • %Program Files%\GUM5.tmp\goopdateres_de.dll
   • %Program Files%\GUM5.tmp\goopdateres_el.dll
   • %Program Files%\GUM5.tmp\goopdateres_en.dll
   • %Program Files%\GUM5.tmp\goopdateres_en-GB.dll
   • %Program Files%\GUM5.tmp\goopdateres_es.dll
   • %Program Files%\GUM5.tmp\goopdateres_es-419.dll
   • %Program Files%\GUM5.tmp\goopdateres_et.dll
   • %Program Files%\GUM5.tmp\goopdateres_fa.dll
   • %Program Files%\GUM5.tmp\goopdateres_fi.dll
   • %Program Files%\GUM5.tmp\goopdateres_fil.dll
   • %Program Files%\GUM5.tmp\goopdateres_fr.dll
   • %Program Files%\GUM5.tmp\goopdateres_gu.dll
   • %Program Files%\GUM5.tmp\goopdateres_hi.dll
   • %Program Files%\GUM5.tmp\goopdateres_hr.dll
   • %Program Files%\GUM5.tmp\goopdateres_hu.dll
   • %Program Files%\GUM5.tmp\goopdateres_id.dll
   • %Program Files%\GUM5.tmp\goopdateres_is.dll
   • %Program Files%\GUM5.tmp\goopdateres_it.dll
   • %Program Files%\GUM5.tmp\goopdateres_iw.dll
   • %Program Files%\GUM5.tmp\goopdateres_ja.dll
   • %Program Files%\GUM5.tmp\goopdateres_kn.dll
   • %Program Files%\GUM5.tmp\goopdateres_ko.dll
   • %Program Files%\GUM5.tmp\goopdateres_lt.dll
   • %Program Files%\GUM5.tmp\goopdateres_lv.dll
   • %Program Files%\GUM5.tmp\goopdateres_ml.dll
   • %Program Files%\GUM5.tmp\goopdateres_mr.dll
   • %Program Files%\GUM5.tmp\goopdateres_ms.dll
   • %Program Files%\GUM5.tmp\goopdateres_nl.dll
   • %Program Files%\GUM5.tmp\goopdateres_no.dll
   • %Program Files%\GUM5.tmp\goopdateres_pl.dll
   • %Program Files%\GUM5.tmp\goopdateres_pt-BR.dll
   • %Program Files%\GUM5.tmp\goopdateres_pt-PT.dll
   • %Program Files%\GUM5.tmp\goopdateres_ro.dll
   • %Program Files%\GUM5.tmp\goopdateres_ru.dll
   • %Program Files%\GUM5.tmp\goopdateres_sk.dll
   • %Program Files%\GUM5.tmp\goopdateres_sl.dll
   • %Program Files%\GUM5.tmp\goopdateres_sr.dll
   • %Program Files%\GUM5.tmp\goopdateres_sv.dll
   • %Program Files%\GUM5.tmp\goopdateres_sw.dll
   • %Program Files%\GUM5.tmp\goopdateres_ta.dll
   • %Program Files%\GUM5.tmp\goopdateres_te.dll
   • %Program Files%\GUM5.tmp\goopdateres_th.dll
   • %Program Files%\GUM5.tmp\goopdateres_tr.dll
   • %Program Files%\GUM5.tmp\goopdateres_uk.dll
   • %Program Files%\GUM5.tmp\goopdateres_ur.dll
   • %Program Files%\GUM5.tmp\goopdateres_vi.dll
   • %Program Files%\GUM5.tmp\goopdateres_zh-CN.dll
   • %Program Files%\GUM5.tmp\goopdateres_zh-TW.dll
   • %Windows%\Tasks\GoogleUpdateTaskMachineCore.job
   • %Windows%\Tasks\GoogleUpdateTaskMachineUA.job
   • %User Profile%\MetaData\2BF68F4714092295550497DD56F57004
   • %User Profile%\Content\2BF68F4714092295550497DD56F57004
   • %User Profile%\MetaData\94308059B57B3142E455B38A6EB92015
   • %User Profile%\Content\94308059B57B3142E455B38A6EB92015
   • %User Temp%\CabA6.tmp
   • %User Temp%\TarA8.tmp
   • %User Profile%\MetaData\008C56320A656ABF9A43EEC6337A4C52
   • %User Profile%\Content\008C56320A656ABF9A43EEC6337A4C52
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: The file name input box title varies depending on the Windows version (e.g. Search for files or folders named or All or part of the file name.).

• For Windows Vista, Windows 7, Windows Server 2008, Windows 8, Windows 8.1, and Windows Server 2012:

1. Open a Windows Explorer window.
   • For Windows Vista, 7, and Server 2008 users, click Start>Computer.
   • For Windows 8, 8.1, and Server 2012 users, right-click on the lower left corner of the screen,then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • __tmp_rar_sfx_access_check_52546
   • ChromeSetup.exe
   • KB153400.exe
   • %Program Files%\GUM5.tmp\GoogleUpdate.exe
   • %Program Files%\GUM5.tmp\GoogleCrashHandler.exe
   • %Program Files%\GUM5.tmp\goopdate.dll
   • %Program Files%\GUM5.tmp\npGoogleUpdate3.dll
   • %Program Files%\GUM5.tmp\GoogleUpdateHelper.msi
   • %Program Files%\GUM5.tmp\GoogleUpdateBroker.exe
   • %Program Files%\GUM5.tmp\GoogleUpdateOnDemand.exe
   • %Program Files%\GUM5.tmp\GoogleUpdateComRegisterShell64.exe
   • %Program Files%\GUM5.tmp\GoogleUpdateWebPlugin.exe
   • %Program Files%\GUM5.tmp\psmachine.dll
   • %Program Files%\GUM5.tmp\psmachine_64.dll
   • %Program Files%\GUM5.tmp\psuser.dll
   • %Program Files%\GUM5.tmp\psuser_64.dll
   • %Program Files%\GUM5.tmp\GoogleCrashHandler64.exe
   • %Program Files%\GUM5.tmp\goopdateres_am.dll
   • %Program Files%\GUM5.tmp\goopdateres_ar.dll
   • %Program Files%\GUM5.tmp\goopdateres_bg.dll
   • %Program Files%\GUM5.tmp\goopdateres_bn.dll
   • %Program Files%\GUM5.tmp\goopdateres_ca.dll
   • %Program Files%\GUM5.tmp\goopdateres_cs.dll
   • %Program Files%\GUM5.tmp\goopdateres_da.dll
   • %Program Files%\GUM5.tmp\goopdateres_de.dll
   • %Program Files%\GUM5.tmp\goopdateres_el.dll
   • %Program Files%\GUM5.tmp\goopdateres_en.dll
   • %Program Files%\GUM5.tmp\goopdateres_en-GB.dll
   • %Program Files%\GUM5.tmp\goopdateres_es.dll
   • %Program Files%\GUM5.tmp\goopdateres_es-419.dll
   • %Program Files%\GUM5.tmp\goopdateres_et.dll
   • %Program Files%\GUM5.tmp\goopdateres_fa.dll
   • %Program Files%\GUM5.tmp\goopdateres_fi.dll
   • %Program Files%\GUM5.tmp\goopdateres_fil.dll
   • %Program Files%\GUM5.tmp\goopdateres_fr.dll
   • %Program Files%\GUM5.tmp\goopdateres_gu.dll
   • %Program Files%\GUM5.tmp\goopdateres_hi.dll
   • %Program Files%\GUM5.tmp\goopdateres_hr.dll
   • %Program Files%\GUM5.tmp\goopdateres_hu.dll
   • %Program Files%\GUM5.tmp\goopdateres_id.dll
   • %Program Files%\GUM5.tmp\goopdateres_is.dll
   • %Program Files%\GUM5.tmp\goopdateres_it.dll
   • %Program Files%\GUM5.tmp\goopdateres_iw.dll
   • %Program Files%\GUM5.tmp\goopdateres_ja.dll
   • %Program Files%\GUM5.tmp\goopdateres_kn.dll
   • %Program Files%\GUM5.tmp\goopdateres_ko.dll
   • %Program Files%\GUM5.tmp\goopdateres_lt.dll
   • %Program Files%\GUM5.tmp\goopdateres_lv.dll
   • %Program Files%\GUM5.tmp\goopdateres_ml.dll
   • %Program Files%\GUM5.tmp\goopdateres_mr.dll
   • %Program Files%\GUM5.tmp\goopdateres_ms.dll
   • %Program Files%\GUM5.tmp\goopdateres_nl.dll
   • %Program Files%\GUM5.tmp\goopdateres_no.dll
   • %Program Files%\GUM5.tmp\goopdateres_pl.dll
   • %Program Files%\GUM5.tmp\goopdateres_pt-BR.dll
   • %Program Files%\GUM5.tmp\goopdateres_pt-PT.dll
   • %Program Files%\GUM5.tmp\goopdateres_ro.dll
   • %Program Files%\GUM5.tmp\goopdateres_ru.dll
   • %Program Files%\GUM5.tmp\goopdateres_sk.dll
   • %Program Files%\GUM5.tmp\goopdateres_sl.dll
   • %Program Files%\GUM5.tmp\goopdateres_sr.dll
   • %Program Files%\GUM5.tmp\goopdateres_sv.dll
   • %Program Files%\GUM5.tmp\goopdateres_sw.dll
   • %Program Files%\GUM5.tmp\goopdateres_ta.dll
   • %Program Files%\GUM5.tmp\goopdateres_te.dll
   • %Program Files%\GUM5.tmp\goopdateres_th.dll
   • %Program Files%\GUM5.tmp\goopdateres_tr.dll
   • %Program Files%\GUM5.tmp\goopdateres_uk.dll
   • %Program Files%\GUM5.tmp\goopdateres_ur.dll
   • %Program Files%\GUM5.tmp\goopdateres_vi.dll
   • %Program Files%\GUM5.tmp\goopdateres_zh-CN.dll
   • %Program Files%\GUM5.tmp\goopdateres_zh-TW.dll
   • %Windows%\Tasks\GoogleUpdateTaskMachineCore.job
   • %Windows%\Tasks\GoogleUpdateTaskMachineUA.job
   • %User Profile%\MetaData\2BF68F4714092295550497DD56F57004
   • %User Profile%\Content\2BF68F4714092295550497DD56F57004
   • %User Profile%\MetaData\94308059B57B3142E455B38A6EB92015
   • %User Profile%\Content\94308059B57B3142E455B38A6EB92015
   • %User Temp%\CabA6.tmp
   • %User Temp%\TarA8.tmp
   • %User Profile%\MetaData\008C56320A656ABF9A43EEC6337A4C52
   • %User Profile%\Content\008C56320A656ABF9A43EEC6337A4C52
3. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the File name* input box, type:
   
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\Wilbert
   • %User Profile%\LOCALS~1
   • %User Temp%\RarSFX0
   • %Program Files%\GUM5.tmp
   • %Program Files%\Google
   • %Program Files%\Google\CrashReports
   • %Program Files%\Google\Update
   • %Program Files%\Google\Update\1.3.29.5
   • %User Profile%\CryptnetUrlCache\MetaData
   • %User Profile%\Microsoft\CryptnetUrlCache
   • %User Profile%\CryptnetUrlCache\Content
   • %Program Files%\Google\Update\Download
   • %Program Files%\Google\Update\Install
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\Wilbert
   • %User Profile%\LOCALS~1
   • %User Temp%\RarSFX0
   • %Program Files%\GUM5.tmp
   • %Program Files%\Google
   • %Program Files%\Google\CrashReports
   • %Program Files%\Google\Update
   • %Program Files%\Google\Update\1.3.29.5
   • %User Profile%\CryptnetUrlCache\MetaData
   • %User Profile%\Microsoft\CryptnetUrlCache
   • %User Profile%\CryptnetUrlCache\Content
   • %Program Files%\Google\Update\Download
   • %Program Files%\Google\Update\Install
   *Note: The file name input box title varies depending on the Windows version (e.g. Search for files or folders named or All or part of the file name.).

For Windows Vista, Windows 7, Windows Server 2008, Windows 8, Windows 8.1, and Windows Server 2012:

1. Open a Windows Explorer window.
   • For Windows Vista, 7, and Server 2008 users, click Start>Computer.
   • For Windows 8, 8.1, and Server 2012 users, right-click on the lower left corner of the screen, then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\Wilbert
   • %User Profile%\LOCALS~1
   • %User Temp%\RarSFX0
   • %Program Files%\GUM5.tmp
   • %Program Files%\Google
   • %Program Files%\Google\CrashReports
   • %Program Files%\Google\Update
   • %Program Files%\Google\Update\1.3.29.5
   • %User Profile%\CryptnetUrlCache\MetaData
   • %User Profile%\Microsoft\CryptnetUrlCache
   • %User Profile%\CryptnetUrlCache\Content
   • %Program Files%\Google\Update\Download
   • %Program Files%\Google\Update\Install
3. Once located, select the file then press SHIFT+DELETE to permanently delete the folder.
4. Repeat steps 2-3 for the remaining folders:
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\Wilbert
   • %User Profile%\LOCALS~1
   • %User Temp%\RarSFX0
   • %Program Files%\GUM5.tmp
   • %Program Files%\Google
   • %Program Files%\Google\CrashReports
   • %Program Files%\Google\Update
   • %Program Files%\Google\Update\1.3.29.5
   • %User Profile%\CryptnetUrlCache\MetaData
   • %User Profile%\Microsoft\CryptnetUrlCache
   • %User Profile%\CryptnetUrlCache\Content
   • %Program Files%\Google\Update\Download
   • %Program Files%\Google\Update\Install
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.