TROJ_BANBRA.WWO

To delete the registry key this malware/grayware created:

1. Open Registry Editor.
   » For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run, type regedit in the text box provided, and then press Enter.
   » For Windows Vista, Windows 7, and Windows Server 2008 users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, and Windows Server 2012 users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Google>Update>ClientState
3. Still in the left panel, locate and delete the key:
   {8A69D345-D564-463C-AFF1-A69D9E530F96}
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Google>Update
5. Still in the left panel, locate and delete the key:
   network
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Google>Update>network
7. Still in the left panel, locate and delete the key:
   secure
8. Again Still in the left panel, locate and delete the key:
   Clients
9. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Google>Update>Clients
10. Still in the left panel, locate and delete the key:
    {430FD4D0-B729-4F61-AA34-91526481799D}
11. Again Still in the left panel, locate and delete the key:
    {430FD4D0-B729-4F61-AA34-91526481799D}
12. Again Still in the left panel, locate and delete the key:
    ClientStateMedium
13. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options
14. Still in the left panel, locate and delete the key:
    GoogleUpdate.exe
15. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>MozillaPlugins
16. Still in the left panel, locate and delete the key:
    @tools.google.com/Google Update;version = 9
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>MozillaPlugins>@tools.google.com/Google Update;version=9
18. Still in the left panel, locate and delete the key:
    MimeTypes
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>MozillaPlugins>@tools.google.com/Google Update;version=9>MimeTypes
20. Still in the left panel, locate and delete the key:
    application/x-vnd.google.oneclickctrl.9
21. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion
22. Still in the left panel, locate and delete the key:
    Ext
23. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext
24. Still in the left panel, locate and delete the key:
    PreApproved
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext>PreApproved
26. Still in the left panel, locate and delete the key:
    {C442AC41-9200-4770-8CC0-7CDB4F245C55}
27. Again Still in the left panel, locate and delete the key:
    Stats
28. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext>Stats
29. Still in the left panel, locate and delete the key:
    {C442AC41-9200-4770-8CC0-7CDB4F245C55}
30. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext>Stats>{C442AC41-9200-4770-8CC0-7CDB4F245C55}
31. Still in the left panel, locate and delete the key:
    iexplore
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext>Stats>{C442AC41-9200-4770-8CC0-7CDB4F245C55}>iexplore
33. Still in the left panel, locate and delete the key:
    AllowedDomains
34. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext>Stats>{C442AC41-9200-4770-8CC0-7CDB4F245C55}>iexplore>AllowedDomains
35. Still in the left panel, locate and delete the key:
    *
36. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Low Rights>ElevationPolicy
37. Still in the left panel, locate and delete the key:
    {C442AC41-9200-4770-8CC0-7CDB4F245C55}
38. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes
39. Still in the left panel, locate and delete the key:
    Google.OneClickCtrl.9
40. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Google.OneClickCtrl.9
41. Still in the left panel, locate and delete the key:
    CLSID
42. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
43. Still in the left panel, locate and delete the key:
    {C442AC41-9200-4770-8CC0-7CDB4F245C55}
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{C442AC41-9200-4770-8CC0-7CDB4F245C55}
45. Still in the left panel, locate and delete the key:
    ProgID
46. Again Still in the left panel, locate and delete the key:
    InprocServer32
47. Again Still in the left panel, locate and delete the key:
    Implemented Categories
48. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{C442AC41-9200-4770-8CC0-7CDB4F245C55}>Implemented Categories
49. Still in the left panel, locate and delete the key:
    {59FB2056-D625-48D0-A944-1A85B5AB2640}
50. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>MIME>Database>Content Type
51. Still in the left panel, locate and delete the key:
    application/x-vnd.google.oneclickctrl.9
52. Again Still in the left panel, locate and delete the key:
    @tools.google.com/Google Update;version = 3
53. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>MozillaPlugins>@tools.google.com/Google Update;version=3
54. Still in the left panel, locate and delete the key:
    MimeTypes
55. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>MozillaPlugins>@tools.google.com/Google Update;version=3>MimeTypes
56. Still in the left panel, locate and delete the key:
    application/x-vnd.google.update3webcontrol.3
57. Again Still in the left panel, locate and delete the key:
    {C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}
58. Again Still in the left panel, locate and delete the key:
    {C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}
59. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext>Stats>{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}
60. Still in the left panel, locate and delete the key:
    iexplore
61. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext>Stats>{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}>iexplore
62. Still in the left panel, locate and delete the key:
    AllowedDomains
63. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext>Stats>{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}>iexplore>AllowedDomains
64. Still in the left panel, locate and delete the key:
    *
65. Again Still in the left panel, locate and delete the key:
    {C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}
66. Again Still in the left panel, locate and delete the key:
    Google.Update3WebControl.3
67. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Google.Update3WebControl.3
68. Still in the left panel, locate and delete the key:
    CLSID
69. Again Still in the left panel, locate and delete the key:
    {C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}
70. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}
71. Still in the left panel, locate and delete the key:
    ProgID
72. Again Still in the left panel, locate and delete the key:
    InprocServer32
73. Again Still in the left panel, locate and delete the key:
    Implemented Categories
74. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}>Implemented Categories
75. Still in the left panel, locate and delete the key:
    {59FB2056-D625-48D0-A944-1A85B5AB2640}
76. Again Still in the left panel, locate and delete the key:
    application/x-vnd.google.update3webcontrol.3
77. Again Still in the left panel, locate and delete the key:
    uid
78. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID
79. Still in the left panel, locate and delete the key:
    {4EB61BAC-A3B6-4760-9581-655041EF4D69}
80. Again Still in the left panel, locate and delete the key:
    GoogleUpdate.exe
81. Again Still in the left panel, locate and delete the key:
    GoogleUpdate.Update3COMClassService.1.0
82. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.Update3COMClassService.1.0
83. Still in the left panel, locate and delete the key:
    CLSID
84. Again Still in the left panel, locate and delete the key:
    GoogleUpdate.Update3COMClassService
85. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.Update3COMClassService
86. Still in the left panel, locate and delete the key:
    CLSID
87. Again Still in the left panel, locate and delete the key:
    CurVer
88. Again Still in the left panel, locate and delete the key:
    {4EB61BAC-A3B6-4760-9581-655041EF4D69}
89. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{4EB61BAC-A3B6-4760-9581-655041EF4D69}
90. Still in the left panel, locate and delete the key:
    ProgID
91. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
92. Again Still in the left panel, locate and delete the key:
    {9465B4B4-5216-4042-9A2C-754D3BCDC410}
93. Again Still in the left panel, locate and delete the key:
    GoogleUpdate.OnDemandCOMClassSvc.1.0
94. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.OnDemandCOMClassSvc.1.0
95. Still in the left panel, locate and delete the key:
    CLSID
96. Again Still in the left panel, locate and delete the key:
    GoogleUpdate.OnDemandCOMClassSvc
97. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.OnDemandCOMClassSvc
98. Still in the left panel, locate and delete the key:
    CLSID
99. Again Still in the left panel, locate and delete the key:
    CurVer
100. Again Still in the left panel, locate and delete the key:
     {9465B4B4-5216-4042-9A2C-754D3BCDC410}
101. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{9465B4B4-5216-4042-9A2C-754D3BCDC410}
102. Still in the left panel, locate and delete the key:
     ProgID
103. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
104. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.Update3WebSvc.1.0
105. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.Update3WebSvc.1.0
106. Still in the left panel, locate and delete the key:
     CLSID
107. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.Update3WebSvc
108. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.Update3WebSvc
109. Still in the left panel, locate and delete the key:
     CLSID
110. Again Still in the left panel, locate and delete the key:
     CurVer
111. Again Still in the left panel, locate and delete the key:
     {534F5323-3569-4F42-919D-1E1CF93E5BF6}
112. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{534F5323-3569-4F42-919D-1E1CF93E5BF6}
113. Still in the left panel, locate and delete the key:
     ProgID
114. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
115. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.CoreClass.1
116. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.CoreClass.1
117. Still in the left panel, locate and delete the key:
     CLSID
118. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.CoreClass
119. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.CoreClass
120. Still in the left panel, locate and delete the key:
     CLSID
121. Again Still in the left panel, locate and delete the key:
     CurVer
122. Again Still in the left panel, locate and delete the key:
     {E225E692-4B47-4777-9BED-4FD7FE257F0E}
123. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{E225E692-4B47-4777-9BED-4FD7FE257F0E}
124. Still in the left panel, locate and delete the key:
     ProgID
125. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
126. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>Software>Google>Update>UsageStats
127. Still in the left panel, locate and delete the key:
     Daily
128. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Google>Update>UsageStats>Daily
129. Still in the left panel, locate and delete the key:
     Counts
130. Again Still in the left panel, locate and delete the key:
     Integers
131. Again Still in the left panel, locate and delete the key:
     {50AC8ACB-D28F-4082-A1BC-C04054B5A5AC}
132. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{50AC8ACB-D28F-4082-A1BC-C04054B5A5AC}
133. Still in the left panel, locate and delete the key:
     InprocHandler32
134. Again Still in the left panel, locate and delete the key:
     {9D6AA569-9F30-41AD-885A-346685C74928}
135. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{9D6AA569-9F30-41AD-885A-346685C74928}
136. Still in the left panel, locate and delete the key:
     InprocServer32
137. Again Still in the left panel, locate and delete the key:
     {D0CD6E57-FBA5-4F71-98DF-3AAEB8CB8118}
138. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{D0CD6E57-FBA5-4F71-98DF-3AAEB8CB8118}
139. Still in the left panel, locate and delete the key:
     InProcServer32
140. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
141. Still in the left panel, locate and delete the key:
     {2E629606-312A-482F-9B12-2C4ABF6F0B6D}
142. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{2E629606-312A-482F-9B12-2C4ABF6F0B6D}
143. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
144. Again Still in the left panel, locate and delete the key:
     NumMethods
145. Again Still in the left panel, locate and delete the key:
     {31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}
146. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}
147. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
148. Again Still in the left panel, locate and delete the key:
     NumMethods
149. Again Still in the left panel, locate and delete the key:
     {8476CE12-AE1F-4198-805C-BA0F9B783F57}
150. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{8476CE12-AE1F-4198-805C-BA0F9B783F57}
151. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
152. Again Still in the left panel, locate and delete the key:
     NumMethods
153. Again Still in the left panel, locate and delete the key:
     {0CD01D1E-4A1C-489D-93B9-9B6672877C57}
154. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{0CD01D1E-4A1C-489D-93B9-9B6672877C57}
155. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
156. Again Still in the left panel, locate and delete the key:
     NumMethods
157. Again Still in the left panel, locate and delete the key:
     {4E223325-C16B-4EEB-AEDC-19AA99A237FA}
158. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{4E223325-C16B-4EEB-AEDC-19AA99A237FA}
159. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
160. Again Still in the left panel, locate and delete the key:
     NumMethods
161. Again Still in the left panel, locate and delete the key:
     {BCDCB538-01C0-46D1-A6A7-52F4D021C272}
162. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BCDCB538-01C0-46D1-A6A7-52F4D021C272}
163. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
164. Again Still in the left panel, locate and delete the key:
     NumMethods
165. Again Still in the left panel, locate and delete the key:
     {49D7563B-2DDB-4831-88C8-768A53833837}
166. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{49D7563B-2DDB-4831-88C8-768A53833837}
167. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
168. Again Still in the left panel, locate and delete the key:
     NumMethods
169. Again Still in the left panel, locate and delete the key:
     {DAB1D343-1B2A-47F9-B445-93DC50704BFE}
170. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{DAB1D343-1B2A-47F9-B445-93DC50704BFE}
171. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
172. Again Still in the left panel, locate and delete the key:
     NumMethods
173. Again Still in the left panel, locate and delete the key:
     {3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}
174. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}
175. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
176. Again Still in the left panel, locate and delete the key:
     NumMethods
177. Again Still in the left panel, locate and delete the key:
     {6DB17455-4E85-46E7-9D23-E555E4B005AF}
178. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{6DB17455-4E85-46E7-9D23-E555E4B005AF}
179. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
180. Again Still in the left panel, locate and delete the key:
     NumMethods
181. Again Still in the left panel, locate and delete the key:
     {DD42475D-6D46-496A-924E-BD5630B4CBBA}
182. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{DD42475D-6D46-496A-924E-BD5630B4CBBA}
183. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
184. Again Still in the left panel, locate and delete the key:
     NumMethods
185. Again Still in the left panel, locate and delete the key:
     {D106AB5F-A70E-400E-A21B-96208C1D8DBB}
186. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{D106AB5F-A70E-400E-A21B-96208C1D8DBB}
187. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
188. Again Still in the left panel, locate and delete the key:
     NumMethods
189. Again Still in the left panel, locate and delete the key:
     {B3A47570-0A85-4AEA-8270-529D47899603}
190. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B3A47570-0A85-4AEA-8270-529D47899603}
191. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
192. Again Still in the left panel, locate and delete the key:
     NumMethods
193. Again Still in the left panel, locate and delete the key:
     {18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}
194. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}
195. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
196. Again Still in the left panel, locate and delete the key:
     NumMethods
197. Again Still in the left panel, locate and delete the key:
     {2D363682-561D-4C3A-81C6-F2F82107562A}
198. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{2D363682-561D-4C3A-81C6-F2F82107562A}
199. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
200. Again Still in the left panel, locate and delete the key:
     NumMethods
201. Again Still in the left panel, locate and delete the key:
     {DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}
202. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}
203. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
204. Again Still in the left panel, locate and delete the key:
     NumMethods
205. Again Still in the left panel, locate and delete the key:
     {76F7B787-A67C-4C73-82C7-31F5E3AABC5C}
206. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}
207. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
208. Again Still in the left panel, locate and delete the key:
     NumMethods
209. Again Still in the left panel, locate and delete the key:
     {128C2DA6-2BC0-44C0-B3F6-4EC22E647964}
210. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}
211. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
212. Again Still in the left panel, locate and delete the key:
     NumMethods
213. Again Still in the left panel, locate and delete the key:
     {084D78A8-B084-4E14-A629-A2C419B0E3D9}
214. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{084D78A8-B084-4E14-A629-A2C419B0E3D9}
215. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
216. Again Still in the left panel, locate and delete the key:
     NumMethods
217. Again Still in the left panel, locate and delete the key:
     {909489C2-85A6-4322-AA56-D25278649D67}
218. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{909489C2-85A6-4322-AA56-D25278649D67}
219. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
220. Again Still in the left panel, locate and delete the key:
     NumMethods
221. Again Still in the left panel, locate and delete the key:
     {494B20CF-282E-4BDD-9F5D-B70CB09D351E}
222. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{494B20CF-282E-4BDD-9F5D-B70CB09D351E}
223. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
224. Again Still in the left panel, locate and delete the key:
     NumMethods
225. Again Still in the left panel, locate and delete the key:
     {5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}
226. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}
227. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
228. Again Still in the left panel, locate and delete the key:
     NumMethods
229. Again Still in the left panel, locate and delete the key:
     {FE908CDD-22BB-472A-9870-1A0390E42F36}
230. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{FE908CDD-22BB-472A-9870-1A0390E42F36}
231. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
232. Again Still in the left panel, locate and delete the key:
     NumMethods
233. Again Still in the left panel, locate and delete the key:
     {1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}
234. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}
235. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
236. Again Still in the left panel, locate and delete the key:
     NumMethods
237. Again Still in the left panel, locate and delete the key:
     {5CCCB0EF-7073-4516-8028-4C628D0C8AAB}
238. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{5CCCB0EF-7073-4516-8028-4C628D0C8AAB}
239. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
240. Again Still in the left panel, locate and delete the key:
     NumMethods
241. Again Still in the left panel, locate and delete the key:
     {247954F9-9EDC-4E68-8CC3-150C2B89EADF}
242. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{247954F9-9EDC-4E68-8CC3-150C2B89EADF}
243. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
244. Again Still in the left panel, locate and delete the key:
     NumMethods
245. Again Still in the left panel, locate and delete the key:
     {4DE778FE-F195-4EE3-9DAB-FE446C239221}
246. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{4DE778FE-F195-4EE3-9DAB-FE446C239221}
247. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
248. Again Still in the left panel, locate and delete the key:
     NumMethods
249. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.OnDemandCOMClassMachine.1.0
250. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.OnDemandCOMClassMachine.1.0
251. Still in the left panel, locate and delete the key:
     CLSID
252. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.OnDemandCOMClassMachine
253. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.OnDemandCOMClassMachine
254. Still in the left panel, locate and delete the key:
     CLSID
255. Again Still in the left panel, locate and delete the key:
     CurVer
256. Again Still in the left panel, locate and delete the key:
     {6F8BD55B-E83D-4A47-85BE-81FFA8057A69}
257. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}
258. Still in the left panel, locate and delete the key:
     ProgID
259. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
260. Again Still in the left panel, locate and delete the key:
     LocalServer32
261. Again Still in the left panel, locate and delete the key:
     Elevation
262. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.Update3WebMachine.1.0
263. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.Update3WebMachine.1.0
264. Still in the left panel, locate and delete the key:
     CLSID
265. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.Update3WebMachine
266. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.Update3WebMachine
267. Still in the left panel, locate and delete the key:
     CLSID
268. Again Still in the left panel, locate and delete the key:
     CurVer
269. Again Still in the left panel, locate and delete the key:
     {8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}
270. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}
271. Still in the left panel, locate and delete the key:
     ProgID
272. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
273. Again Still in the left panel, locate and delete the key:
     LocalServer32
274. Again Still in the left panel, locate and delete the key:
     Elevation
275. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.CoCreateAsync.1.0
276. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.CoCreateAsync.1.0
277. Still in the left panel, locate and delete the key:
     CLSID
278. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.CoCreateAsync
279. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.CoCreateAsync
280. Still in the left panel, locate and delete the key:
     CLSID
281. Again Still in the left panel, locate and delete the key:
     CurVer
282. Again Still in the left panel, locate and delete the key:
     {7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}
283. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{7DE94008-8AFD-4C70-9728-C6FBFFF6A73E}
284. Still in the left panel, locate and delete the key:
     ProgID
285. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
286. Again Still in the left panel, locate and delete the key:
     LocalServer32
287. Again Still in the left panel, locate and delete the key:
     Google.OneClickProcessLauncherMachine.1.0
288. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Google.OneClickProcessLauncherMachine.1.0
289. Still in the left panel, locate and delete the key:
     CLSID
290. Again Still in the left panel, locate and delete the key:
     Google.OneClickProcessLauncherMachine
291. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Google.OneClickProcessLauncherMachine
292. Still in the left panel, locate and delete the key:
     CLSID
293. Again Still in the left panel, locate and delete the key:
     CurVer
294. Again Still in the left panel, locate and delete the key:
     {AAD4AE2E-D834-46D4-8B09-490FAC9C722B}
295. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}
296. Still in the left panel, locate and delete the key:
     ProgID
297. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
298. Again Still in the left panel, locate and delete the key:
     LocalServer32
299. Again Still in the left panel, locate and delete the key:
     {AAD4AE2E-D834-46D4-8B09-490FAC9C722B}
300. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.ProcessLauncher.1.0
301. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.ProcessLauncher.1.0
302. Still in the left panel, locate and delete the key:
     CLSID
303. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.ProcessLauncher
304. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.ProcessLauncher
305. Still in the left panel, locate and delete the key:
     CLSID
306. Again Still in the left panel, locate and delete the key:
     CurVer
307. Again Still in the left panel, locate and delete the key:
     {ABC01078-F197-4B0B-ADBC-CFE684B39C82}
308. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{ABC01078-F197-4B0B-ADBC-CFE684B39C82}
309. Still in the left panel, locate and delete the key:
     ProgID
310. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
311. Again Still in the left panel, locate and delete the key:
     LocalServer32
312. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.CoreMachineClass.1
313. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.CoreMachineClass.1
314. Still in the left panel, locate and delete the key:
     CLSID
315. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.CoreMachineClass
316. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.CoreMachineClass
317. Still in the left panel, locate and delete the key:
     CLSID
318. Again Still in the left panel, locate and delete the key:
     CurVer
319. Again Still in the left panel, locate and delete the key:
     {9B2340A0-4068-43D6-B404-32E27217859D}
320. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{9B2340A0-4068-43D6-B404-32E27217859D}
321. Still in the left panel, locate and delete the key:
     ProgID
322. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
323. Again Still in the left panel, locate and delete the key:
     LocalServer32
324. Again Still in the left panel, locate and delete the key:
     Elevation
325. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.OnDemandCOMClassMachineFallback.1.0
326. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.OnDemandCOMClassMachineFallback.1.0
327. Still in the left panel, locate and delete the key:
     CLSID
328. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.OnDemandCOMClassMachineFallback
329. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.OnDemandCOMClassMachineFallback
330. Still in the left panel, locate and delete the key:
     CLSID
331. Again Still in the left panel, locate and delete the key:
     CurVer
332. Again Still in the left panel, locate and delete the key:
     {B3D28DBD-0DFA-40E4-8071-520767BADC7E}
333. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B3D28DBD-0DFA-40E4-8071-520767BADC7E}
334. Still in the left panel, locate and delete the key:
     ProgID
335. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
336. Again Still in the left panel, locate and delete the key:
     LocalServer32
337. Again Still in the left panel, locate and delete the key:
     Elevation
338. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.Update3WebMachineFallback.1.0
339. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.Update3WebMachineFallback.1.0
340. Still in the left panel, locate and delete the key:
     CLSID
341. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.Update3WebMachineFallback
342. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.Update3WebMachineFallback
343. Still in the left panel, locate and delete the key:
     CLSID
344. Again Still in the left panel, locate and delete the key:
     CurVer
345. Again Still in the left panel, locate and delete the key:
     {598FE0E5-E02D-465D-9A9D-37974A28FD42}
346. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{598FE0E5-E02D-465D-9A9D-37974A28FD42}
347. Still in the left panel, locate and delete the key:
     ProgID
348. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
349. Again Still in the left panel, locate and delete the key:
     LocalServer32
350. Again Still in the left panel, locate and delete the key:
     Elevation
351. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.CredentialDialogMachine.1.0
352. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.CredentialDialogMachine.1.0
353. Still in the left panel, locate and delete the key:
     CLSID
354. Again Still in the left panel, locate and delete the key:
     GoogleUpdate.CredentialDialogMachine
355. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>GoogleUpdate.CredentialDialogMachine
356. Still in the left panel, locate and delete the key:
     CLSID
357. Again Still in the left panel, locate and delete the key:
     CurVer
358. Again Still in the left panel, locate and delete the key:
     {25461599-633D-42B1-84FB-7CD68D026E53}
359. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{25461599-633D-42B1-84FB-7CD68D026E53}
360. Still in the left panel, locate and delete the key:
     ProgID
361. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
362. Again Still in the left panel, locate and delete the key:
     LocalServer32
363. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Google>Update
364. Still in the left panel, locate and delete the key:
     proxy
365. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>Software>Google>Update>ClientStateMedium
366. Still in the left panel, locate and delete the key:
     {8A69D345-D564-463C-AFF1-A69D9E530F96}
367. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor.
   » For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run, type regedit in the text box provided, and then press Enter.
   » For Windows Vista, Windows 7, and Windows Server 2008 users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, and Windows Server 2012 users, right-click on the lower-left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Google>Update>ClientState>{8A69D345-D564-463C-AFF1-A69D9E530F96}
3. In the right panel, locate and delete the entry:
   usagestats = "1"
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Google>Update
5. In the right panel, locate and delete the entry:
   path = "%Program Files%\Google\Update\GoogleUpdate.exe"
6. Again In the right panel, locate and delete the entry:
   UninstallCmdLine = "%Program Files%\Google\Update\GoogleUpdate.exe /uninstall"
7. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Google>Update>Clients>{430FD4D0-B729-4F61-AA34-91526481799D}
8. In the right panel, locate and delete the entry:
   pv = "1.3.21.165"
9. Again In the right panel, locate and delete the entry:
   name = "Google Update"
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Google>Update>ClientState>{430FD4D0-B729-4F61-AA34-91526481799D}
11. In the right panel, locate and delete the entry:
    pv = "1.3.21.165"
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>GoogleUpdate.exe
13. In the right panel, locate and delete the entry:
    DisableExceptionChainValidation = "0"
14. Again In the right panel, locate and delete the entry:
    IsMSIHelperRegistered = "0"
15. Again In the right panel, locate and delete the entry:
    LastOSVersion = "{random values}"
16. Again In the right panel, locate and delete the entry:
    version = "1.3.21.165"
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>MozillaPlugins>@tools.google.com/Google Update;version=9
18. In the right panel, locate and delete the entry:
    Path = "%Program Files%\Google\Update\1.3.21.165\npGoogleUpdate3.dll"
19. Again In the right panel, locate and delete the entry:
    Description = "Google Update"
20. Again In the right panel, locate and delete the entry:
    ProductName = "Google Update"
21. Again In the right panel, locate and delete the entry:
    Vendor = "Google Inc."
22. Again In the right panel, locate and delete the entry:
    Version = "9"
23. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Low Rights>ElevationPolicy>{C442AC41-9200-4770-8CC0-7CDB4F245C55}
24. In the right panel, locate and delete the entry:
    AppName = "GoogleUpdate.exe"
25. Again In the right panel, locate and delete the entry:
    AppPath = "%Program Files%\Google\Update"
26. Again In the right panel, locate and delete the entry:
    Policy = "3"
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{C442AC41-9200-4770-8CC0-7CDB4F245C55}>InprocServer32
28. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
29. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>MIME>Database>Content Type>application/x-vnd.google.oneclickctrl.9
30. In the right panel, locate and delete the entry:
    CLSID = "{C442AC41-9200-4770-8CC0-7CDB4F245C55}"
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>MozillaPlugins>@tools.google.com/Google Update;version=3
32. In the right panel, locate and delete the entry:
    Path = "%Program Files%\Google\Update\1.3.21.165\npGoogleUpdate3.dll"
33. Again In the right panel, locate and delete the entry:
    Description = "Google Update"
34. Again In the right panel, locate and delete the entry:
    ProductName = "Google Update"
35. Again In the right panel, locate and delete the entry:
    Vendor = "Google Inc."
36. Again In the right panel, locate and delete the entry:
    Version = "3"
37. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Low Rights>ElevationPolicy>{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}
38. In the right panel, locate and delete the entry:
    AppName = "GoogleUpdateBroker.exe"
39. Again In the right panel, locate and delete the entry:
    AppPath = "%Program Files%\Google\Update\1.3.21.165"
40. Again In the right panel, locate and delete the entry:
    Policy = "3"
41. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}>InprocServer32
42. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
43. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>MIME>Database>Content Type>application/x-vnd.google.update3webcontrol.3
44. In the right panel, locate and delete the entry:
    CLSID = "{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}"
45. Again In the right panel, locate and delete the entry:
    brand = "GTPM"
46. Again In the right panel, locate and delete the entry:
    InstallTime = "54454152"
47. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Google>Update>UsageStats>Daily
48. In the right panel, locate and delete the entry:
    LastTransmission = "5445418e"
49. Again In the right panel, locate and delete the entry:
    uid = "{3D8E9508-B7FE-4962-9FB4-A42EE38059FA}"
50. Again In the right panel, locate and delete the entry:
    uid-create-time = "54454148"
51. Again In the right panel, locate and delete the entry:
    uid-num-rotations = "1"
52. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>GoogleUpdate.exe
53. In the right panel, locate and delete the entry:
    AppID = "{4EB61BAC-A3B6-4760-9581-655041EF4D69}"
54. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>{4EB61BAC-A3B6-4760-9581-655041EF4D69}
55. In the right panel, locate and delete the entry:
    LocalService = "gupdate"
56. Again In the right panel, locate and delete the entry:
    ServiceParameters = "/comsvc"
57. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{4EB61BAC-A3B6-4760-9581-655041EF4D69}
58. In the right panel, locate and delete the entry:
    AppID = "{4EB61BAC-A3B6-4760-9581-655041EF4D69}"
59. Again In the right panel, locate and delete the entry:
    AppID = "{9465B4B4-5216-4042-9A2C-754D3BCDC410}"
60. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>{9465B4B4-5216-4042-9A2C-754D3BCDC410}
61. In the right panel, locate and delete the entry:
    LocalService = "gupdatem"
62. Again In the right panel, locate and delete the entry:
    ServiceParameters = "/comsvc"
63. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{9465B4B4-5216-4042-9A2C-754D3BCDC410}
64. In the right panel, locate and delete the entry:
    AppID = "{9465B4B4-5216-4042-9A2C-754D3BCDC410}"
65. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{534F5323-3569-4F42-919D-1E1CF93E5BF6}
66. In the right panel, locate and delete the entry:
    AppID = "{9465B4B4-5216-4042-9A2C-754D3BCDC410}"
67. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{E225E692-4B47-4777-9BED-4FD7FE257F0E}
68. In the right panel, locate and delete the entry:
    AppID = "{9465B4B4-5216-4042-9A2C-754D3BCDC410}"
69. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Google>Update>UsageStats>Daily>Counts
70. In the right panel, locate and delete the entry:
    opt_in_uid_generated = "{random values}"
71. Again In the right panel, locate and delete the entry:
    goopdate_main = "{random values}"
72. Again In the right panel, locate and delete the entry:
    goopdate_constructor = "{random values}"
73. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Google>Update>UsageStats>Daily>Integers
74. In the right panel, locate and delete the entry:
    windows_sp_major_version = "{random values}"
75. Again In the right panel, locate and delete the entry:
    windows_minor_version = "{random values}"
76. Again In the right panel, locate and delete the entry:
    windows_major_version = "{random values}"
77. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{50AC8ACB-D28F-4082-A1BC-C04054B5A5AC}>InprocHandler32
78. In the right panel, locate and delete the entry:
    ThreadingModel = "Both"
79. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{9D6AA569-9F30-41AD-885A-346685C74928}>InprocServer32
80. In the right panel, locate and delete the entry:
    ThreadingModel = "Both"
81. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{D0CD6E57-FBA5-4F71-98DF-3AAEB8CB8118}>InProcServer32
82. In the right panel, locate and delete the entry:
    ThreadingModel = "Both"
83. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}
84. In the right panel, locate and delete the entry:
    LocalizedString = "@%Program Files%\Google\Update\1.3.21.165\goopdate.dll,-3000"
85. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{6F8BD55B-E83D-4A47-85BE-81FFA8057A69}>Elevation
86. In the right panel, locate and delete the entry:
    Enabled = "1"
87. Again In the right panel, locate and delete the entry:
    IconReference = "@%Program Files%\Google\Update\1.3.21.165\goopdate.dll,-1004"
88. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}
89. In the right panel, locate and delete the entry:
    LocalizedString = "@%Program Files%\Google\Update\1.3.21.165\goopdate.dll,-3000"
90. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}>Elevation
91. In the right panel, locate and delete the entry:
    Enabled = "1"
92. Again In the right panel, locate and delete the entry:
    IconReference = "@%Program Files%\Google\Update\1.3.21.165\goopdate.dll,-1004"
93. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Low Rights>ElevationPolicy>{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}
94. In the right panel, locate and delete the entry:
    CLSID = "{AAD4AE2E-D834-46D4-8B09-490FAC9C722B}"
95. Again In the right panel, locate and delete the entry:
    Policy = "3"
96. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{9B2340A0-4068-43D6-B404-32E27217859D}
97. In the right panel, locate and delete the entry:
    LocalizedString = "@%Program Files%\Google\Update\1.3.21.165\goopdate.dll,-3000"
98. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{9B2340A0-4068-43D6-B404-32E27217859D}>Elevation
99. In the right panel, locate and delete the entry:
    Enabled = "1"
100. Again In the right panel, locate and delete the entry:
     IconReference = "@%Program Files%\Google\Update\1.3.21.165\goopdate.dll,-1004"
101. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B3D28DBD-0DFA-40E4-8071-520767BADC7E}
102. In the right panel, locate and delete the entry:
     LocalizedString = "@%Program Files%\Google\Update\1.3.21.165\goopdate.dll,-3000"
103. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B3D28DBD-0DFA-40E4-8071-520767BADC7E}>Elevation
104. In the right panel, locate and delete the entry:
     Enabled = "1"
105. Again In the right panel, locate and delete the entry:
     IconReference = "@%Program Files%\Google\Update\1.3.21.165\goopdate.dll,-1004"
106. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{598FE0E5-E02D-465D-9A9D-37974A28FD42}
107. In the right panel, locate and delete the entry:
     LocalizedString = "@%Program Files%\Google\Update\1.3.21.165\goopdate.dll,-3000"
108. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{598FE0E5-E02D-465D-9A9D-37974A28FD42}>Elevation
109. In the right panel, locate and delete the entry:
     Enabled = "1"
110. Again In the right panel, locate and delete the entry:
     IconReference = "@%Program Files%\Google\Update\1.3.21.165\goopdate.dll,-1004"
111. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Google>Update>proxy
112. In the right panel, locate and delete the entry:
     source = "auto"
113. Close Registry Editor.

To manually delete a malware/grayware file from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the File name* input box, type the following:
   
   • %User Temp%\chrome_installer.exe
   • %Program Files%\GUM2.tmp\GoogleUpdate.exe
   • %Program Files%\GUM2.tmp\GoogleCrashHandler.exe
   • %Program Files%\GUM2.tmp\goopdate.dll
   • %Program Files%\GUM2.tmp\npGoogleUpdate3.dll
   • %Program Files%\GUM2.tmp\GoogleUpdateHelper.msi
   • %Program Files%\GUM2.tmp\GoogleUpdateBroker.exe
   • %Program Files%\GUM2.tmp\GoogleUpdateOnDemand.exe
   • %Program Files%\GUM2.tmp\psmachine.dll
   • %Program Files%\GUM2.tmp\psuser.dll
   • %Program Files%\GUM2.tmp\GoogleCrashHandler64.exe
   • %Program Files%\GUM2.tmp\goopdateres_am.dll
   • %Program Files%\GUM2.tmp\goopdateres_ar.dll
   • %Program Files%\GUM2.tmp\goopdateres_bg.dll
   • %Program Files%\GUM2.tmp\goopdateres_bn.dll
   • %Program Files%\GUM2.tmp\goopdateres_ca.dll
   • %Program Files%\GUM2.tmp\goopdateres_cs.dll
   • %Program Files%\GUM2.tmp\goopdateres_da.dll
   • %Program Files%\GUM2.tmp\goopdateres_de.dll
   • %Program Files%\GUM2.tmp\goopdateres_el.dll
   • %Program Files%\GUM2.tmp\goopdateres_en.dll
   • %Program Files%\GUM2.tmp\goopdateres_en-GB.dll
   • %Program Files%\GUM2.tmp\goopdateres_es.dll
   • %Program Files%\GUM2.tmp\goopdateres_es-419.dll
   • %Program Files%\GUM2.tmp\goopdateres_et.dll
   • %Program Files%\GUM2.tmp\goopdateres_fa.dll
   • %Program Files%\GUM2.tmp\goopdateres_fi.dll
   • %Program Files%\GUM2.tmp\goopdateres_fil.dll
   • %Program Files%\GUM2.tmp\goopdateres_fr.dll
   • %Program Files%\GUM2.tmp\goopdateres_gu.dll
   • %Program Files%\GUM2.tmp\goopdateres_hi.dll
   • %Program Files%\GUM2.tmp\goopdateres_hr.dll
   • %Program Files%\GUM2.tmp\goopdateres_hu.dll
   • %Program Files%\GUM2.tmp\goopdateres_id.dll
   • %Program Files%\GUM2.tmp\goopdateres_is.dll
   • %Program Files%\GUM2.tmp\goopdateres_it.dll
   • %Program Files%\GUM2.tmp\goopdateres_iw.dll
   • %Program Files%\GUM2.tmp\goopdateres_ja.dll
   • %Program Files%\GUM2.tmp\goopdateres_kn.dll
   • %Program Files%\GUM2.tmp\goopdateres_ko.dll
   • %Program Files%\GUM2.tmp\goopdateres_lt.dll
   • %Program Files%\GUM2.tmp\goopdateres_lv.dll
   • %Program Files%\GUM2.tmp\goopdateres_ml.dll
   • %Program Files%\GUM2.tmp\goopdateres_mr.dll
   • %Program Files%\GUM2.tmp\goopdateres_ms.dll
   • %Program Files%\GUM2.tmp\goopdateres_nl.dll
   • %Program Files%\GUM2.tmp\goopdateres_no.dll
   • %Program Files%\GUM2.tmp\goopdateres_pl.dll
   • %Program Files%\GUM2.tmp\goopdateres_pt-BR.dll
   • %Program Files%\GUM2.tmp\goopdateres_pt-PT.dll
   • %Program Files%\GUM2.tmp\goopdateres_ro.dll
   • %Program Files%\GUM2.tmp\goopdateres_ru.dll
   • %Program Files%\GUM2.tmp\goopdateres_sk.dll
   • %Program Files%\GUM2.tmp\goopdateres_sl.dll
   • %Program Files%\GUM2.tmp\goopdateres_sr.dll
   • %Program Files%\GUM2.tmp\goopdateres_sv.dll
   • %Program Files%\GUM2.tmp\goopdateres_sw.dll
   • %Program Files%\GUM2.tmp\goopdateres_ta.dll
   • %Program Files%\GUM2.tmp\goopdateres_te.dll
   • %Program Files%\GUM2.tmp\goopdateres_th.dll
   • %Program Files%\GUM2.tmp\goopdateres_tr.dll
   • %Program Files%\GUM2.tmp\goopdateres_uk.dll
   • %Program Files%\GUM2.tmp\goopdateres_ur.dll
   • %Program Files%\GUM2.tmp\goopdateres_vi.dll
   • %Program Files%\GUM2.tmp\goopdateres_zh-CN.dll
   • %Program Files%\GUM2.tmp\goopdateres_zh-TW.dll
   • %Windows%\Tasks\GoogleUpdateTaskMachineCore.job
   • %Windows%\Tasks\GoogleUpdateTaskMachineUA.job
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: The file name input box title varies depending on the Windows version (e.g. Search for files or folders named or All or part of the file name.).

• For Windows Vista, Windows 7, Windows Server 2008, Windows 8, Windows 8.1, and Windows Server 2012:

1. Open a Windows Explorer window.
   • For Windows Vista, 7, and Server 2008 users, click Start>Computer.
   • For Windows 8, 8.1, and Server 2012 users, right-click on the lower left corner of the screen,then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %User Temp%\chrome_installer.exe
   • %Program Files%\GUM2.tmp\GoogleUpdate.exe
   • %Program Files%\GUM2.tmp\GoogleCrashHandler.exe
   • %Program Files%\GUM2.tmp\goopdate.dll
   • %Program Files%\GUM2.tmp\npGoogleUpdate3.dll
   • %Program Files%\GUM2.tmp\GoogleUpdateHelper.msi
   • %Program Files%\GUM2.tmp\GoogleUpdateBroker.exe
   • %Program Files%\GUM2.tmp\GoogleUpdateOnDemand.exe
   • %Program Files%\GUM2.tmp\psmachine.dll
   • %Program Files%\GUM2.tmp\psuser.dll
   • %Program Files%\GUM2.tmp\GoogleCrashHandler64.exe
   • %Program Files%\GUM2.tmp\goopdateres_am.dll
   • %Program Files%\GUM2.tmp\goopdateres_ar.dll
   • %Program Files%\GUM2.tmp\goopdateres_bg.dll
   • %Program Files%\GUM2.tmp\goopdateres_bn.dll
   • %Program Files%\GUM2.tmp\goopdateres_ca.dll
   • %Program Files%\GUM2.tmp\goopdateres_cs.dll
   • %Program Files%\GUM2.tmp\goopdateres_da.dll
   • %Program Files%\GUM2.tmp\goopdateres_de.dll
   • %Program Files%\GUM2.tmp\goopdateres_el.dll
   • %Program Files%\GUM2.tmp\goopdateres_en.dll
   • %Program Files%\GUM2.tmp\goopdateres_en-GB.dll
   • %Program Files%\GUM2.tmp\goopdateres_es.dll
   • %Program Files%\GUM2.tmp\goopdateres_es-419.dll
   • %Program Files%\GUM2.tmp\goopdateres_et.dll
   • %Program Files%\GUM2.tmp\goopdateres_fa.dll
   • %Program Files%\GUM2.tmp\goopdateres_fi.dll
   • %Program Files%\GUM2.tmp\goopdateres_fil.dll
   • %Program Files%\GUM2.tmp\goopdateres_fr.dll
   • %Program Files%\GUM2.tmp\goopdateres_gu.dll
   • %Program Files%\GUM2.tmp\goopdateres_hi.dll
   • %Program Files%\GUM2.tmp\goopdateres_hr.dll
   • %Program Files%\GUM2.tmp\goopdateres_hu.dll
   • %Program Files%\GUM2.tmp\goopdateres_id.dll
   • %Program Files%\GUM2.tmp\goopdateres_is.dll
   • %Program Files%\GUM2.tmp\goopdateres_it.dll
   • %Program Files%\GUM2.tmp\goopdateres_iw.dll
   • %Program Files%\GUM2.tmp\goopdateres_ja.dll
   • %Program Files%\GUM2.tmp\goopdateres_kn.dll
   • %Program Files%\GUM2.tmp\goopdateres_ko.dll
   • %Program Files%\GUM2.tmp\goopdateres_lt.dll
   • %Program Files%\GUM2.tmp\goopdateres_lv.dll
   • %Program Files%\GUM2.tmp\goopdateres_ml.dll
   • %Program Files%\GUM2.tmp\goopdateres_mr.dll
   • %Program Files%\GUM2.tmp\goopdateres_ms.dll
   • %Program Files%\GUM2.tmp\goopdateres_nl.dll
   • %Program Files%\GUM2.tmp\goopdateres_no.dll
   • %Program Files%\GUM2.tmp\goopdateres_pl.dll
   • %Program Files%\GUM2.tmp\goopdateres_pt-BR.dll
   • %Program Files%\GUM2.tmp\goopdateres_pt-PT.dll
   • %Program Files%\GUM2.tmp\goopdateres_ro.dll
   • %Program Files%\GUM2.tmp\goopdateres_ru.dll
   • %Program Files%\GUM2.tmp\goopdateres_sk.dll
   • %Program Files%\GUM2.tmp\goopdateres_sl.dll
   • %Program Files%\GUM2.tmp\goopdateres_sr.dll
   • %Program Files%\GUM2.tmp\goopdateres_sv.dll
   • %Program Files%\GUM2.tmp\goopdateres_sw.dll
   • %Program Files%\GUM2.tmp\goopdateres_ta.dll
   • %Program Files%\GUM2.tmp\goopdateres_te.dll
   • %Program Files%\GUM2.tmp\goopdateres_th.dll
   • %Program Files%\GUM2.tmp\goopdateres_tr.dll
   • %Program Files%\GUM2.tmp\goopdateres_uk.dll
   • %Program Files%\GUM2.tmp\goopdateres_ur.dll
   • %Program Files%\GUM2.tmp\goopdateres_vi.dll
   • %Program Files%\GUM2.tmp\goopdateres_zh-CN.dll
   • %Program Files%\GUM2.tmp\goopdateres_zh-TW.dll
   • %Windows%\Tasks\GoogleUpdateTaskMachineCore.job
   • %Windows%\Tasks\GoogleUpdateTaskMachineUA.job
3. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the File name* input box, type:
   
   • %Program Files%\GUM2.tmp
   • %Application Data%\Google
   • %Application Data%\Google\CrashReports
   • %Program Files%\Google
   • %Program Files%\Google\CrashReports
   • %Program Files%\Google\Update
   • %Program Files%\Google\Update\1.3.21.165
   • %Program Files%\Google\Update\Offline
   • %Program Files%\Google\Update\Offline\{5E76E45C-A5D5-4C8D-AF56-6A88291554A0}
   • %Program Files%\Google\Update\Download
   • %Program Files%\Google\Update\Install
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %Program Files%\GUM2.tmp
   • %Application Data%\Google
   • %Application Data%\Google\CrashReports
   • %Program Files%\Google
   • %Program Files%\Google\CrashReports
   • %Program Files%\Google\Update
   • %Program Files%\Google\Update\1.3.21.165
   • %Program Files%\Google\Update\Offline
   • %Program Files%\Google\Update\Offline\{5E76E45C-A5D5-4C8D-AF56-6A88291554A0}
   • %Program Files%\Google\Update\Download
   • %Program Files%\Google\Update\Install
   *Note: The file name input box title varies depending on the Windows version (e.g. Search for files or folders named or All or part of the file name.).

For Windows Vista, Windows 7, Windows Server 2008, Windows 8, Windows 8.1, and Windows Server 2012:

1. Open a Windows Explorer window.
   • For Windows Vista, 7, and Server 2008 users, click Start>Computer.
   • For Windows 8, 8.1, and Server 2012 users, right-click on the lower left corner of the screen, then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %Program Files%\GUM2.tmp
   • %Application Data%\Google
   • %Application Data%\Google\CrashReports
   • %Program Files%\Google
   • %Program Files%\Google\CrashReports
   • %Program Files%\Google\Update
   • %Program Files%\Google\Update\1.3.21.165
   • %Program Files%\Google\Update\Offline
   • %Program Files%\Google\Update\Offline\{5E76E45C-A5D5-4C8D-AF56-6A88291554A0}
   • %Program Files%\Google\Update\Download
   • %Program Files%\Google\Update\Install
3. Once located, select the file then press SHIFT+DELETE to permanently delete the folder.
4. Repeat steps 2-3 for the remaining folders:
   • %Program Files%\GUM2.tmp
   • %Application Data%\Google
   • %Application Data%\Google\CrashReports
   • %Program Files%\Google
   • %Program Files%\Google\CrashReports
   • %Program Files%\Google\Update
   • %Program Files%\Google\Update\1.3.21.165
   • %Program Files%\Google\Update\Offline
   • %Program Files%\Google\Update\Offline\{5E76E45C-A5D5-4C8D-AF56-6A88291554A0}
   • %Program Files%\Google\Update\Download
   • %Program Files%\Google\Update\Install
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.