HT_STARTPAGE_CD100271.RDXN

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE
3. Still in the left panel, locate and delete the key:
   opensearchcc
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall
5. Still in the left panel, locate and delete the key:
   opensearch
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
7. Still in the left panel, locate and delete the key:
   {EBECD5A2-BE00-4687-BB3A-68865610C395}
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{EBECD5A2-BE00-4687-BB3A-68865610C395}
9. Still in the left panel, locate and delete the key:
   5.0
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{EBECD5A2-BE00-4687-BB3A-68865610C395}>5.0
11. Still in the left panel, locate and delete the key:
    FLAGS
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{EBECD5A2-BE00-4687-BB3A-68865610C395}>5.0>0
13. Still in the left panel, locate and delete the key:
    win32
14. Again Still in the left panel, locate and delete the key:
    HELPDIR
15. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
16. Still in the left panel, locate and delete the key:
    {294C25FD-10CB-4C55-BC3D-E50F5AFFD082}
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{294C25FD-10CB-4C55-BC3D-E50F5AFFD082}
18. Still in the left panel, locate and delete the key:
    ProxyStubClsid
19. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
20. Again Still in the left panel, locate and delete the key:
    TypeLib
21. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID
22. Still in the left panel, locate and delete the key:
    {EBE18DC5-B307-4222-8B1C-0CDA230161CD}
23. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{EBE18DC5-B307-4222-8B1C-0CDA230161CD}
24. Still in the left panel, locate and delete the key:
    InprocServer32
25. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT
26. Still in the left panel, locate and delete the key:
    opensearchccprg.opensearchcc
27. Again Still in the left panel, locate and delete the key:
    {2429B1A4-E714-46EA-8B1A-73D074E0D7EE}
28. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{2429B1A4-E714-46EA-8B1A-73D074E0D7EE}
29. Still in the left panel, locate and delete the key:
    3.0
30. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{2429B1A4-E714-46EA-8B1A-73D074E0D7EE}>3.0
31. Still in the left panel, locate and delete the key:
    FLAGS
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{2429B1A4-E714-46EA-8B1A-73D074E0D7EE}>3.0>0
33. Still in the left panel, locate and delete the key:
    win32
34. Again Still in the left panel, locate and delete the key:
    HELPDIR
35. Again Still in the left panel, locate and delete the key:
    {B015539C-A6F0-4A64-8E4E-54831106AAB8}
36. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B015539C-A6F0-4A64-8E4E-54831106AAB8}
37. Still in the left panel, locate and delete the key:
    ProxyStubClsid
38. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
39. Again Still in the left panel, locate and delete the key:
    TypeLib
40. Again Still in the left panel, locate and delete the key:
    {32010362-377D-4EE2-A7E8-76E9834E97CD}
41. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{32010362-377D-4EE2-A7E8-76E9834E97CD}
42. Still in the left panel, locate and delete the key:
    InprocServer32
43. Again Still in the left panel, locate and delete the key:
    opensearchcvcfg.opensearchcv
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{48E59293-9880-11CF-9754-00AA00C00908}
45. Still in the left panel, locate and delete the key:
    Control
46. Again Still in the left panel, locate and delete the key:
    {48E59290-9880-11CF-9754-00AA00C00908}
47. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>opensearchcv
48. Still in the left panel, locate and delete the key:
    tsurl
49. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>opensearchcc
3. In the right panel, locate and delete the entry:
   pid = "opensearch01"
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>opensearch
5. In the right panel, locate and delete the entry:
   DisplayName = "opensearch"
6. Again In the right panel, locate and delete the entry:
   DisplayIcon = "%Program Files%\opensearchcc\Uninstall.exe"
7. Again In the right panel, locate and delete the entry:
   UninstallString = "%Program Files%\opensearchcc\Uninstall.exe"
8. Again In the right panel, locate and delete the entry:
   NoModify = "1"
9. Again In the right panel, locate and delete the entry:
   NoRepair = "1"
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{294C25FD-10CB-4C55-BC3D-E50F5AFFD082}>TypeLib
11. In the right panel, locate and delete the entry:
    Version = "5.0"
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{EBE18DC5-B307-4222-8B1C-0CDA230161CD}
13. In the right panel, locate and delete the entry:
    ProgID = "opensearchccprg.opensearchcc"
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{EBE18DC5-B307-4222-8B1C-0CDA230161CD}>InprocServer32
15. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
16. Again In the right panel, locate and delete the entry:
    TypeLib = "{EBECD5A2-BE00-4687-BB3A-68865610C395}"
17. Again In the right panel, locate and delete the entry:
    VERSION = "5.0"
18. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>opensearchccprg.opensearchcc
19. In the right panel, locate and delete the entry:
    Clsid = "{EBE18DC5-B307-4222-8B1C-0CDA230161CD}"
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{294C25FD-10CB-4C55-BC3D-E50F5AFFD082}
21. In the right panel, locate and delete the entry:
    ProxyStubClsid = "{00020424-0000-0000-C000-000000000046}"
22. Again In the right panel, locate and delete the entry:
    ProxyStubClsid32 = "{00020424-0000-0000-C000-000000000046}"
23. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B015539C-A6F0-4A64-8E4E-54831106AAB8}>TypeLib
24. In the right panel, locate and delete the entry:
    Version = "3.0"
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{32010362-377D-4EE2-A7E8-76E9834E97CD}
26. In the right panel, locate and delete the entry:
    ProgID = "opensearchcvcfg.opensearchcv"
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{32010362-377D-4EE2-A7E8-76E9834E97CD}>InprocServer32
28. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
29. Again In the right panel, locate and delete the entry:
    TypeLib = "{2429B1A4-E714-46EA-8B1A-73D074E0D7EE}"
30. Again In the right panel, locate and delete the entry:
    VERSION = "3.0"
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>opensearchcvcfg.opensearchcv
32. In the right panel, locate and delete the entry:
    Clsid = "{32010362-377D-4EE2-A7E8-76E9834E97CD}"
33. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B015539C-A6F0-4A64-8E4E-54831106AAB8}
34. In the right panel, locate and delete the entry:
    ProxyStubClsid = "{00020424-0000-0000-C000-000000000046}"
35. Again In the right panel, locate and delete the entry:
    ProxyStubClsid32 = "{00020424-0000-0000-C000-000000000046}"
36. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>opensearchcv
37. In the right panel, locate and delete the entry:
    Thnd = "2d"
38. Close Registry Editor.

To restore registry values this malware/grayware modified:

1. Open Registry Editor. To do this:
   
   • On Windows 2000, XP, and Server 2003:
     Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
   • On Windows Vista and 7:
     Click the Start button, type REGEDIT in the Search input field then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{48E59293-9880-11CF-9754-00AA00C00908}>InprocServer32
3. In the right panel, locate the registry value:
   ThreadingModel = "Apartment"
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   ThreadingModel = "Apartment"
5. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{48E59291-9880-11CF-9754-00AA00C00908}>TypeLib
6. In the right panel, locate the registry value:
   Version = "1.0"
7. Right-click on the value name and choose Modify. Change the value data of this entry to:
   Version = "1.0"
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{48E59292-9880-11CF-9754-00AA00C00908}>TypeLib
9. In the right panel, locate the registry value:
   Version = "1.0"
10. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "1.0"
11. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %System%\opensearchccinst.exe
   • %User Temp%\$inst\2.tmp
   • %User Temp%\$inst\temp_0.tmp
   • %Program Files%\opensearchcc\Uninstall.ini
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %System%\opensearchccinst.exe
   • %User Temp%\$inst\2.tmp
   • %User Temp%\$inst\temp_0.tmp
   • %Program Files%\opensearchcc\Uninstall.ini
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %User Temp%\$inst
   • %Program Files%\opensearchcc
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %User Temp%\$inst
   • %Program Files%\opensearchcc