TROJ_BANLOAD.LTO

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Description>Microsoft>Rpc
3. Still in the left panel, locate and delete the key:
   UuidTemporaryData
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
5. Still in the left panel, locate and delete the key:
   {33156ACD-1287-4758-9FE0-EEA1E5A1CCAD}
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{33156ACD-1287-4758-9FE0-EEA1E5A1CCAD}
7. Still in the left panel, locate and delete the key:
   1.0
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{33156ACD-1287-4758-9FE0-EEA1E5A1CCAD}>1.0
9. Still in the left panel, locate and delete the key:
   FLAGS
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{33156ACD-1287-4758-9FE0-EEA1E5A1CCAD}>1.0>0
11. Still in the left panel, locate and delete the key:
    win32
12. Again Still in the left panel, locate and delete the key:
    HELPDIR
13. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
14. Still in the left panel, locate and delete the key:
    {98CB0C5A-F04B-4DFD-8C6E-FF72392354C1}
15. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{98CB0C5A-F04B-4DFD-8C6E-FF72392354C1}
16. Still in the left panel, locate and delete the key:
    ProxyStubClsid
17. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
18. Again Still in the left panel, locate and delete the key:
    TypeLib
19. Again Still in the left panel, locate and delete the key:
    {9E732BA7-CEB4-43AD-9865-CE5F23E57AA6}
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{9E732BA7-CEB4-43AD-9865-CE5F23E57AA6}
21. Still in the left panel, locate and delete the key:
    ProxyStubClsid
22. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
23. Again Still in the left panel, locate and delete the key:
    TypeLib
24. Again Still in the left panel, locate and delete the key:
    {B8358AF1-B45A-47B8-8C89-F06725661A1C}
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B8358AF1-B45A-47B8-8C89-F06725661A1C}
26. Still in the left panel, locate and delete the key:
    ProxyStubClsid
27. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
28. Again Still in the left panel, locate and delete the key:
    TypeLib
29. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID
30. Still in the left panel, locate and delete the key:
    {5A9831BE-1683-41DE-AA2B-0580D8C63665}
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{5A9831BE-1683-41DE-AA2B-0580D8C63665}
32. Still in the left panel, locate and delete the key:
    InprocServer32
33. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT
34. Still in the left panel, locate and delete the key:
    ShieldPO.Class
35. Again Still in the left panel, locate and delete the key:
    {8F2C3851-9FC2-422A-8199-B52D1507BDBB}
36. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{8F2C3851-9FC2-422A-8199-B52D1507BDBB}
37. Still in the left panel, locate and delete the key:
    InprocServer32
38. Again Still in the left panel, locate and delete the key:
    ShieldPO.cJPGU
39. Again Still in the left panel, locate and delete the key:
    {9BC905D4-792F-4D1B-8F15-DE8F8010254E}
40. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{9BC905D4-792F-4D1B-8F15-DE8F8010254E}
41. Still in the left panel, locate and delete the key:
    InprocServer32
42. Again Still in the left panel, locate and delete the key:
    ShieldPO.cIMGU
43. In the left panel, double-click the following:
    HKEY_CURRENT_USER>SOFTWARE>Microsoft>Windows>CurrentVersion>Policies>Ext
44. Still in the left panel, locate and delete the key:
    CLSID
45. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext
46. Still in the left panel, locate and delete the key:
    PreApproved
47. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext>PreApproved
48. Still in the left panel, locate and delete the key:
    {5A9831BE-1683-41DE-AA2B-0580D8C63665}
49. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Description>Microsoft>Rpc>UuidTemporaryData
3. In the right panel, locate and delete the entry:
   NetworkAddress = "{random values}"
4. Again In the right panel, locate and delete the entry:
   NetworkAddressLocal = "0"
5. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{98CB0C5A-F04B-4DFD-8C6E-FF72392354C1}>TypeLib
6. In the right panel, locate and delete the entry:
   Version = "1.0"
7. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{9E732BA7-CEB4-43AD-9865-CE5F23E57AA6}>TypeLib
8. In the right panel, locate and delete the entry:
   Version = "1.0"
9. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B8358AF1-B45A-47B8-8C89-F06725661A1C}>TypeLib
10. In the right panel, locate and delete the entry:
    Version = "1.0"
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{5A9831BE-1683-41DE-AA2B-0580D8C63665}
12. In the right panel, locate and delete the entry:
    ProgID = "ShieldPO.Class"
13. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{5A9831BE-1683-41DE-AA2B-0580D8C63665}>InprocServer32
14. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
15. Again In the right panel, locate and delete the entry:
    TypeLib = "{33156ACD-1287-4758-9FE0-EEA1E5A1CCAD}"
16. Again In the right panel, locate and delete the entry:
    VERSION = "1.0"
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ShieldPO.Class
18. In the right panel, locate and delete the entry:
    Clsid = "{5A9831BE-1683-41DE-AA2B-0580D8C63665}"
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B8358AF1-B45A-47B8-8C89-F06725661A1C}
20. In the right panel, locate and delete the entry:
    ProxyStubClsid = "{00020424-0000-0000-C000-000000000046}"
21. Again In the right panel, locate and delete the entry:
    ProxyStubClsid32 = "{00020424-0000-0000-C000-000000000046}"
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{8F2C3851-9FC2-422A-8199-B52D1507BDBB}
23. In the right panel, locate and delete the entry:
    ProgID = "ShieldPO.cJPGU"
24. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{8F2C3851-9FC2-422A-8199-B52D1507BDBB}>InprocServer32
25. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
26. Again In the right panel, locate and delete the entry:
    TypeLib = "{33156ACD-1287-4758-9FE0-EEA1E5A1CCAD}"
27. Again In the right panel, locate and delete the entry:
    VERSION = "1.0"
28. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ShieldPO.cJPGU
29. In the right panel, locate and delete the entry:
    Clsid = "{8F2C3851-9FC2-422A-8199-B52D1507BDBB}"
30. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{9E732BA7-CEB4-43AD-9865-CE5F23E57AA6}
31. In the right panel, locate and delete the entry:
    ProxyStubClsid = "{00020424-0000-0000-C000-000000000046}"
32. Again In the right panel, locate and delete the entry:
    ProxyStubClsid32 = "{00020424-0000-0000-C000-000000000046}"
33. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{9BC905D4-792F-4D1B-8F15-DE8F8010254E}
34. In the right panel, locate and delete the entry:
    ProgID = "ShieldPO.cIMGU"
35. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{9BC905D4-792F-4D1B-8F15-DE8F8010254E}>InprocServer32
36. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
37. Again In the right panel, locate and delete the entry:
    TypeLib = "{33156ACD-1287-4758-9FE0-EEA1E5A1CCAD}"
38. Again In the right panel, locate and delete the entry:
    VERSION = "1.0"
39. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ShieldPO.cIMGU
40. In the right panel, locate and delete the entry:
    Clsid = "{9BC905D4-792F-4D1B-8F15-DE8F8010254E}"
41. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{98CB0C5A-F04B-4DFD-8C6E-FF72392354C1}
42. In the right panel, locate and delete the entry:
    ProxyStubClsid = "{00020424-0000-0000-C000-000000000046}"
43. Again In the right panel, locate and delete the entry:
    ProxyStubClsid32 = "{00020424-0000-0000-C000-000000000046}"
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Browser Helper Objects>{5A9831BE-1683-41DE-AA2B-0580D8C63665}
45. In the right panel, locate and delete the entry:
    NoExplorer = "1"
46. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Policies>Ext>CLSID
47. In the right panel, locate and delete the entry:
    {5A9831BE-1683-41DE-AA2B-0580D8C63665} = "1"
48. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>policies>system
49. In the right panel, locate and delete the entry:
    EnableLUA = "0"
50. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %User Temp%\~DF3152248.tmp
   • %System%\shldpo2a.dll
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %User Temp%\~DF3152248.tmp
   • %System%\shldpo2a.dll
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.