TROJ_BHO.VQ

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>PQDVD
3. Still in the left panel, locate and delete the key:
   PSPVideoExpress
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Uninstall
5. Still in the left panel, locate and delete the key:
   PSPVideoExpress
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID
7. Still in the left panel, locate and delete the key:
   {B9FD8E0A-17E0-48de-AB1D-70DDAA35D577}
8. Again Still in the left panel, locate and delete the key:
   webperform.DLL
9. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer
10. Still in the left panel, locate and delete the key:
    Browser Helper Objects
11. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT
12. Still in the left panel, locate and delete the key:
    Web.Perform.1
13. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Web.Perform.1
14. Still in the left panel, locate and delete the key:
    CLSID
15. Again Still in the left panel, locate and delete the key:
    Web.Perform
16. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Web.Perform
17. Still in the left panel, locate and delete the key:
    CLSID
18. Again Still in the left panel, locate and delete the key:
    CurVer
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
20. Still in the left panel, locate and delete the key:
    {AB692F9B-27FE-4511-8885-ED62BB45197B}
21. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{AB692F9B-27FE-4511-8885-ED62BB45197B}
22. Still in the left panel, locate and delete the key:
    ProgID
23. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
24. Again Still in the left panel, locate and delete the key:
    Programmable
25. Again Still in the left panel, locate and delete the key:
    InprocServer32
26. Again Still in the left panel, locate and delete the key:
    TypeLib
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
28. Still in the left panel, locate and delete the key:
    {B9FD8E0A-17E0-48DE-AB1D-70DDAA35D577}
29. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{B9FD8E0A-17E0-48DE-AB1D-70DDAA35D577}
30. Still in the left panel, locate and delete the key:
    1.0
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{B9FD8E0A-17E0-48DE-AB1D-70DDAA35D577}>1.0
32. Still in the left panel, locate and delete the key:
    FLAGS
33. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{B9FD8E0A-17E0-48DE-AB1D-70DDAA35D577}>1.0>0
34. Still in the left panel, locate and delete the key:
    win32
35. Again Still in the left panel, locate and delete the key:
    HELPDIR
36. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
37. Still in the left panel, locate and delete the key:
    {E498D54B-8307-483A-8CA0-55E4573DD63A}
38. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{E498D54B-8307-483A-8CA0-55E4573DD63A}
39. Still in the left panel, locate and delete the key:
    ProxyStubClsid
40. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
41. Again Still in the left panel, locate and delete the key:
    TypeLib
42. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID
43. Still in the left panel, locate and delete the key:
    {9FEB375E-811C-41C4-9F20-D6FBAFFAA73D}
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{9FEB375E-811C-41C4-9F20-D6FBAFFAA73D}
45. Still in the left panel, locate and delete the key:
    InprocServer32
46. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID>{083863F1-70DE-11D0-BD40-00A0C911CE86}>Instance
47. Still in the left panel, locate and delete the key:
    {9FEB375E-811C-41C4-9F20-D6FBAFFAA73D}
48. Again Still in the left panel, locate and delete the key:
    {B9660384-4E56-4E3B-A9CA-6645D37D7DB1}
49. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B9660384-4E56-4E3B-A9CA-6645D37D7DB1}
50. Still in the left panel, locate and delete the key:
    InprocServer32
51. Again Still in the left panel, locate and delete the key:
    {B9660384-4E56-4E3B-A9CA-6645D37D7DB1}
52. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>Media Type>{E436EB83-524F-11CE-9F53-0020AF0BA770}
53. Still in the left panel, locate and delete the key:
    {57428EC6-C2B2-44A2-AA9C-28F0B6A5C48E}
54. Again Still in the left panel, locate and delete the key:
    {E21BE468-5C18-43EB-B0CC-DB93A847D769}
55. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{E21BE468-5C18-43EB-B0CC-DB93A847D769}
56. Still in the left panel, locate and delete the key:
    InprocServer32
57. Again Still in the left panel, locate and delete the key:
    {765035B3-5944-4A94-806B-20EE3415F26F}
58. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{765035B3-5944-4A94-806B-20EE3415F26F}
59. Still in the left panel, locate and delete the key:
    InprocServer32
60. Again Still in the left panel, locate and delete the key:
    {238D0F23-5DC9-45A6-9BE2-666160C324DD}
61. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{238D0F23-5DC9-45A6-9BE2-666160C324DD}
62. Still in the left panel, locate and delete the key:
    InprocServer32
63. Again Still in the left panel, locate and delete the key:
    {941A4793-A705-4312-8DFC-C11CA05F397E}
64. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{941A4793-A705-4312-8DFC-C11CA05F397E}
65. Still in the left panel, locate and delete the key:
    InprocServer32
66. Again Still in the left panel, locate and delete the key:
    {E21BE468-5C18-43EB-B0CC-DB93A847D769}
67. Again Still in the left panel, locate and delete the key:
    {765035B3-5944-4A94-806B-20EE3415F26F}
68. Again Still in the left panel, locate and delete the key:
    {238D0F23-5DC9-45A6-9BE2-666160C324DD}
69. Again Still in the left panel, locate and delete the key:
    {941A4793-A705-4312-8DFC-C11CA05F397E}
70. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>PQDVD>PSPVideoExpress
3. In the right panel, locate and delete the entry:
   Install_Dir = "%Program Files%\PQDVD\PSPVideoExpress"
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>PSPVideoExpress
5. In the right panel, locate and delete the entry:
   DisplayName = "PSP Video Express(remove only)"
6. Again In the right panel, locate and delete the entry:
   UninstallString = "%Program Files%\PQDVD\PSPVideoExpress\bt-uninst.exe"
7. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>Services>NPF
8. In the right panel, locate and delete the entry:
   Start = "2"
9. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>webperform.DLL
10. In the right panel, locate and delete the entry:
    AppID = "{B9FD8E0A-17E0-48de-AB1D-70DDAA35D577}"
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{AB692F9B-27FE-4511-8885-ED62BB45197B}>InprocServer32
12. In the right panel, locate and delete the entry:
    ThreadingModel = "apartment"
13. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{AB692F9B-27FE-4511-8885-ED62BB45197B}
14. In the right panel, locate and delete the entry:
    AppID = "{B9FD8E0A-17E0-48de-AB1D-70DDAA35D577}"
15. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{E498D54B-8307-483A-8CA0-55E4573DD63A}>TypeLib
16. In the right panel, locate and delete the entry:
    Version = "1.0"
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{9FEB375E-811C-41C4-9F20-D6FBAFFAA73D}>InprocServer32
18. In the right panel, locate and delete the entry:
    ThreadingModel = "Both"
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{083863F1-70DE-11d0-BD40-00A0C911CE86}>Instance>{9FEB375E-811C-41C4-9F20-D6FBAFFAA73D}
20. In the right panel, locate and delete the entry:
    FriendlyName = "PQG"
21. Again In the right panel, locate and delete the entry:
    CLSID = "{9FEB375E-811C-41C4-9F20-D6FBAFFAA73D}"
22. Again In the right panel, locate and delete the entry:
    FilterData = "{random values}"
23. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B9660384-4E56-4E3B-A9CA-6645D37D7DB1}>InprocServer32
24. In the right panel, locate and delete the entry:
    ThreadingModel = "Both"
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{083863F1-70DE-11d0-BD40-00A0C911CE86}>Instance>{B9660384-4E56-4E3B-A9CA-6645D37D7DB1}
26. In the right panel, locate and delete the entry:
    FriendlyName = "PQVG"
27. Again In the right panel, locate and delete the entry:
    CLSID = "{B9660384-4E56-4E3B-A9CA-6645D37D7DB1}"
28. Again In the right panel, locate and delete the entry:
    FilterData = "{random values}"
29. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Media Type>{e436eb83-524f-11ce-9f53-0020af0ba770}>{57428EC6-C2B2-44A2-AA9C-28F0B6A5C48E}
30. In the right panel, locate and delete the entry:
    0 = "0,4,,2E524D46"
31. Again In the right panel, locate and delete the entry:
    Source Filter = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{E21BE468-5C18-43EB-B0CC-DB93A847D769}>InprocServer32
33. In the right panel, locate and delete the entry:
    ThreadingModel = "Both"
34. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{765035B3-5944-4A94-806B-20EE3415F26F}>InprocServer32
35. In the right panel, locate and delete the entry:
    ThreadingModel = "Both"
36. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{238D0F23-5DC9-45A6-9BE2-666160C324DD}>InprocServer32
37. In the right panel, locate and delete the entry:
    ThreadingModel = "Both"
38. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{941A4793-A705-4312-8DFC-C11CA05F397E}>InprocServer32
39. In the right panel, locate and delete the entry:
    ThreadingModel = "Both"
40. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{083863F1-70DE-11d0-BD40-00A0C911CE86}>Instance>{E21BE468-5C18-43EB-B0CC-DB93A847D769}
41. In the right panel, locate and delete the entry:
    FriendlyName = "RealMedia Splitter"
42. Again In the right panel, locate and delete the entry:
    CLSID = "{E21BE468-5C18-43EB-B0CC-DB93A847D769}"
43. Again In the right panel, locate and delete the entry:
    FilterData = "{random values}"
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{083863F1-70DE-11d0-BD40-00A0C911CE86}>Instance>{765035B3-5944-4A94-806B-20EE3415F26F}
45. In the right panel, locate and delete the entry:
    FriendlyName = "RealMedia Source"
46. Again In the right panel, locate and delete the entry:
    CLSID = "{765035B3-5944-4A94-806B-20EE3415F26F}"
47. Again In the right panel, locate and delete the entry:
    FilterData = "{random values}"
48. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{083863F1-70DE-11d0-BD40-00A0C911CE86}>Instance>{238D0F23-5DC9-45A6-9BE2-666160C324DD}
49. In the right panel, locate and delete the entry:
    FriendlyName = "RealVideo Decoder"
50. Again In the right panel, locate and delete the entry:
    CLSID = "{238D0F23-5DC9-45A6-9BE2-666160C324DD}"
51. Again In the right panel, locate and delete the entry:
    FilterData = "{random values}"
52. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{083863F1-70DE-11d0-BD40-00A0C911CE86}>Instance>{941A4793-A705-4312-8DFC-C11CA05F397E}
53. In the right panel, locate and delete the entry:
    FriendlyName = "RealAudio Decoder"
54. Again In the right panel, locate and delete the entry:
    CLSID = "{941A4793-A705-4312-8DFC-C11CA05F397E}"
55. Again In the right panel, locate and delete the entry:
    FilterData = "{random values}"
56. Close Registry Editor.

To delete malware/grayware component files:

1. Search for the following files:
   
   • %Program Files%\PQDVD\PSPVideoExpress\aqua.mskn
   • %Program Files%\PQDVD\PSPVideoExpress\aqua0.mskn
   • %Program Files%\PQDVD\PSPVideoExpress\aqua1.mskn
   • %Program Files%\PQDVD\PSPVideoExpress\g1.rtf
   • %Program Files%\PQDVD\PSPVideoExpress\g3.rtf
   • %Program Files%\PQDVD\PSPVideoExpress\g4.rtf
   • %Program Files%\PQDVD\PSPVideoExpress\g5.rtf
   • %Program Files%\PQDVD\PSPVideoExpress\g6_psp.rtf
   • %Program Files%\PQDVD\PSPVideoExpress\Thumbnail.bmp
   • %Program Files%\PQDVD\PSPVideoExpress\help.chm
   • %Program Files%\PQDVD\PSPVideoExpress\pqdvdi.dll
   • %Program Files%\PQDVD\PSPVideoExpress\pqg.ax
   • %Program Files%\PQDVD\PSPVideoExpress\pqvg.ax
   • %Program Files%\PQDVD\PSPVideoExpress\msvcr71.dll
   • %Program Files%\PQDVD\PSPVideoExpress\avformat.dll
   • %Program Files%\PQDVD\PSPVideoExpress\avcodec.dll
   • %Program Files%\PQDVD\PSPVideoExpress\PQDVD_PSP.exe
   • %Program Files%\PQDVD\PSPVideoExpress\codec.reg
   • %Program Files%\PQDVD\PSPVideoExpress\url.reg
   • %System%\webperform.dll
   • %System%\secbm.exe
   • %System%\wpcap.dll
   • %System%\Packet.dll
   • %System%\WanPacket.dll
   • %User Temp%\nsl2.tmp\System.dll
   • %System%\drivers\npf.sys
   • %User Temp%\nsl2.tmp\nsExec.dll
   • %Start Menu%\Programs\PSP Video Express\Uninstall PSP Video Express.lnk
   • %Start Menu%\Programs\PSP Video Express\PSP Video Express - Manual.lnk
   • %Start Menu%\Programs\PSP Video Express\PSP Video Express.lnk
   • %Desktop%\PSP Video Express.lnk
   • %Program Files%\PQDVD\PSPVideoExpress\bt-uninst.exe
   • %System%\rmsupport.ax
   • %User Temp%\nsl2.tmp\ns3.tmp
   
   Note: To do a search for the following files, right-click Start then click Search... or Find..., depending on the version of Windows you are running. For each file to be deleted, type its file name in the Named input box. In the Look In drop-down list, select My Computer, then press Enter.
2. Once located, select the file then press SHIFT+DELETE to permanently delete the file.
3. Repeat the said steps for all files listed.

To delete malware/grayware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %Program Files%\PQDVD
   • %Program Files%\PQDVD\PSPVideoExpress
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\ADMINI~1
   • %User Profile%\LOCALS~1
   • %User Temp%\nsl2.tmp
   • %Program Files%\PQDVD\PSPVideoExpress\Temp
   • %System Root%\Documents and Settings\Administrator
   • %Start Menu%\Programs\PSP Video Express
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat the said steps for all folders listed.