TROJ_FAKEAV.SCP

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER
3. Still in the left panel, locate and delete the key:
   .exe
4. In the left panel, double-click the following:
   HKEY_CURRENT_USER>.exe
5. Still in the left panel, locate and delete the key:
   DefaultIcon
6. Again Still in the left panel, locate and delete the key:
   shell
7. In the left panel, double-click the following:
   HKEY_CURRENT_USER>.exe>shell
8. Still in the left panel, locate and delete the key:
   open
9. In the left panel, double-click the following:
   HKEY_CURRENT_USER>.exe>shell>open
10. Still in the left panel, locate and delete the key:
    command
11. Again Still in the left panel, locate and delete the key:
    runas
12. In the left panel, double-click the following:
    HKEY_CURRENT_USER>.exe>shell>runas
13. Still in the left panel, locate and delete the key:
    command
14. Again Still in the left panel, locate and delete the key:
    W0
15. In the left panel, double-click the following:
    HKEY_CURRENT_USER>W0
16. Still in the left panel, locate and delete the key:
    DefaultIcon
17. Again Still in the left panel, locate and delete the key:
    shell
18. In the left panel, double-click the following:
    HKEY_CURRENT_USER>W0>shell
19. Still in the left panel, locate and delete the key:
    open
20. In the left panel, double-click the following:
    HKEY_CURRENT_USER>W0>shell>open
21. Still in the left panel, locate and delete the key:
    command
22. Again Still in the left panel, locate and delete the key:
    runas
23. In the left panel, double-click the following:
    HKEY_CURRENT_USER>W0>shell>runas
24. Still in the left panel, locate and delete the key:
    command
25. Again Still in the left panel, locate and delete the key:
    60q
26. In the left panel, double-click the following:
    HKEY_CURRENT_USER>60q
27. Still in the left panel, locate and delete the key:
    DefaultIcon
28. Again Still in the left panel, locate and delete the key:
    shell
29. In the left panel, double-click the following:
    HKEY_CURRENT_USER>60q>shell
30. Still in the left panel, locate and delete the key:
    open
31. In the left panel, double-click the following:
    HKEY_CURRENT_USER>60q>shell>open
32. Still in the left panel, locate and delete the key:
    command
33. Again Still in the left panel, locate and delete the key:
    runas
34. In the left panel, double-click the following:
    HKEY_CURRENT_USER>60q>shell>runas
35. Still in the left panel, locate and delete the key:
    command
36. Again Still in the left panel, locate and delete the key:
    NDU
37. In the left panel, double-click the following:
    HKEY_CURRENT_USER>NDU
38. Still in the left panel, locate and delete the key:
    DefaultIcon
39. Again Still in the left panel, locate and delete the key:
    shell
40. In the left panel, double-click the following:
    HKEY_CURRENT_USER>NDU>shell
41. Still in the left panel, locate and delete the key:
    open
42. In the left panel, double-click the following:
    HKEY_CURRENT_USER>NDU>shell>open
43. Still in the left panel, locate and delete the key:
    command
44. Again Still in the left panel, locate and delete the key:
    runas
45. In the left panel, double-click the following:
    HKEY_CURRENT_USER>NDU>shell>runas
46. Still in the left panel, locate and delete the key:
    command
47. Again Still in the left panel, locate and delete the key:
    g5
48. In the left panel, double-click the following:
    HKEY_CURRENT_USER>g5
49. Still in the left panel, locate and delete the key:
    DefaultIcon
50. Again Still in the left panel, locate and delete the key:
    shell
51. In the left panel, double-click the following:
    HKEY_CURRENT_USER>g5>shell
52. Still in the left panel, locate and delete the key:
    open
53. In the left panel, double-click the following:
    HKEY_CURRENT_USER>g5>shell>open
54. Still in the left panel, locate and delete the key:
    command
55. Again Still in the left panel, locate and delete the key:
    runas
56. In the left panel, double-click the following:
    HKEY_CURRENT_USER>g5>shell>runas
57. Still in the left panel, locate and delete the key:
    command
58. Again Still in the left panel, locate and delete the key:
    qK
59. In the left panel, double-click the following:
    HKEY_CURRENT_USER>qK
60. Still in the left panel, locate and delete the key:
    DefaultIcon
61. Again Still in the left panel, locate and delete the key:
    shell
62. In the left panel, double-click the following:
    HKEY_CURRENT_USER>qK>shell
63. Still in the left panel, locate and delete the key:
    open
64. In the left panel, double-click the following:
    HKEY_CURRENT_USER>qK>shell>open
65. Still in the left panel, locate and delete the key:
    command
66. Again Still in the left panel, locate and delete the key:
    runas
67. In the left panel, double-click the following:
    HKEY_CURRENT_USER>qK>shell>runas
68. Still in the left panel, locate and delete the key:
    command
69. Again Still in the left panel, locate and delete the key:
    j5u
70. In the left panel, double-click the following:
    HKEY_CURRENT_USER>j5u
71. Still in the left panel, locate and delete the key:
    DefaultIcon
72. Again Still in the left panel, locate and delete the key:
    shell
73. In the left panel, double-click the following:
    HKEY_CURRENT_USER>j5u>shell
74. Still in the left panel, locate and delete the key:
    open
75. In the left panel, double-click the following:
    HKEY_CURRENT_USER>j5u>shell>open
76. Still in the left panel, locate and delete the key:
    command
77. Again Still in the left panel, locate and delete the key:
    runas
78. In the left panel, double-click the following:
    HKEY_CURRENT_USER>j5u>shell>runas
79. Still in the left panel, locate and delete the key:
    command
80. Again Still in the left panel, locate and delete the key:
    2S
81. In the left panel, double-click the following:
    HKEY_CURRENT_USER>2S
82. Still in the left panel, locate and delete the key:
    DefaultIcon
83. Again Still in the left panel, locate and delete the key:
    shell
84. In the left panel, double-click the following:
    HKEY_CURRENT_USER>2S>shell
85. Still in the left panel, locate and delete the key:
    open
86. In the left panel, double-click the following:
    HKEY_CURRENT_USER>2S>shell>open
87. Still in the left panel, locate and delete the key:
    command
88. Again Still in the left panel, locate and delete the key:
    runas
89. In the left panel, double-click the following:
    HKEY_CURRENT_USER>2S>shell>runas
90. Still in the left panel, locate and delete the key:
    command
91. Again Still in the left panel, locate and delete the key:
    CH4
92. In the left panel, double-click the following:
    HKEY_CURRENT_USER>CH4
93. Still in the left panel, locate and delete the key:
    DefaultIcon
94. Again Still in the left panel, locate and delete the key:
    shell
95. In the left panel, double-click the following:
    HKEY_CURRENT_USER>CH4>shell
96. Still in the left panel, locate and delete the key:
    open
97. In the left panel, double-click the following:
    HKEY_CURRENT_USER>CH4>shell>open
98. Still in the left panel, locate and delete the key:
    command
99. Again Still in the left panel, locate and delete the key:
    runas
100. In the left panel, double-click the following:
     HKEY_CURRENT_USER>CH4>shell>runas
101. Still in the left panel, locate and delete the key:
     command
102. Again Still in the left panel, locate and delete the key:
     oN
103. In the left panel, double-click the following:
     HKEY_CURRENT_USER>oN
104. Still in the left panel, locate and delete the key:
     DefaultIcon
105. Again Still in the left panel, locate and delete the key:
     shell
106. In the left panel, double-click the following:
     HKEY_CURRENT_USER>oN>shell
107. Still in the left panel, locate and delete the key:
     open
108. In the left panel, double-click the following:
     HKEY_CURRENT_USER>oN>shell>open
109. Still in the left panel, locate and delete the key:
     command
110. Again Still in the left panel, locate and delete the key:
     runas
111. In the left panel, double-click the following:
     HKEY_CURRENT_USER>oN>shell>runas
112. Still in the left panel, locate and delete the key:
     command
113. Again Still in the left panel, locate and delete the key:
     o5
114. In the left panel, double-click the following:
     HKEY_CURRENT_USER>o5
115. Still in the left panel, locate and delete the key:
     DefaultIcon
116. Again Still in the left panel, locate and delete the key:
     shell
117. In the left panel, double-click the following:
     HKEY_CURRENT_USER>o5>shell
118. Still in the left panel, locate and delete the key:
     open
119. In the left panel, double-click the following:
     HKEY_CURRENT_USER>o5>shell>open
120. Still in the left panel, locate and delete the key:
     command
121. Again Still in the left panel, locate and delete the key:
     runas
122. In the left panel, double-click the following:
     HKEY_CURRENT_USER>o5>shell>runas
123. Still in the left panel, locate and delete the key:
     command
124. Again Still in the left panel, locate and delete the key:
     EC3
125. In the left panel, double-click the following:
     HKEY_CURRENT_USER>EC3
126. Still in the left panel, locate and delete the key:
     DefaultIcon
127. Again Still in the left panel, locate and delete the key:
     shell
128. In the left panel, double-click the following:
     HKEY_CURRENT_USER>EC3>shell
129. Still in the left panel, locate and delete the key:
     open
130. In the left panel, double-click the following:
     HKEY_CURRENT_USER>EC3>shell>open
131. Still in the left panel, locate and delete the key:
     command
132. Again Still in the left panel, locate and delete the key:
     runas
133. In the left panel, double-click the following:
     HKEY_CURRENT_USER>EC3>shell>runas
134. Still in the left panel, locate and delete the key:
     command
135. Again Still in the left panel, locate and delete the key:
     U8C
136. In the left panel, double-click the following:
     HKEY_CURRENT_USER>U8C
137. Still in the left panel, locate and delete the key:
     DefaultIcon
138. Again Still in the left panel, locate and delete the key:
     shell
139. In the left panel, double-click the following:
     HKEY_CURRENT_USER>U8C>shell
140. Still in the left panel, locate and delete the key:
     open
141. In the left panel, double-click the following:
     HKEY_CURRENT_USER>U8C>shell>open
142. Still in the left panel, locate and delete the key:
     command
143. Again Still in the left panel, locate and delete the key:
     runas
144. In the left panel, double-click the following:
     HKEY_CURRENT_USER>U8C>shell>runas
145. Still in the left panel, locate and delete the key:
     command
146. Again Still in the left panel, locate and delete the key:
     Uo
147. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Uo
148. Still in the left panel, locate and delete the key:
     DefaultIcon
149. Again Still in the left panel, locate and delete the key:
     shell
150. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Uo>shell
151. Still in the left panel, locate and delete the key:
     open
152. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Uo>shell>open
153. Still in the left panel, locate and delete the key:
     command
154. Again Still in the left panel, locate and delete the key:
     runas
155. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Uo>shell>runas
156. Still in the left panel, locate and delete the key:
     command
157. Again Still in the left panel, locate and delete the key:
     N3
158. In the left panel, double-click the following:
     HKEY_CURRENT_USER>N3
159. Still in the left panel, locate and delete the key:
     DefaultIcon
160. Again Still in the left panel, locate and delete the key:
     shell
161. In the left panel, double-click the following:
     HKEY_CURRENT_USER>N3>shell
162. Still in the left panel, locate and delete the key:
     open
163. In the left panel, double-click the following:
     HKEY_CURRENT_USER>N3>shell>open
164. Still in the left panel, locate and delete the key:
     command
165. Again Still in the left panel, locate and delete the key:
     runas
166. In the left panel, double-click the following:
     HKEY_CURRENT_USER>N3>shell>runas
167. Still in the left panel, locate and delete the key:
     command
168. Again Still in the left panel, locate and delete the key:
     f48
169. In the left panel, double-click the following:
     HKEY_CURRENT_USER>f48
170. Still in the left panel, locate and delete the key:
     DefaultIcon
171. Again Still in the left panel, locate and delete the key:
     shell
172. In the left panel, double-click the following:
     HKEY_CURRENT_USER>f48>shell
173. Still in the left panel, locate and delete the key:
     open
174. In the left panel, double-click the following:
     HKEY_CURRENT_USER>f48>shell>open
175. Still in the left panel, locate and delete the key:
     command
176. Again Still in the left panel, locate and delete the key:
     runas
177. In the left panel, double-click the following:
     HKEY_CURRENT_USER>f48>shell>runas
178. Still in the left panel, locate and delete the key:
     command
179. Again Still in the left panel, locate and delete the key:
     CB
180. In the left panel, double-click the following:
     HKEY_CURRENT_USER>CB
181. Still in the left panel, locate and delete the key:
     DefaultIcon
182. Again Still in the left panel, locate and delete the key:
     shell
183. In the left panel, double-click the following:
     HKEY_CURRENT_USER>CB>shell
184. Still in the left panel, locate and delete the key:
     open
185. In the left panel, double-click the following:
     HKEY_CURRENT_USER>CB>shell>open
186. Still in the left panel, locate and delete the key:
     command
187. Again Still in the left panel, locate and delete the key:
     runas
188. In the left panel, double-click the following:
     HKEY_CURRENT_USER>CB>shell>runas
189. Still in the left panel, locate and delete the key:
     command
190. Again Still in the left panel, locate and delete the key:
     2b
191. In the left panel, double-click the following:
     HKEY_CURRENT_USER>2b
192. Still in the left panel, locate and delete the key:
     DefaultIcon
193. Again Still in the left panel, locate and delete the key:
     shell
194. In the left panel, double-click the following:
     HKEY_CURRENT_USER>2b>shell
195. Still in the left panel, locate and delete the key:
     open
196. In the left panel, double-click the following:
     HKEY_CURRENT_USER>2b>shell>open
197. Still in the left panel, locate and delete the key:
     command
198. Again Still in the left panel, locate and delete the key:
     runas
199. In the left panel, double-click the following:
     HKEY_CURRENT_USER>2b>shell>runas
200. Still in the left panel, locate and delete the key:
     command
201. Again Still in the left panel, locate and delete the key:
     10
202. In the left panel, double-click the following:
     HKEY_CURRENT_USER>10
203. Still in the left panel, locate and delete the key:
     DefaultIcon
204. Again Still in the left panel, locate and delete the key:
     shell
205. In the left panel, double-click the following:
     HKEY_CURRENT_USER>10>shell
206. Still in the left panel, locate and delete the key:
     open
207. In the left panel, double-click the following:
     HKEY_CURRENT_USER>10>shell>open
208. Still in the left panel, locate and delete the key:
     command
209. Again Still in the left panel, locate and delete the key:
     runas
210. In the left panel, double-click the following:
     HKEY_CURRENT_USER>10>shell>runas
211. Still in the left panel, locate and delete the key:
     command
212. Again Still in the left panel, locate and delete the key:
     1RI
213. In the left panel, double-click the following:
     HKEY_CURRENT_USER>1RI
214. Still in the left panel, locate and delete the key:
     DefaultIcon
215. Again Still in the left panel, locate and delete the key:
     shell
216. In the left panel, double-click the following:
     HKEY_CURRENT_USER>1RI>shell
217. Still in the left panel, locate and delete the key:
     open
218. In the left panel, double-click the following:
     HKEY_CURRENT_USER>1RI>shell>open
219. Still in the left panel, locate and delete the key:
     command
220. Again Still in the left panel, locate and delete the key:
     runas
221. In the left panel, double-click the following:
     HKEY_CURRENT_USER>1RI>shell>runas
222. Still in the left panel, locate and delete the key:
     command
223. Again Still in the left panel, locate and delete the key:
     OvP
224. In the left panel, double-click the following:
     HKEY_CURRENT_USER>OvP
225. Still in the left panel, locate and delete the key:
     DefaultIcon
226. Again Still in the left panel, locate and delete the key:
     shell
227. In the left panel, double-click the following:
     HKEY_CURRENT_USER>OvP>shell
228. Still in the left panel, locate and delete the key:
     open
229. In the left panel, double-click the following:
     HKEY_CURRENT_USER>OvP>shell>open
230. Still in the left panel, locate and delete the key:
     command
231. Again Still in the left panel, locate and delete the key:
     runas
232. In the left panel, double-click the following:
     HKEY_CURRENT_USER>OvP>shell>runas
233. Still in the left panel, locate and delete the key:
     command
234. Again Still in the left panel, locate and delete the key:
     FV
235. In the left panel, double-click the following:
     HKEY_CURRENT_USER>FV
236. Still in the left panel, locate and delete the key:
     DefaultIcon
237. Again Still in the left panel, locate and delete the key:
     shell
238. In the left panel, double-click the following:
     HKEY_CURRENT_USER>FV>shell
239. Still in the left panel, locate and delete the key:
     open
240. In the left panel, double-click the following:
     HKEY_CURRENT_USER>FV>shell>open
241. Still in the left panel, locate and delete the key:
     command
242. Again Still in the left panel, locate and delete the key:
     runas
243. In the left panel, double-click the following:
     HKEY_CURRENT_USER>FV>shell>runas
244. Still in the left panel, locate and delete the key:
     command
245. Again Still in the left panel, locate and delete the key:
     36
246. In the left panel, double-click the following:
     HKEY_CURRENT_USER>36
247. Still in the left panel, locate and delete the key:
     DefaultIcon
248. Again Still in the left panel, locate and delete the key:
     shell
249. In the left panel, double-click the following:
     HKEY_CURRENT_USER>36>shell
250. Still in the left panel, locate and delete the key:
     open
251. In the left panel, double-click the following:
     HKEY_CURRENT_USER>36>shell>open
252. Still in the left panel, locate and delete the key:
     command
253. Again Still in the left panel, locate and delete the key:
     runas
254. In the left panel, double-click the following:
     HKEY_CURRENT_USER>36>shell>runas
255. Still in the left panel, locate and delete the key:
     command
256. Again Still in the left panel, locate and delete the key:
     YM
257. In the left panel, double-click the following:
     HKEY_CURRENT_USER>YM
258. Still in the left panel, locate and delete the key:
     DefaultIcon
259. Again Still in the left panel, locate and delete the key:
     shell
260. In the left panel, double-click the following:
     HKEY_CURRENT_USER>YM>shell
261. Still in the left panel, locate and delete the key:
     open
262. In the left panel, double-click the following:
     HKEY_CURRENT_USER>YM>shell>open
263. Still in the left panel, locate and delete the key:
     command
264. Again Still in the left panel, locate and delete the key:
     runas
265. In the left panel, double-click the following:
     HKEY_CURRENT_USER>YM>shell>runas
266. Still in the left panel, locate and delete the key:
     command
267. Again Still in the left panel, locate and delete the key:
     Q5
268. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Q5
269. Still in the left panel, locate and delete the key:
     DefaultIcon
270. Again Still in the left panel, locate and delete the key:
     shell
271. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Q5>shell
272. Still in the left panel, locate and delete the key:
     open
273. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Q5>shell>open
274. Still in the left panel, locate and delete the key:
     command
275. Again Still in the left panel, locate and delete the key:
     runas
276. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Q5>shell>runas
277. Still in the left panel, locate and delete the key:
     command
278. Again Still in the left panel, locate and delete the key:
     Mv5
279. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Mv5
280. Still in the left panel, locate and delete the key:
     DefaultIcon
281. Again Still in the left panel, locate and delete the key:
     shell
282. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Mv5>shell
283. Still in the left panel, locate and delete the key:
     open
284. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Mv5>shell>open
285. Still in the left panel, locate and delete the key:
     command
286. Again Still in the left panel, locate and delete the key:
     runas
287. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Mv5>shell>runas
288. Still in the left panel, locate and delete the key:
     command
289. Again Still in the left panel, locate and delete the key:
     80
290. In the left panel, double-click the following:
     HKEY_CURRENT_USER>80
291. Still in the left panel, locate and delete the key:
     DefaultIcon
292. Again Still in the left panel, locate and delete the key:
     shell
293. In the left panel, double-click the following:
     HKEY_CURRENT_USER>80>shell
294. Still in the left panel, locate and delete the key:
     open
295. In the left panel, double-click the following:
     HKEY_CURRENT_USER>80>shell>open
296. Still in the left panel, locate and delete the key:
     command
297. Again Still in the left panel, locate and delete the key:
     runas
298. In the left panel, double-click the following:
     HKEY_CURRENT_USER>80>shell>runas
299. Still in the left panel, locate and delete the key:
     command
300. Again Still in the left panel, locate and delete the key:
     xS
301. In the left panel, double-click the following:
     HKEY_CURRENT_USER>xS
302. Still in the left panel, locate and delete the key:
     DefaultIcon
303. Again Still in the left panel, locate and delete the key:
     shell
304. In the left panel, double-click the following:
     HKEY_CURRENT_USER>xS>shell
305. Still in the left panel, locate and delete the key:
     open
306. In the left panel, double-click the following:
     HKEY_CURRENT_USER>xS>shell>open
307. Still in the left panel, locate and delete the key:
     command
308. Again Still in the left panel, locate and delete the key:
     runas
309. In the left panel, double-click the following:
     HKEY_CURRENT_USER>xS>shell>runas
310. Still in the left panel, locate and delete the key:
     command
311. Again Still in the left panel, locate and delete the key:
     Y6
312. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Y6
313. Still in the left panel, locate and delete the key:
     DefaultIcon
314. Again Still in the left panel, locate and delete the key:
     shell
315. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Y6>shell
316. Still in the left panel, locate and delete the key:
     open
317. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Y6>shell>open
318. Still in the left panel, locate and delete the key:
     command
319. Again Still in the left panel, locate and delete the key:
     runas
320. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Y6>shell>runas
321. Still in the left panel, locate and delete the key:
     command
322. Again Still in the left panel, locate and delete the key:
     h8
323. In the left panel, double-click the following:
     HKEY_CURRENT_USER>h8
324. Still in the left panel, locate and delete the key:
     DefaultIcon
325. Again Still in the left panel, locate and delete the key:
     shell
326. In the left panel, double-click the following:
     HKEY_CURRENT_USER>h8>shell
327. Still in the left panel, locate and delete the key:
     open
328. In the left panel, double-click the following:
     HKEY_CURRENT_USER>h8>shell>open
329. Still in the left panel, locate and delete the key:
     command
330. Again Still in the left panel, locate and delete the key:
     runas
331. In the left panel, double-click the following:
     HKEY_CURRENT_USER>h8>shell>runas
332. Still in the left panel, locate and delete the key:
     command
333. Again Still in the left panel, locate and delete the key:
     Dc
334. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Dc
335. Still in the left panel, locate and delete the key:
     DefaultIcon
336. Again Still in the left panel, locate and delete the key:
     shell
337. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Dc>shell
338. Still in the left panel, locate and delete the key:
     open
339. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Dc>shell>open
340. Still in the left panel, locate and delete the key:
     command
341. Again Still in the left panel, locate and delete the key:
     runas
342. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Dc>shell>runas
343. Still in the left panel, locate and delete the key:
     command
344. Again Still in the left panel, locate and delete the key:
     L4
345. In the left panel, double-click the following:
     HKEY_CURRENT_USER>L4
346. Still in the left panel, locate and delete the key:
     DefaultIcon
347. Again Still in the left panel, locate and delete the key:
     shell
348. In the left panel, double-click the following:
     HKEY_CURRENT_USER>L4>shell
349. Still in the left panel, locate and delete the key:
     open
350. In the left panel, double-click the following:
     HKEY_CURRENT_USER>L4>shell>open
351. Still in the left panel, locate and delete the key:
     command
352. Again Still in the left panel, locate and delete the key:
     runas
353. In the left panel, double-click the following:
     HKEY_CURRENT_USER>L4>shell>runas
354. Still in the left panel, locate and delete the key:
     command
355. Again Still in the left panel, locate and delete the key:
     I5R
356. In the left panel, double-click the following:
     HKEY_CURRENT_USER>I5R
357. Still in the left panel, locate and delete the key:
     DefaultIcon
358. Again Still in the left panel, locate and delete the key:
     shell
359. In the left panel, double-click the following:
     HKEY_CURRENT_USER>I5R>shell
360. Still in the left panel, locate and delete the key:
     open
361. In the left panel, double-click the following:
     HKEY_CURRENT_USER>I5R>shell>open
362. Still in the left panel, locate and delete the key:
     command
363. Again Still in the left panel, locate and delete the key:
     runas
364. In the left panel, double-click the following:
     HKEY_CURRENT_USER>I5R>shell>runas
365. Still in the left panel, locate and delete the key:
     command
366. Again Still in the left panel, locate and delete the key:
     Tr
367. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Tr
368. Still in the left panel, locate and delete the key:
     DefaultIcon
369. Again Still in the left panel, locate and delete the key:
     shell
370. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Tr>shell
371. Still in the left panel, locate and delete the key:
     open
372. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Tr>shell>open
373. Still in the left panel, locate and delete the key:
     command
374. Again Still in the left panel, locate and delete the key:
     runas
375. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Tr>shell>runas
376. Still in the left panel, locate and delete the key:
     command
377. Again Still in the left panel, locate and delete the key:
     vV
378. In the left panel, double-click the following:
     HKEY_CURRENT_USER>vV
379. Still in the left panel, locate and delete the key:
     DefaultIcon
380. Again Still in the left panel, locate and delete the key:
     shell
381. In the left panel, double-click the following:
     HKEY_CURRENT_USER>vV>shell
382. Still in the left panel, locate and delete the key:
     open
383. In the left panel, double-click the following:
     HKEY_CURRENT_USER>vV>shell>open
384. Still in the left panel, locate and delete the key:
     command
385. Again Still in the left panel, locate and delete the key:
     runas
386. In the left panel, double-click the following:
     HKEY_CURRENT_USER>vV>shell>runas
387. Still in the left panel, locate and delete the key:
     command
388. Again Still in the left panel, locate and delete the key:
     O3
389. In the left panel, double-click the following:
     HKEY_CURRENT_USER>O3
390. Still in the left panel, locate and delete the key:
     DefaultIcon
391. Again Still in the left panel, locate and delete the key:
     shell
392. In the left panel, double-click the following:
     HKEY_CURRENT_USER>O3>shell
393. Still in the left panel, locate and delete the key:
     open
394. In the left panel, double-click the following:
     HKEY_CURRENT_USER>O3>shell>open
395. Still in the left panel, locate and delete the key:
     command
396. Again Still in the left panel, locate and delete the key:
     runas
397. In the left panel, double-click the following:
     HKEY_CURRENT_USER>O3>shell>runas
398. Still in the left panel, locate and delete the key:
     command
399. Again Still in the left panel, locate and delete the key:
     0X0
400. In the left panel, double-click the following:
     HKEY_CURRENT_USER>0X0
401. Still in the left panel, locate and delete the key:
     DefaultIcon
402. Again Still in the left panel, locate and delete the key:
     shell
403. In the left panel, double-click the following:
     HKEY_CURRENT_USER>0X0>shell
404. Still in the left panel, locate and delete the key:
     open
405. In the left panel, double-click the following:
     HKEY_CURRENT_USER>0X0>shell>open
406. Still in the left panel, locate and delete the key:
     command
407. Again Still in the left panel, locate and delete the key:
     runas
408. In the left panel, double-click the following:
     HKEY_CURRENT_USER>0X0>shell>runas
409. Still in the left panel, locate and delete the key:
     command
410. Again Still in the left panel, locate and delete the key:
     E6Y
411. In the left panel, double-click the following:
     HKEY_CURRENT_USER>E6Y
412. Still in the left panel, locate and delete the key:
     DefaultIcon
413. Again Still in the left panel, locate and delete the key:
     shell
414. In the left panel, double-click the following:
     HKEY_CURRENT_USER>E6Y>shell
415. Still in the left panel, locate and delete the key:
     open
416. In the left panel, double-click the following:
     HKEY_CURRENT_USER>E6Y>shell>open
417. Still in the left panel, locate and delete the key:
     command
418. Again Still in the left panel, locate and delete the key:
     runas
419. In the left panel, double-click the following:
     HKEY_CURRENT_USER>E6Y>shell>runas
420. Still in the left panel, locate and delete the key:
     command
421. Again Still in the left panel, locate and delete the key:
     1FW
422. In the left panel, double-click the following:
     HKEY_CURRENT_USER>1FW
423. Still in the left panel, locate and delete the key:
     DefaultIcon
424. Again Still in the left panel, locate and delete the key:
     shell
425. In the left panel, double-click the following:
     HKEY_CURRENT_USER>1FW>shell
426. Still in the left panel, locate and delete the key:
     open
427. In the left panel, double-click the following:
     HKEY_CURRENT_USER>1FW>shell>open
428. Still in the left panel, locate and delete the key:
     command
429. Again Still in the left panel, locate and delete the key:
     runas
430. In the left panel, double-click the following:
     HKEY_CURRENT_USER>1FW>shell>runas
431. Still in the left panel, locate and delete the key:
     command
432. Again Still in the left panel, locate and delete the key:
     75i
433. In the left panel, double-click the following:
     HKEY_CURRENT_USER>75i
434. Still in the left panel, locate and delete the key:
     DefaultIcon
435. Again Still in the left panel, locate and delete the key:
     shell
436. In the left panel, double-click the following:
     HKEY_CURRENT_USER>75i>shell
437. Still in the left panel, locate and delete the key:
     open
438. In the left panel, double-click the following:
     HKEY_CURRENT_USER>75i>shell>open
439. Still in the left panel, locate and delete the key:
     command
440. Again Still in the left panel, locate and delete the key:
     runas
441. In the left panel, double-click the following:
     HKEY_CURRENT_USER>75i>shell>runas
442. Still in the left panel, locate and delete the key:
     command
443. Again Still in the left panel, locate and delete the key:
     SA
444. In the left panel, double-click the following:
     HKEY_CURRENT_USER>SA
445. Still in the left panel, locate and delete the key:
     DefaultIcon
446. Again Still in the left panel, locate and delete the key:
     shell
447. In the left panel, double-click the following:
     HKEY_CURRENT_USER>SA>shell
448. Still in the left panel, locate and delete the key:
     open
449. In the left panel, double-click the following:
     HKEY_CURRENT_USER>SA>shell>open
450. Still in the left panel, locate and delete the key:
     command
451. Again Still in the left panel, locate and delete the key:
     runas
452. In the left panel, double-click the following:
     HKEY_CURRENT_USER>SA>shell>runas
453. Still in the left panel, locate and delete the key:
     command
454. Again Still in the left panel, locate and delete the key:
     5V2
455. In the left panel, double-click the following:
     HKEY_CURRENT_USER>5V2
456. Still in the left panel, locate and delete the key:
     DefaultIcon
457. Again Still in the left panel, locate and delete the key:
     shell
458. In the left panel, double-click the following:
     HKEY_CURRENT_USER>5V2>shell
459. Still in the left panel, locate and delete the key:
     open
460. In the left panel, double-click the following:
     HKEY_CURRENT_USER>5V2>shell>open
461. Still in the left panel, locate and delete the key:
     command
462. Again Still in the left panel, locate and delete the key:
     runas
463. In the left panel, double-click the following:
     HKEY_CURRENT_USER>5V2>shell>runas
464. Still in the left panel, locate and delete the key:
     command
465. Again Still in the left panel, locate and delete the key:
     y30
466. In the left panel, double-click the following:
     HKEY_CURRENT_USER>y30
467. Still in the left panel, locate and delete the key:
     DefaultIcon
468. Again Still in the left panel, locate and delete the key:
     shell
469. In the left panel, double-click the following:
     HKEY_CURRENT_USER>y30>shell
470. Still in the left panel, locate and delete the key:
     open
471. In the left panel, double-click the following:
     HKEY_CURRENT_USER>y30>shell>open
472. Still in the left panel, locate and delete the key:
     command
473. Again Still in the left panel, locate and delete the key:
     runas
474. In the left panel, double-click the following:
     HKEY_CURRENT_USER>y30>shell>runas
475. Still in the left panel, locate and delete the key:
     command
476. Again Still in the left panel, locate and delete the key:
     7kM
477. In the left panel, double-click the following:
     HKEY_CURRENT_USER>7kM
478. Still in the left panel, locate and delete the key:
     DefaultIcon
479. Again Still in the left panel, locate and delete the key:
     shell
480. In the left panel, double-click the following:
     HKEY_CURRENT_USER>7kM>shell
481. Still in the left panel, locate and delete the key:
     open
482. In the left panel, double-click the following:
     HKEY_CURRENT_USER>7kM>shell>open
483. Still in the left panel, locate and delete the key:
     command
484. Again Still in the left panel, locate and delete the key:
     runas
485. In the left panel, double-click the following:
     HKEY_CURRENT_USER>7kM>shell>runas
486. Still in the left panel, locate and delete the key:
     command
487. Again Still in the left panel, locate and delete the key:
     4H
488. In the left panel, double-click the following:
     HKEY_CURRENT_USER>4H
489. Still in the left panel, locate and delete the key:
     DefaultIcon
490. Again Still in the left panel, locate and delete the key:
     shell
491. In the left panel, double-click the following:
     HKEY_CURRENT_USER>4H>shell
492. Still in the left panel, locate and delete the key:
     open
493. In the left panel, double-click the following:
     HKEY_CURRENT_USER>4H>shell>open
494. Still in the left panel, locate and delete the key:
     command
495. Again Still in the left panel, locate and delete the key:
     runas
496. In the left panel, double-click the following:
     HKEY_CURRENT_USER>4H>shell>runas
497. Still in the left panel, locate and delete the key:
     command
498. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>Services>SharedAccess>Parameters>FirewallPolicy>StandardProfile
3. In the right panel, locate and delete the entry:
   EnableFirewall = "0"
4. Again In the right panel, locate and delete the entry:
   DoNotAllowExceptions = "0"
5. Again In the right panel, locate and delete the entry:
   DisableNotifications = "1"
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>Services>SharedAccess>Parameters>FirewallPolicy>DomainProfile
7. In the right panel, locate and delete the entry:
   EnableFirewall = "0"
8. Again In the right panel, locate and delete the entry:
   DoNotAllowExceptions = "0"
9. Again In the right panel, locate and delete the entry:
   DisableNotifications = "1"
10. In the left panel, double-click the following:
    HKEY_CURRENT_USER>.exe
11. In the right panel, locate and delete the entry:
    Content Type = "application/x-msdownload"
12. In the left panel, double-click the following:
    HKEY_CURRENT_USER>.exe>shell>open>command
13. In the right panel, locate and delete the entry:
    IsolatedCommand = "%1 %*"
14. In the left panel, double-click the following:
    HKEY_CURRENT_USER>.exe>shell>runas>command
15. In the right panel, locate and delete the entry:
    IsolatedCommand = "%1 %*"
16. In the left panel, double-click the following:
    HKEY_CURRENT_USER>W0
17. In the right panel, locate and delete the entry:
    Content Type = "application/x-msdownload"
18. In the left panel, double-click the following:
    HKEY_CURRENT_USER>W0>shell>open>command
19. In the right panel, locate and delete the entry:
    IsolatedCommand = "%1 %*"
20. In the left panel, double-click the following:
    HKEY_CURRENT_USER>W0>shell>runas>command
21. In the right panel, locate and delete the entry:
    IsolatedCommand = "%1 %*"
22. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows
23. In the right panel, locate and delete the entry:
    Local = "ab19919"
24. In the left panel, double-click the following:
    HKEY_CURRENT_USER>60q
25. In the right panel, locate and delete the entry:
    Content Type = "application/x-msdownload"
26. In the left panel, double-click the following:
    HKEY_CURRENT_USER>60q>shell>open>command
27. In the right panel, locate and delete the entry:
    IsolatedCommand = "%1 %*"
28. In the left panel, double-click the following:
    HKEY_CURRENT_USER>60q>shell>runas>command
29. In the right panel, locate and delete the entry:
    IsolatedCommand = "%1 %*"
30. In the left panel, double-click the following:
    HKEY_CURRENT_USER>NDU
31. In the right panel, locate and delete the entry:
    Content Type = "application/x-msdownload"
32. In the left panel, double-click the following:
    HKEY_CURRENT_USER>NDU>shell>open>command
33. In the right panel, locate and delete the entry:
    IsolatedCommand = "%1 %*"
34. In the left panel, double-click the following:
    HKEY_CURRENT_USER>NDU>shell>runas>command
35. In the right panel, locate and delete the entry:
    IsolatedCommand = "%1 %*"
36. In the left panel, double-click the following:
    HKEY_CURRENT_USER>g5
37. In the right panel, locate and delete the entry:
    Content Type = "application/x-msdownload"
38. In the left panel, double-click the following:
    HKEY_CURRENT_USER>g5>shell>open>command
39. In the right panel, locate and delete the entry:
    IsolatedCommand = "%1 %*"
40. In the left panel, double-click the following:
    HKEY_CURRENT_USER>g5>shell>runas>command
41. In the right panel, locate and delete the entry:
    IsolatedCommand = "%1 %*"
42. In the left panel, double-click the following:
    HKEY_CURRENT_USER>qK
43. In the right panel, locate and delete the entry:
    Content Type = "application/x-msdownload"
44. In the left panel, double-click the following:
    HKEY_CURRENT_USER>qK>shell>open>command
45. In the right panel, locate and delete the entry:
    IsolatedCommand = "%1 %*"
46. In the left panel, double-click the following:
    HKEY_CURRENT_USER>qK>shell>runas>command
47. In the right panel, locate and delete the entry:
    IsolatedCommand = "%1 %*"
48. In the left panel, double-click the following:
    HKEY_CURRENT_USER>j5u
49. In the right panel, locate and delete the entry:
    Content Type = "application/x-msdownload"
50. In the left panel, double-click the following:
    HKEY_CURRENT_USER>j5u>shell>open>command
51. In the right panel, locate and delete the entry:
    IsolatedCommand = "%1 %*"
52. In the left panel, double-click the following:
    HKEY_CURRENT_USER>j5u>shell>runas>command
53. In the right panel, locate and delete the entry:
    IsolatedCommand = "%1 %*"
54. In the left panel, double-click the following:
    HKEY_CURRENT_USER>2S
55. In the right panel, locate and delete the entry:
    Content Type = "application/x-msdownload"
56. In the left panel, double-click the following:
    HKEY_CURRENT_USER>2S>shell>open>command
57. In the right panel, locate and delete the entry:
    IsolatedCommand = "%1 %*"
58. In the left panel, double-click the following:
    HKEY_CURRENT_USER>2S>shell>runas>command
59. In the right panel, locate and delete the entry:
    IsolatedCommand = "%1 %*"
60. In the left panel, double-click the following:
    HKEY_CURRENT_USER>CH4
61. In the right panel, locate and delete the entry:
    Content Type = "application/x-msdownload"
62. In the left panel, double-click the following:
    HKEY_CURRENT_USER>CH4>shell>open>command
63. In the right panel, locate and delete the entry:
    IsolatedCommand = "%1 %*"
64. In the left panel, double-click the following:
    HKEY_CURRENT_USER>CH4>shell>runas>command
65. In the right panel, locate and delete the entry:
    IsolatedCommand = "%1 %*"
66. In the left panel, double-click the following:
    HKEY_CURRENT_USER>oN
67. In the right panel, locate and delete the entry:
    Content Type = "application/x-msdownload"
68. In the left panel, double-click the following:
    HKEY_CURRENT_USER>oN>shell>open>command
69. In the right panel, locate and delete the entry:
    IsolatedCommand = "%1 %*"
70. In the left panel, double-click the following:
    HKEY_CURRENT_USER>oN>shell>runas>command
71. In the right panel, locate and delete the entry:
    IsolatedCommand = "%1 %*"
72. In the left panel, double-click the following:
    HKEY_CURRENT_USER>o5
73. In the right panel, locate and delete the entry:
    Content Type = "application/x-msdownload"
74. In the left panel, double-click the following:
    HKEY_CURRENT_USER>o5>shell>open>command
75. In the right panel, locate and delete the entry:
    IsolatedCommand = "%1 %*"
76. In the left panel, double-click the following:
    HKEY_CURRENT_USER>o5>shell>runas>command
77. In the right panel, locate and delete the entry:
    IsolatedCommand = "%1 %*"
78. In the left panel, double-click the following:
    HKEY_CURRENT_USER>EC3
79. In the right panel, locate and delete the entry:
    Content Type = "application/x-msdownload"
80. In the left panel, double-click the following:
    HKEY_CURRENT_USER>EC3>shell>open>command
81. In the right panel, locate and delete the entry:
    IsolatedCommand = "%1 %*"
82. In the left panel, double-click the following:
    HKEY_CURRENT_USER>EC3>shell>runas>command
83. In the right panel, locate and delete the entry:
    IsolatedCommand = "%1 %*"
84. In the left panel, double-click the following:
    HKEY_CURRENT_USER>U8C
85. In the right panel, locate and delete the entry:
    Content Type = "application/x-msdownload"
86. In the left panel, double-click the following:
    HKEY_CURRENT_USER>U8C>shell>open>command
87. In the right panel, locate and delete the entry:
    IsolatedCommand = "%1 %*"
88. In the left panel, double-click the following:
    HKEY_CURRENT_USER>U8C>shell>runas>command
89. In the right panel, locate and delete the entry:
    IsolatedCommand = "%1 %*"
90. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Uo
91. In the right panel, locate and delete the entry:
    Content Type = "application/x-msdownload"
92. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Uo>shell>open>command
93. In the right panel, locate and delete the entry:
    IsolatedCommand = "%1 %*"
94. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Uo>shell>runas>command
95. In the right panel, locate and delete the entry:
    IsolatedCommand = "%1 %*"
96. In the left panel, double-click the following:
    HKEY_CURRENT_USER>N3
97. In the right panel, locate and delete the entry:
    Content Type = "application/x-msdownload"
98. In the left panel, double-click the following:
    HKEY_CURRENT_USER>N3>shell>open>command
99. In the right panel, locate and delete the entry:
    IsolatedCommand = "%1 %*"
100. In the left panel, double-click the following:
     HKEY_CURRENT_USER>N3>shell>runas>command
101. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
102. In the left panel, double-click the following:
     HKEY_CURRENT_USER>f48
103. In the right panel, locate and delete the entry:
     Content Type = "application/x-msdownload"
104. In the left panel, double-click the following:
     HKEY_CURRENT_USER>f48>shell>open>command
105. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
106. In the left panel, double-click the following:
     HKEY_CURRENT_USER>f48>shell>runas>command
107. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
108. In the left panel, double-click the following:
     HKEY_CURRENT_USER>CB
109. In the right panel, locate and delete the entry:
     Content Type = "application/x-msdownload"
110. In the left panel, double-click the following:
     HKEY_CURRENT_USER>CB>shell>open>command
111. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
112. In the left panel, double-click the following:
     HKEY_CURRENT_USER>CB>shell>runas>command
113. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
114. In the left panel, double-click the following:
     HKEY_CURRENT_USER>2b
115. In the right panel, locate and delete the entry:
     Content Type = "application/x-msdownload"
116. In the left panel, double-click the following:
     HKEY_CURRENT_USER>2b>shell>open>command
117. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
118. In the left panel, double-click the following:
     HKEY_CURRENT_USER>2b>shell>runas>command
119. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
120. In the left panel, double-click the following:
     HKEY_CURRENT_USER>10
121. In the right panel, locate and delete the entry:
     Content Type = "application/x-msdownload"
122. In the left panel, double-click the following:
     HKEY_CURRENT_USER>10>shell>open>command
123. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
124. In the left panel, double-click the following:
     HKEY_CURRENT_USER>10>shell>runas>command
125. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
126. In the left panel, double-click the following:
     HKEY_CURRENT_USER>1RI
127. In the right panel, locate and delete the entry:
     Content Type = "application/x-msdownload"
128. In the left panel, double-click the following:
     HKEY_CURRENT_USER>1RI>shell>open>command
129. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
130. In the left panel, double-click the following:
     HKEY_CURRENT_USER>1RI>shell>runas>command
131. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
132. In the left panel, double-click the following:
     HKEY_CURRENT_USER>OvP
133. In the right panel, locate and delete the entry:
     Content Type = "application/x-msdownload"
134. In the left panel, double-click the following:
     HKEY_CURRENT_USER>OvP>shell>open>command
135. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
136. In the left panel, double-click the following:
     HKEY_CURRENT_USER>OvP>shell>runas>command
137. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
138. In the left panel, double-click the following:
     HKEY_CURRENT_USER>FV
139. In the right panel, locate and delete the entry:
     Content Type = "application/x-msdownload"
140. In the left panel, double-click the following:
     HKEY_CURRENT_USER>FV>shell>open>command
141. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
142. In the left panel, double-click the following:
     HKEY_CURRENT_USER>FV>shell>runas>command
143. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
144. In the left panel, double-click the following:
     HKEY_CURRENT_USER>36
145. In the right panel, locate and delete the entry:
     Content Type = "application/x-msdownload"
146. In the left panel, double-click the following:
     HKEY_CURRENT_USER>36>shell>open>command
147. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
148. In the left panel, double-click the following:
     HKEY_CURRENT_USER>36>shell>runas>command
149. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
150. In the left panel, double-click the following:
     HKEY_CURRENT_USER>YM
151. In the right panel, locate and delete the entry:
     Content Type = "application/x-msdownload"
152. In the left panel, double-click the following:
     HKEY_CURRENT_USER>YM>shell>open>command
153. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
154. In the left panel, double-click the following:
     HKEY_CURRENT_USER>YM>shell>runas>command
155. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
156. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Q5
157. In the right panel, locate and delete the entry:
     Content Type = "application/x-msdownload"
158. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Q5>shell>open>command
159. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
160. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Q5>shell>runas>command
161. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
162. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Mv5
163. In the right panel, locate and delete the entry:
     Content Type = "application/x-msdownload"
164. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Mv5>shell>open>command
165. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
166. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Mv5>shell>runas>command
167. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
168. In the left panel, double-click the following:
     HKEY_CURRENT_USER>80
169. In the right panel, locate and delete the entry:
     Content Type = "application/x-msdownload"
170. In the left panel, double-click the following:
     HKEY_CURRENT_USER>80>shell>open>command
171. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
172. In the left panel, double-click the following:
     HKEY_CURRENT_USER>80>shell>runas>command
173. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
174. In the left panel, double-click the following:
     HKEY_CURRENT_USER>xS
175. In the right panel, locate and delete the entry:
     Content Type = "application/x-msdownload"
176. In the left panel, double-click the following:
     HKEY_CURRENT_USER>xS>shell>open>command
177. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
178. In the left panel, double-click the following:
     HKEY_CURRENT_USER>xS>shell>runas>command
179. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
180. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Y6
181. In the right panel, locate and delete the entry:
     Content Type = "application/x-msdownload"
182. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Y6>shell>open>command
183. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
184. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Y6>shell>runas>command
185. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
186. In the left panel, double-click the following:
     HKEY_CURRENT_USER>h8
187. In the right panel, locate and delete the entry:
     Content Type = "application/x-msdownload"
188. In the left panel, double-click the following:
     HKEY_CURRENT_USER>h8>shell>open>command
189. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
190. In the left panel, double-click the following:
     HKEY_CURRENT_USER>h8>shell>runas>command
191. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
192. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Dc
193. In the right panel, locate and delete the entry:
     Content Type = "application/x-msdownload"
194. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Dc>shell>open>command
195. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
196. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Dc>shell>runas>command
197. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
198. In the left panel, double-click the following:
     HKEY_CURRENT_USER>L4
199. In the right panel, locate and delete the entry:
     Content Type = "application/x-msdownload"
200. In the left panel, double-click the following:
     HKEY_CURRENT_USER>L4>shell>open>command
201. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
202. In the left panel, double-click the following:
     HKEY_CURRENT_USER>L4>shell>runas>command
203. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
204. In the left panel, double-click the following:
     HKEY_CURRENT_USER>I5R
205. In the right panel, locate and delete the entry:
     Content Type = "application/x-msdownload"
206. In the left panel, double-click the following:
     HKEY_CURRENT_USER>I5R>shell>open>command
207. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
208. In the left panel, double-click the following:
     HKEY_CURRENT_USER>I5R>shell>runas>command
209. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
210. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Tr
211. In the right panel, locate and delete the entry:
     Content Type = "application/x-msdownload"
212. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Tr>shell>open>command
213. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
214. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Tr>shell>runas>command
215. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
216. In the left panel, double-click the following:
     HKEY_CURRENT_USER>vV
217. In the right panel, locate and delete the entry:
     Content Type = "application/x-msdownload"
218. In the left panel, double-click the following:
     HKEY_CURRENT_USER>vV>shell>open>command
219. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
220. In the left panel, double-click the following:
     HKEY_CURRENT_USER>vV>shell>runas>command
221. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
222. In the left panel, double-click the following:
     HKEY_CURRENT_USER>O3
223. In the right panel, locate and delete the entry:
     Content Type = "application/x-msdownload"
224. In the left panel, double-click the following:
     HKEY_CURRENT_USER>O3>shell>open>command
225. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
226. In the left panel, double-click the following:
     HKEY_CURRENT_USER>O3>shell>runas>command
227. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
228. In the left panel, double-click the following:
     HKEY_CURRENT_USER>0X0
229. In the right panel, locate and delete the entry:
     Content Type = "application/x-msdownload"
230. In the left panel, double-click the following:
     HKEY_CURRENT_USER>0X0>shell>open>command
231. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
232. In the left panel, double-click the following:
     HKEY_CURRENT_USER>0X0>shell>runas>command
233. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
234. In the left panel, double-click the following:
     HKEY_CURRENT_USER>E6Y
235. In the right panel, locate and delete the entry:
     Content Type = "application/x-msdownload"
236. In the left panel, double-click the following:
     HKEY_CURRENT_USER>E6Y>shell>open>command
237. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
238. In the left panel, double-click the following:
     HKEY_CURRENT_USER>E6Y>shell>runas>command
239. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
240. In the left panel, double-click the following:
     HKEY_CURRENT_USER>1FW
241. In the right panel, locate and delete the entry:
     Content Type = "application/x-msdownload"
242. In the left panel, double-click the following:
     HKEY_CURRENT_USER>1FW>shell>open>command
243. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
244. In the left panel, double-click the following:
     HKEY_CURRENT_USER>1FW>shell>runas>command
245. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
246. In the left panel, double-click the following:
     HKEY_CURRENT_USER>75i
247. In the right panel, locate and delete the entry:
     Content Type = "application/x-msdownload"
248. In the left panel, double-click the following:
     HKEY_CURRENT_USER>75i>shell>open>command
249. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
250. In the left panel, double-click the following:
     HKEY_CURRENT_USER>75i>shell>runas>command
251. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
252. In the left panel, double-click the following:
     HKEY_CURRENT_USER>SA
253. In the right panel, locate and delete the entry:
     Content Type = "application/x-msdownload"
254. In the left panel, double-click the following:
     HKEY_CURRENT_USER>SA>shell>open>command
255. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
256. In the left panel, double-click the following:
     HKEY_CURRENT_USER>SA>shell>runas>command
257. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
258. In the left panel, double-click the following:
     HKEY_CURRENT_USER>5V2
259. In the right panel, locate and delete the entry:
     Content Type = "application/x-msdownload"
260. In the left panel, double-click the following:
     HKEY_CURRENT_USER>5V2>shell>open>command
261. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
262. In the left panel, double-click the following:
     HKEY_CURRENT_USER>5V2>shell>runas>command
263. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
264. In the left panel, double-click the following:
     HKEY_CURRENT_USER>y30
265. In the right panel, locate and delete the entry:
     Content Type = "application/x-msdownload"
266. In the left panel, double-click the following:
     HKEY_CURRENT_USER>y30>shell>open>command
267. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
268. In the left panel, double-click the following:
     HKEY_CURRENT_USER>y30>shell>runas>command
269. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
270. In the left panel, double-click the following:
     HKEY_CURRENT_USER>7kM
271. In the right panel, locate and delete the entry:
     Content Type = "application/x-msdownload"
272. In the left panel, double-click the following:
     HKEY_CURRENT_USER>7kM>shell>open>command
273. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
274. In the left panel, double-click the following:
     HKEY_CURRENT_USER>7kM>shell>runas>command
275. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
276. In the left panel, double-click the following:
     HKEY_CURRENT_USER>4H
277. In the right panel, locate and delete the entry:
     Content Type = "application/x-msdownload"
278. In the left panel, double-click the following:
     HKEY_CURRENT_USER>4H>shell>open>command
279. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
280. In the left panel, double-click the following:
     HKEY_CURRENT_USER>4H>shell>runas>command
281. In the right panel, locate and delete the entry:
     IsolatedCommand = "%1 %*"
282. Close Registry Editor.

To restore registry values this malware/grayware modified:

1. Open Registry Editor. To do this:
   
   • On Windows 2000, XP, and Server 2003:
     Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
   • On Windows Vista and 7:
     Click the Start button, type REGEDIT in the Search input field then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>Services>SharedAccess
3. In the right panel, locate the registry value:
   Start = "4"
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   Start = "2"
5. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Security Center
6. In the right panel, locate the registry value:
   AntiVirusDisableNotify = "1"
7. Again In the right panel, locate the registry value:
   AntiVirusOverride = "1"
8. Again In the right panel, locate the registry value:
   FirewallDisableNotify = "1"
9. Again In the right panel, locate the registry value:
   FirewallOverride = "1"
10. Again In the right panel, locate the registry value:
    UpdatesDisableNotify = "1"
11. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>GDIPlus
12. In the right panel, locate the registry value:
    FontCachePath = "%Application Data%"
13. Right-click on the value name and choose Modify. Change the value data of this entry to:
    FontCachePath = "%User Profile%\Local Settings\Application Data"
14. Close Registry Editor.

To manually delete a malware/grayware file from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the left panel, click All Files.
3. In the Named input box, type the following:
   
   • %Application Data%\bnt.exe
4. In the Look In drop-down list, select My Computer then press Enter.
5. Once located, select the file then press SHIFT+DELETE to delete it.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type the following:
   
   • %Application Data%\bnt.exe
3. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.