TROJ_STRTPG.SMX

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Main
3. Still in the left panel, locate and delete the key:
   Frist
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>iiifile
5. Still in the left panel, locate and delete the key:
   ScriptEngine
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>anifile
7. Still in the left panel, locate and delete the key:
   ScriptEngine
8. Again Still in the left panel, locate and delete the key:
   shell
9. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>anifile>shell
10. Still in the left panel, locate and delete the key:
    open
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>anifile>shell>open
12. Still in the left panel, locate and delete the key:
    command
13. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>fonfile
14. Still in the left panel, locate and delete the key:
    ScriptEngine
15. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Toolbar>WebBrowser
3. In the right panel, locate and delete the entry:
   ITBar7Layout = {random values}
4. Again In the right panel, locate and delete the entry:
   ITBarLayout = {random values}
5. Close Registry Editor.

To restore registry values this malware/grayware modified:

1. Open Registry Editor. To do this:
   
   • On Windows 2000, XP, and Server 2003:
     Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
   • On Windows Vista and 7:
     Click the Start button, type REGEDIT in the Search input field then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>HTTP
3. In the right panel, locate the registry value:
   EditFlags = 2
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   EditFlags = 2
5. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>https
6. In the right panel, locate the registry value:
   EditFlags = 2
7. Right-click on the value name and choose Modify. Change the value data of this entry to:
   EditFlags = 2
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ftp
9. In the right panel, locate the registry value:
   EditFlags = 2
10. Right-click on the value name and choose Modify. Change the value data of this entry to:
    EditFlags = 2
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>gopher
12. In the right panel, locate the registry value:
    EditFlags = 2
13. Right-click on the value name and choose Modify. Change the value data of this entry to:
    EditFlags = 2
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>InternetShortcut
15. In the right panel, locate the registry value:
    EditFlags = 2
16. Right-click on the value name and choose Modify. Change the value data of this entry to:
    EditFlags = 2
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{FBF23B40-E3F0-101B-8488-00AA003E56F8}>InProcServer32
18. In the right panel, locate the registry value:
    ThreadingModel = "Apartment"
19. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = Apartment
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.htm
21. In the right panel, locate the registry value:
    Content Type = "text/html"
22. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Content Type = text/html
23. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.html
24. In the right panel, locate the registry value:
    Content Type = "text/html"
25. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Content Type = text/html
26. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>InternetShortcut>shell>open
27. In the right panel, locate the registry value:
    CLSID = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"
28. Right-click on the value name and choose Modify. Change the value data of this entry to:
    CLSID = {FBF23B40-E3F0-101B-8488-00AA003E56F8}
29. Close Registry Editor.

To delete malware/grayware/spyware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %Program Files%\Internet Explorer\MUI
   • %Program Files%\Thunder
   • %Program Files%\Thunder\ComDlls\1143
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %Program Files%\Internet Explorer\MUI
   • %Program Files%\Thunder
   • %Program Files%\Thunder\ComDlls\1143

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %User Profile%\mm.ico
   • %User Profile%\game.ico
   • %User Profile%\taobao.ico
   • %User Profile%\movie.ico
   • %System Root%\b.txt
   • %User Temp%\TMP4352$.TMP
   • %User Temp%\RGI1.tmp
   • %Program Files%\Thunder\Update.exe
   • %Windows%\Downloaded Program Files\taobao.ico
   • %Windows%\Downloaded Program Files\game.ico
   • %Windows%\Downloaded Program Files\movie.ico
   • %Windows%\Downloaded Program Files\mm.ico
   • %Windows%\Downloaded Program Files\Update.exe
   • %Desktop%\ÌÔ±¦Íø.iii
   • %Desktop%\ÔÚÏßСÓÎÏ·.ani
   • %Favorites%\×îм«Æ·ÂÌÉ«ºÃµÄµçÓ°¿âÃâ·Ñ.¸ßÇå¸ßËÙ£¡ÌìÌì¸üÐÂ!!.html
   • %Favorites%\Öйú¸£Àû²ÊƱ£¬ÌåÓý²ÊƱµÄͶעÖÐÐÄ.²ÊƱ´óÓ®¼Ò£¡.html
   • %Favorites%\×îÐÂÔÚÏßС˵Ãâ·ÑµÄÔĶÁ.·á¸»ÄÚÈÝËٶȿìµÄС˵վ!.html
   • %Favorites%\ÌÔ±¦Íø - ÌÔ£¡ÎÒϲ»¶.html
   • %Favorites%\45575.comÔÚÏßµÄСÓÎÏ·.×îºÃÍæ×îÐÂ×î¿ì¿á³¬¼¶Ð¡ÓÎÏ·!.html
   • %Favorites%\µ±µ±Íø¡ªÍøÉϹºÎïÖÐÐÄ.html
   • %Favorites%\׿ԽÑÇÂíÑ·ÍøÉϹºÎïͼÊ飬ÊÖ»ú£¬ÊýÂ룬¼Òµç£¬»¯×±Æ·£¬ÖÓ±í£¬Ê×ÊεÈÔÚÏßÏúÊÛ.html
   • %Favorites%\¿´¿´µçÊÓ¾çÔÚÏß´óÈ«,,,×îºÃÂÌÉ«×îиßËÙÃâ·ÑµçÊÓ¾çÍøÕ¾!.html
   • %Favorites%\¼õ·Ê£¡¿ìµ½ÈÃÄã"&"¼â½Ð£¡ºþÄÏÎÀÊÓÍƼö×óÐýÈâ¼î¼õ·Ê!.html
   • %Favorites%\°¬³ÈÍŹº - ¾«Æ·ÍŹºÃ¿Ò»Ìì|¹ºÎï|ÍŹº|´òÕÛ!.html
   • %Favorites%\ÃÀÅ®·áÐØ´óÃؾ÷-20ÌìÄÚѸËÙÔö´ó´ó´ó!.html
   • %Favorites%\°¬³ÈÅ®×°--×îÃÀÀöʱÉеÄÅ®×°Æ·ÅÆ.ÃÀÅ®ÂòÒ£¬Ãëɱ°¬³ÈÅ®×°!!.html
   • %Favorites%\Á´½Ó\ÍøÖ·µ¼º½.html
   • %Favorites%\Á´½Ó\¸£²ÊÌå²Ê.html
   • %Favorites%\Á´½Ó\¡ô ÌÔ ±¦ Íø ¡ô.html
   • %Favorites%\Á´½Ó\ºÃÍæСÓÎÏ·.html
   • %Favorites%\Á´½Ó\µ±µ±Íø.html
   • %Favorites%\Á´½Ó\׿ԽÍø.html
   • %Favorites%\Á´½Ó\¿´µçÊÓ¾ç.html
   • %Favorites%\Á´½Ó\С˵Íø.html
   • %Favorites%\Á´½Ó\µ¥»úÓÎÏ·.html
   • %Favorites%\Á´½Ó\ÍøÂçµçÊÓ.html
   • %Favorites%\Á´½Ó\×î¿ìµçÓ°.html
   • %System Root%\Documents and Settings\Administrator\Start Menu\Programs\Internet Explorer.fon
   • %User Profile%\×ÀÃæ\Internet Explorer.fon
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %User Profile%\mm.ico
   • %User Profile%\game.ico
   • %User Profile%\taobao.ico
   • %User Profile%\movie.ico
   • %System Root%\b.txt
   • %User Temp%\TMP4352$.TMP
   • %User Temp%\RGI1.tmp
   • %Program Files%\Thunder\Update.exe
   • %Windows%\Downloaded Program Files\taobao.ico
   • %Windows%\Downloaded Program Files\game.ico
   • %Windows%\Downloaded Program Files\movie.ico
   • %Windows%\Downloaded Program Files\mm.ico
   • %Windows%\Downloaded Program Files\Update.exe
   • %Desktop%\ÌÔ±¦Íø.iii
   • %Desktop%\ÔÚÏßСÓÎÏ·.ani
   • %Favorites%\×îм«Æ·ÂÌÉ«ºÃµÄµçÓ°¿âÃâ·Ñ.¸ßÇå¸ßËÙ£¡ÌìÌì¸üÐÂ!!.html
   • %Favorites%\Öйú¸£Àû²ÊƱ£¬ÌåÓý²ÊƱµÄͶעÖÐÐÄ.²ÊƱ´óÓ®¼Ò£¡.html
   • %Favorites%\×îÐÂÔÚÏßС˵Ãâ·ÑµÄÔĶÁ.·á¸»ÄÚÈÝËٶȿìµÄС˵վ!.html
   • %Favorites%\ÌÔ±¦Íø - ÌÔ£¡ÎÒϲ»¶.html
   • %Favorites%\45575.comÔÚÏßµÄСÓÎÏ·.×îºÃÍæ×îÐÂ×î¿ì¿á³¬¼¶Ð¡ÓÎÏ·!.html
   • %Favorites%\µ±µ±Íø¡ªÍøÉϹºÎïÖÐÐÄ.html
   • %Favorites%\׿ԽÑÇÂíÑ·ÍøÉϹºÎïͼÊ飬ÊÖ»ú£¬ÊýÂ룬¼Òµç£¬»¯×±Æ·£¬ÖÓ±í£¬Ê×ÊεÈÔÚÏßÏúÊÛ.html
   • %Favorites%\¿´¿´µçÊÓ¾çÔÚÏß´óÈ«,,,×îºÃÂÌÉ«×îиßËÙÃâ·ÑµçÊÓ¾çÍøÕ¾!.html
   • %Favorites%\¼õ·Ê£¡¿ìµ½ÈÃÄã"&"¼â½Ð£¡ºþÄÏÎÀÊÓÍƼö×óÐýÈâ¼î¼õ·Ê!.html
   • %Favorites%\°¬³ÈÍŹº - ¾«Æ·ÍŹºÃ¿Ò»Ìì|¹ºÎï|ÍŹº|´òÕÛ!.html
   • %Favorites%\ÃÀÅ®·áÐØ´óÃؾ÷-20ÌìÄÚѸËÙÔö´ó´ó´ó!.html
   • %Favorites%\°¬³ÈÅ®×°--×îÃÀÀöʱÉеÄÅ®×°Æ·ÅÆ.ÃÀÅ®ÂòÒ£¬Ãëɱ°¬³ÈÅ®×°!!.html
   • %Favorites%\Á´½Ó\ÍøÖ·µ¼º½.html
   • %Favorites%\Á´½Ó\¸£²ÊÌå²Ê.html
   • %Favorites%\Á´½Ó\¡ô ÌÔ ±¦ Íø ¡ô.html
   • %Favorites%\Á´½Ó\ºÃÍæСÓÎÏ·.html
   • %Favorites%\Á´½Ó\µ±µ±Íø.html
   • %Favorites%\Á´½Ó\׿ԽÍø.html
   • %Favorites%\Á´½Ó\¿´µçÊÓ¾ç.html
   • %Favorites%\Á´½Ó\С˵Íø.html
   • %Favorites%\Á´½Ó\µ¥»úÓÎÏ·.html
   • %Favorites%\Á´½Ó\ÍøÂçµçÊÓ.html
   • %Favorites%\Á´½Ó\×î¿ìµçÓ°.html
   • %System Root%\Documents and Settings\Administrator\Start Menu\Programs\Internet Explorer.fon
   • %User Profile%\×ÀÃæ\Internet Explorer.fon
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.