TROJ_SWISYN.RU

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBScript
3. Still in the left panel, locate and delete the key:
   OLEScript
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBS
5. Still in the left panel, locate and delete the key:
   OLEScript
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B54F3741-5B07-11cf-A4B0-00AA004A55E8}
7. Still in the left panel, locate and delete the key:
   OLEScript
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBScript Author
9. Still in the left panel, locate and delete the key:
   OLEScript
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBS Author
11. Still in the left panel, locate and delete the key:
    OLEScript
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B54F3742-5B07-11cf-A4B0-00AA004A55E8}
13. Still in the left panel, locate and delete the key:
    OLEScript
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBScript.Encode
15. Still in the left panel, locate and delete the key:
    OLEScript
16. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B54F3743-5B07-11cf-A4B0-00AA004A55E8}
17. Still in the left panel, locate and delete the key:
    OLEScript
18. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBScript.RegExp
19. Still in the left panel, locate and delete the key:
    OLEScript
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{3F4DACA4-160D-11D2-A8E9-00104B365C9F}
21. Still in the left panel, locate and delete the key:
    OLEScript
22. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>International
23. Still in the left panel, locate and delete the key:
    CpMRU
24. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CLASSES_ROOT
3. In the right panel, locate and delete the entry:
   VBScript = "VB Script Language"
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBScript
5. In the right panel, locate and delete the entry:
   CLSID = "{B54F3741-5B07-11cf-A4B0-00AA004A55E8}"
6. Again In the right panel, locate and delete the entry:
   VBS = "VB Script Language"
7. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBS
8. In the right panel, locate and delete the entry:
   CLSID = "{B54F3741-5B07-11cf-A4B0-00AA004A55E8}"
9. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
10. In the right panel, locate and delete the entry:
    {B54F3741-5B07-11cf-A4B0-00AA004A55E8} = "VB Script Language"
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B54F3741-5B07-11cf-A4B0-00AA004A55E8}
12. In the right panel, locate and delete the entry:
    ProgID = "VBScript"
13. Again In the right panel, locate and delete the entry:
    InprocServer32 = "%System%\VBScript.dll"
14. Again In the right panel, locate and delete the entry:
    VBScript Author = "VB Script Language Authoring"
15. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBScript Author
16. In the right panel, locate and delete the entry:
    CLSID = "{B54F3742-5B07-11cf-A4B0-00AA004A55E8}"
17. Again In the right panel, locate and delete the entry:
    VBS Author = "VB Script Language Authoring"
18. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBS Author
19. In the right panel, locate and delete the entry:
    CLSID = "{B54F3742-5B07-11cf-A4B0-00AA004A55E8}"
20. Again In the right panel, locate and delete the entry:
    {B54F3742-5B07-11cf-A4B0-00AA004A55E8} = "VB Script Language Authoring"
21. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B54F3742-5B07-11cf-A4B0-00AA004A55E8}
22. In the right panel, locate and delete the entry:
    ProgID = "VBScript Author"
23. Again In the right panel, locate and delete the entry:
    InprocServer32 = "%System%\VBScript.dll"
24. Again In the right panel, locate and delete the entry:
    VBScript.Encode = "VBScript Language Encoding"
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBScript.Encode
26. In the right panel, locate and delete the entry:
    CLSID = "{B54F3743-5B07-11cf-A4B0-00AA004A55E8}"
27. Again In the right panel, locate and delete the entry:
    {B54F3743-5B07-11cf-A4B0-00AA004A55E8} = "VBScript Language Encoding"
28. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B54F3743-5B07-11cf-A4B0-00AA004A55E8}
29. In the right panel, locate and delete the entry:
    ProgID = "VBScript.Encode"
30. Again In the right panel, locate and delete the entry:
    InprocServer32 = "%System%\VBScript.dll"
31. Again In the right panel, locate and delete the entry:
    VBScript.RegExp = "VBScript Regular Expression"
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBScript.RegExp
33. In the right panel, locate and delete the entry:
    CLSID = "{3F4DACA4-160D-11D2-A8E9-00104B365C9F}"
34. Again In the right panel, locate and delete the entry:
    {3F4DACA4-160D-11D2-A8E9-00104B365C9F} = "VBScript Regular Expression"
35. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{3F4DACA4-160D-11D2-A8E9-00104B365C9F}
36. In the right panel, locate and delete the entry:
    ProgID = "VBScript.RegExp"
37. Again In the right panel, locate and delete the entry:
    InprocServer32 = "%System%\VBScript.dll"
38. Again In the right panel, locate and delete the entry:
    QMDispatch.QMVBSRoutine = "QMDispatch.QMVBSRoutine"
39. Again In the right panel, locate and delete the entry:
    CLSID\{241D7F03-9232-4024-8373-149860BE27C0} = "QMDispatch.QMVBSRoutine"
40. Again In the right panel, locate and delete the entry:
    QMDispatch.QMVBSRoutine\CLSID = "{241D7F03-9232-4024-8373-149860BE27C0}"
41. Again In the right panel, locate and delete the entry:
    CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\ProgID = "QMDispatch.QMVBSRoutine"
42. Again In the right panel, locate and delete the entry:
    CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\InProcServer32 = "%User Profile%\qmacro\qdisp.dll"
43. Again In the right panel, locate and delete the entry:
    QMDispatch.QMRoutine = "QMDispatch.QMRoutine"
44. Again In the right panel, locate and delete the entry:
    CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049} = "QMDispatch.QMRoutine"
45. Again In the right panel, locate and delete the entry:
    QMDispatch.QMRoutine\CLSID = "{C07DB6A3-34FC-4084-BE2E-76BB9203B049}"
46. Again In the right panel, locate and delete the entry:
    CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\ProgID = "QMDispatch.QMRoutine"
47. Again In the right panel, locate and delete the entry:
    CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\InProcServer32 = "%User Profile%\qmacro\qdisp.dll"
48. Again In the right panel, locate and delete the entry:
    QMDispatch.QMLibrary = "QMDispatch.QMLibrary"
49. Again In the right panel, locate and delete the entry:
    CLSID\{EBEB87A6-E151-4054-AB45-A6E094C5334B} = "QMDispatch.QMLibrary"
50. Again In the right panel, locate and delete the entry:
    QMDispatch.QMLibrary\CLSID = "{EBEB87A6-E151-4054-AB45-A6E094C5334B}"
51. Again In the right panel, locate and delete the entry:
    CLSID\{EBEB87A6-E151-4054-AB45-A6E094C5334B}\ProgID = "QMDispatch.QMLibrary"
52. Again In the right panel, locate and delete the entry:
    CLSID\{EBEB87A6-E151-4054-AB45-A6E094C5334B}\InProcServer32 = "%User Profile%\qmacro\qdisp.dll"
53. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{EBEB87A6-E151-4054-AB45-A6E094C5334B}>InProcServer32
54. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
55. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{C07DB6A3-34FC-4084-BE2E-76BB9203B049}>InProcServer32
56. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
57. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{241D7F03-9232-4024-8373-149860BE27C0}>InProcServer32
58. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
59. Again In the right panel, locate and delete the entry:
    QMDispatch.QMLibrary.Inner = "QMDispatch.QMLibrary.Inner"
60. Again In the right panel, locate and delete the entry:
    CLSID\{EBEB87A5-E151-4054-AB45-A6E094C5334B} = "QMDispatch.QMLibrary.Inner"
61. Again In the right panel, locate and delete the entry:
    QMDispatch.QMLibrary.Inner\CLSID = "{EBEB87A5-E151-4054-AB45-A6E094C5334B}"
62. Again In the right panel, locate and delete the entry:
    CLSID\{EBEB87A5-E151-4054-AB45-A6E094C5334B}\ProgID = "QMDispatch.QMLibrary.Inner"
63. Again In the right panel, locate and delete the entry:
    CLSID\{EBEB87A5-E151-4054-AB45-A6E094C5334B}\InprocHandler32 = "ole32.dll"
64. Again In the right panel, locate and delete the entry:
    CLSID\{EBEB87A5-E151-4054-AB45-A6E094C5334B}\LocalServer32 = "%System Root%\54A0~1.EXE"
65. Again In the right panel, locate and delete the entry:
    QMDispatch.QMFunction = "QMDispatch.QMFunction"
66. Again In the right panel, locate and delete the entry:
    CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B} = "QMDispatch.QMFunction"
67. Again In the right panel, locate and delete the entry:
    QMDispatch.QMFunction\CLSID = "{EBEB87A4-E151-4054-AB45-A6E094C5334B}"
68. Again In the right panel, locate and delete the entry:
    CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\ProgID = "QMDispatch.QMFunction"
69. Again In the right panel, locate and delete the entry:
    CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\InprocHandler32 = "ole32.dll"
70. Again In the right panel, locate and delete the entry:
    CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\LocalServer32 = "%System Root%\54A0~1.EXE"
71. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>International>CpMRU
72. In the right panel, locate and delete the entry:
    Enable = "1"
73. Again In the right panel, locate and delete the entry:
    Size = "a"
74. Again In the right panel, locate and delete the entry:
    InitHits = "64"
75. Again In the right panel, locate and delete the entry:
    Factor = "14"
76. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>International
77. In the right panel, locate and delete the entry:
    W2KLpk = "1"
78. Again In the right panel, locate and delete the entry:
    W2KLpk = "0"
79. Close Registry Editor.

To restore registry values this malware/grayware modified:

1. Open Registry Editor. To do this:
   
   • On Windows 2000, XP, and Server 2003:
     Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
   • On Windows Vista and 7:
     Click the Start button, type REGEDIT in the Search input field then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{0E59F1D5-1FBE-11D0-8FF2-00A0D10038BC}>InprocServer32
3. In the right panel, locate the registry value:
   ThreadingModel = "Apartment"
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   ThreadingModel = "Apartment"
5. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B54F3741-5B07-11cf-A4B0-00AA004A55E8}>InprocServer32
6. In the right panel, locate the registry value:
   ThreadingModel = "Both"
7. Right-click on the value name and choose Modify. Change the value data of this entry to:
   ThreadingModel = "Both"
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B54F3742-5B07-11cf-A4B0-00AA004A55E8}>InprocServer32
9. In the right panel, locate the registry value:
   ThreadingModel = "Both"
10. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Both"
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B54F3743-5B07-11cf-A4B0-00AA004A55E8}>InprocServer32
12. In the right panel, locate the registry value:
    ThreadingModel = "Both"
13. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Both"
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{3F4DACA4-160D-11D2-A8E9-00104B365C9F}>InprocServer32
15. In the right panel, locate the registry value:
    ThreadingModel = "Apartment"
16. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Apartment"
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{3F4DACA0-160D-11D2-A8E9-00104B365C9F}>TypeLib
18. In the right panel, locate the registry value:
    Version = "1.0"
19. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "5.5"
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{3F4DACA1-160D-11D2-A8E9-00104B365C9F}>TypeLib
21. In the right panel, locate the registry value:
    Version = "1.0"
22. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "5.5"
23. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{3F4DACA2-160D-11D2-A8E9-00104B365C9F}>TypeLib
24. In the right panel, locate the registry value:
    Version = "1.0"
25. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "5.5"
26. Again In the right panel, locate the registry value:
    Version = "5.5"
27. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "5.5"
28. Again In the right panel, locate the registry value:
    Version = "5.5"
29. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "5.5"
30. Again In the right panel, locate the registry value:
    Version = "5.5"
31. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "5.5"
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Active Setup>Installed Components>{4f645220-306d-11d2-995d-00c04f98bbc9}
33. In the right panel, locate the registry value:
    IsInstalled = "1"
34. Right-click on the value name and choose Modify. Change the value data of this entry to:
    IsInstalled = "1"
35. Again In the right panel, locate the registry value:
    Version = "5,6,0,8820"
36. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "5,6,0,8820"
37. Again In the right panel, locate the registry value:
    Locale = "EN"
38. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Locale = "EN"
39. Again In the right panel, locate the registry value:
    ComponentID = "MSVBScript"
40. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ComponentID = "MSVBScript"
41. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %System Root%\svchost.exe
   • %System Root%\×Ô¶¯ÊÕ»õ¸ß¼¶°æ.exe
   • %User Temp%\8.tmp
   • %User Temp%\B.tmp
   • %User Temp%\plugin.zip
   • %System Root%\plugin\MSG.DLL
   • %System Root%\plugin\WINDOW.DLL
   • %System Root%\plugin\FILE.DLL
   • %System Root%\plugin\SYS.DLL
   • %User Temp%\mymacro.zip
   • %User Temp%\ad-mymacro8.xml
   • %User Temp%\adcon\mm\tmpad.xml
   • %User Profile%\qmacro\qdisp.dll
   • %System Root%\cfgdll.dll
   • %User Temp%\2671C.tmp
   • %User Temp%\ad-mymacro8.xml.tmp
   • %System%\SET35.tmp
   • %System%\SET3B.tmp
   • %System%\SET41.tmp
   • %System%\SET47.tmp
   • %System%\SET4D.tmp
   • %System%\SET53.tmp
   • %System%\SET38.tmp
   • %System%\SET3E.tmp
   • %System%\SET44.tmp
   • %System%\SET4A.tmp
   • %System%\SET50.tmp
   • %System%\SET56.tmp
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %System Root%\svchost.exe
   • %System Root%\×Ô¶¯ÊÕ»õ¸ß¼¶°æ.exe
   • %User Temp%\8.tmp
   • %User Temp%\B.tmp
   • %User Temp%\plugin.zip
   • %System Root%\plugin\MSG.DLL
   • %System Root%\plugin\WINDOW.DLL
   • %System Root%\plugin\FILE.DLL
   • %System Root%\plugin\SYS.DLL
   • %User Temp%\mymacro.zip
   • %User Temp%\ad-mymacro8.xml
   • %User Temp%\adcon\mm\tmpad.xml
   • %User Profile%\qmacro\qdisp.dll
   • %System Root%\cfgdll.dll
   • %User Temp%\2671C.tmp
   • %User Temp%\ad-mymacro8.xml.tmp
   • %System%\SET35.tmp
   • %System%\SET3B.tmp
   • %System%\SET41.tmp
   • %System%\SET47.tmp
   • %System%\SET4D.tmp
   • %System%\SET53.tmp
   • %System%\SET38.tmp
   • %System%\SET3E.tmp
   • %System%\SET44.tmp
   • %System%\SET4A.tmp
   • %System%\SET50.tmp
   • %System%\SET56.tmp
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %System Root%\plugin
   • %User Temp%\adcon
   • %User Temp%\adcon\mm
   • %User Profile%\Application Data\qmacro
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %System Root%\plugin
   • %User Temp%\adcon
   • %User Temp%\adcon\mm
   • %User Profile%\Application Data\qmacro