HKTL_SQLINJECT

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CLASSES_ROOT
3. Still in the left panel, locate and delete the key:
   .hvj
4. Again Still in the left panel, locate and delete the key:
   havijfile
5. In the left panel, double-click the following:
   HKEY_CLASSES_ROOT>havijfile>shelll>open
6. Still in the left panel, locate and delete the key:
   command
7. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Uninstall
8. Still in the left panel, locate and delete the key:
   Havij_is1
9. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{3B7C8860-D78F-101B-B9B5-04021C009402}
10. Still in the left panel, locate and delete the key:
    Control
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
12. Still in the left panel, locate and delete the key:
    {3B7C8863-D78F-101B-B9B5-04021C009402}
13. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID
14. Still in the left panel, locate and delete the key:
    {B617B991-A767-4F05-99BA-AC6FCABB102E}
15. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B617B991-A767-4F05-99BA-AC6FCABB102E}
16. Still in the left panel, locate and delete the key:
    InprocServer32
17. Again Still in the left panel, locate and delete the key:
    {831FDD16-0C5C-11D2-A9FC-0000F8754DA1}
18. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{248DD896-BB45-11CF-9ABC-0080C7E7B78D}
19. Still in the left panel, locate and delete the key:
    Control
20. Again Still in the left panel, locate and delete the key:
    {248DD890-BB45-11CF-9ABC-0080C7E7B78D}
21. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{F9043C85-F6F2-101A-A3C9-08002B2F49FB}
22. Still in the left panel, locate and delete the key:
    Control
23. Again Still in the left panel, locate and delete the key:
    {F9043C88-F6F2-101A-A3C9-08002B2F49FB}
24. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>SharedDlls
3. In the right panel, locate and delete the entry:
   %System%\stdole2.tlb = "2"
4. Again In the right panel, locate and delete the entry:
   %System%\msvbvm60.dll = "2"
5. Again In the right panel, locate and delete the entry:
   %System%\oleaut32.dll = "2"
6. Again In the right panel, locate and delete the entry:
   %System%\olepro32.dll = "2"
7. Again In the right panel, locate and delete the entry:
   %System%\asycfilt.dll = "2"
8. Again In the right panel, locate and delete the entry:
   %System%\comcat.dll = "2"
9. Again In the right panel, locate and delete the entry:
   %System%\RICHTX32.ocx = "1"
10. Again In the right panel, locate and delete the entry:
    %System%\Mscomctl.ocx = "1"
11. Again In the right panel, locate and delete the entry:
    %System%\Mswinsck.ocx = "1"
12. Again In the right panel, locate and delete the entry:
    %System%\comdlg32.ocx = "1"
13. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>Havij_is1
14. In the right panel, locate and delete the entry:
    Inno Setup: Setup Version = "5.3.9 (a)"
15. Again In the right panel, locate and delete the entry:
    Inno Setup: App Path = "%Program Files%\Havij 1.14 Free"
16. Again In the right panel, locate and delete the entry:
    InstallLocation = "%Program Files%\Havij 1.14 Free"
17. Again In the right panel, locate and delete the entry:
    Inno Setup: Icon Group = "Havij 1.13 Free"
18. Again In the right panel, locate and delete the entry:
    Inno Setup: User = "Wilbert"
19. Again In the right panel, locate and delete the entry:
    Inno Setup: Deselected Tasks = "desktopicon"
20. Again In the right panel, locate and delete the entry:
    Inno Setup: Language = "english"
21. Again In the right panel, locate and delete the entry:
    DisplayName = "Havij 1.14 Free"
22. Again In the right panel, locate and delete the entry:
    UninstallString = "%Program Files%\Havij 1.14 Free\unins000.exe "
23. Again In the right panel, locate and delete the entry:
    QuietUninstallString = "%Program Files%\Havij 1.14 Free\unins000.exe /SILENT"
24. Again In the right panel, locate and delete the entry:
    Publisher = "ITSecTeam"
25. Again In the right panel, locate and delete the entry:
    URLInfoAbout = "http://ITSecTeam.com"
26. Again In the right panel, locate and delete the entry:
    HelpLink = "http://ITSecTeam.com"
27. Again In the right panel, locate and delete the entry:
    URLUpdateInfo = "http://ITSecTeam.com"
28. Again In the right panel, locate and delete the entry:
    NoModify = "1"
29. Again In the right panel, locate and delete the entry:
    NoRepair = "1"
30. Again In the right panel, locate and delete the entry:
    InstallDate = "20140209"
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{0BE35203-8F91-11CE-9DE3-00AA004BB851}
32. In the right panel, locate and delete the entry:
    CLSID = "Standard Font"
33. Again In the right panel, locate and delete the entry:
    InprocServer32 = "oleaut32.dll"
34. Again In the right panel, locate and delete the entry:
    ProgID = "StdFont"
35. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>StdFont
36. In the right panel, locate and delete the entry:
    CLSID = "{0BE35203-8F91-11CE-9DE3-00AA004BB851}"
37. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{46763EE0-CAB2-11CE-8C20-00AA0051E5D4}
38. In the right panel, locate and delete the entry:
    CLSID = "Obsolete Font"
39. Again In the right panel, locate and delete the entry:
    InprocServer32 = "oleaut32.dll"
40. Again In the right panel, locate and delete the entry:
    ProgID = "OldFont"
41. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>OldFont
42. In the right panel, locate and delete the entry:
    CLSID = "{46763EE0-CAB2-11CE-8C20-00AA0051E5D4}"
43. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{0BE35204-8F91-11CE-9DE3-00AA004BB851}
44. In the right panel, locate and delete the entry:
    CLSID = "Standard Picture"
45. Again In the right panel, locate and delete the entry:
    InprocServer32 = "oleaut32.dll"
46. Again In the right panel, locate and delete the entry:
    ProgID = "StdPicture"
47. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>StdPicture
48. In the right panel, locate and delete the entry:
    CLSID = "{0BE35204-8F91-11CE-9DE3-00AA004BB851}"
49. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B617B991-A767-4F05-99BA-AC6FCABB102E}>InprocServer32
50. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
51. Close Registry Editor.

To restore registry values this malware/grayware modified:

1. Open Registry Editor. To do this:
   
   • On Windows 2000, XP, and Server 2003:
     Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
   • On Windows Vista and 7:
     Click the Start button, type REGEDIT in the Search input field then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}>InProcServer32
3. In the right panel, locate the registry value:
   ThreadingModel = "Apartment"
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   ThreadingModel = "Apartment"
5. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>Services>Eventlog>Application>VBRuntime
6. In the right panel, locate the registry value:
   EventMessageFile = "%System%\msvbvm60.dll"
7. Right-click on the value name and choose Modify. Change the value data of this entry to:
   EventMessageFile = "%Windows%\system32\MSVBVM60.DLL"
8. Again In the right panel, locate the registry value:
   TypesSupported = "4"
9. Right-click on the value name and choose Modify. Change the value data of this entry to:
   TypesSupported = "4"
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{00020420-0000-0000-C000-000000000046}>InprocServer32
11. In the right panel, locate the registry value:
    ThreadingModel = "Both"
12. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Both"
13. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{00020421-0000-0000-C000-000000000046}>InprocServer32
14. In the right panel, locate the registry value:
    ThreadingModel = "Both"
15. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Both"
16. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{00020422-0000-0000-C000-000000000046}>InprocServer32
17. In the right panel, locate the registry value:
    ThreadingModel = "Both"
18. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Both"
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{00020423-0000-0000-C000-000000000046}>InprocServer32
20. In the right panel, locate the registry value:
    ThreadingModel = "Both"
21. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Both"
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{00020424-0000-0000-C000-000000000046}>InprocServer32
23. In the right panel, locate the registry value:
    ThreadingModel = "Both"
24. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Both"
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{00020425-0000-0000-C000-000000000046}>InprocServer32
26. In the right panel, locate the registry value:
    ThreadingModel = "Both"
27. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Both"
28. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B196B286-BAB4-101A-B69C-00AA00341D07}>InprocServer32
29. In the right panel, locate the registry value:
    ThreadingModel = "Both"
30. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Both"
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{0000002F-0000-0000-C000-000000000046}>InprocServer32
32. In the right panel, locate the registry value:
    ThreadingModel = "Both"
33. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Both"
34. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{0BE35203-8F91-11CE-9DE3-00AA004BB851}>InprocServer32
35. In the right panel, locate the registry value:
    ThreadingModel = "Both"
36. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Both"
37. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{0BE35204-8F91-11CE-9DE3-00AA004BB851}>InprocServer32
38. In the right panel, locate the registry value:
    ThreadingModel = "Apartment"
39. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Apartment"
40. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{3B7C8860-D78F-101B-B9B5-04021C009402}>InprocServer32
41. In the right panel, locate the registry value:
    ThreadingModel = "Apartment"
42. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Apartment"
43. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{2334D2B1-713E-11CF-8AE5-00AA00C00905}>TypeLib
44. In the right panel, locate the registry value:
    Version = "1.2"
45. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "2.0"
46. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{2334D2B3-713E-11CF-8AE5-00AA00C00905}>TypeLib
47. In the right panel, locate the registry value:
    Version = "1.2"
48. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "2.0"
49. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{ED117630-4090-11CF-8981-00AA00688B10}>TypeLib
50. In the right panel, locate the registry value:
    Version = "1.2"
51. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "1.2"
52. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{859321D0-3FD1-11CF-8981-00AA00688B10}>TypeLib
53. In the right panel, locate the registry value:
    Version = "1.2"
54. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "1.2"
55. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{E9A5593C-CAB0-11D1-8C0B-0000F8754DA1}>TypeLib
56. In the right panel, locate the registry value:
    Version = "1.2"
57. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "1.2"
58. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{3B7C8862-D78F-101B-B9B5-04021C009402}>TypeLib
59. In the right panel, locate the registry value:
    Version = "1.2"
60. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "1.2"
61. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{BDD1F04B-858B-11D1-B16A-00C0F0283628}>InprocServer32
62. In the right panel, locate the registry value:
    ThreadingModel = "Apartment"
63. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Apartment"
64. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{C74190B6-8589-11D1-B16A-00C0F0283628}>InprocServer32
65. In the right panel, locate the registry value:
    ThreadingModel = "Apartment"
66. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Apartment"
67. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{1EFB6596-857C-11D1-B16A-00C0F0283628}>InprocServer32
68. In the right panel, locate the registry value:
    ThreadingModel = "Apartment"
69. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Apartment"
70. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{66833FE6-8583-11D1-B16A-00C0F0283628}>InprocServer32
71. In the right panel, locate the registry value:
    ThreadingModel = "Apartment"
72. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Apartment"
73. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{2C247F23-8591-11D1-B16A-00C0F0283628}>InprocServer32
74. In the right panel, locate the registry value:
    ThreadingModel = "Apartment"
75. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Apartment"
76. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{8E3867A3-8586-11D1-B16A-00C0F0283628}>InprocServer32
77. In the right panel, locate the registry value:
    ThreadingModel = "Apartment"
78. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Apartment"
79. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{F08DF954-8592-11D1-B16A-00C0F0283628}>InprocServer32
80. In the right panel, locate the registry value:
    ThreadingModel = "Apartment"
81. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Apartment"
82. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{35053A22-8589-11D1-B16A-00C0F0283628}>InprocServer32
83. In the right panel, locate the registry value:
    ThreadingModel = "Apartment"
84. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Apartment"
85. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{DD9DA666-8594-11D1-B16A-00C0F0283628}>InprocServer32
86. In the right panel, locate the registry value:
    ThreadingModel = "Apartment"
87. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Apartment"
88. Again In the right panel, locate the registry value:
    Version = "2.0"
89. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "2.0"
90. Again In the right panel, locate the registry value:
    Version = "2.0"
91. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "2.0"
92. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{1EFB6594-857C-11D1-B16A-00C0F0283628}>TypeLib
93. In the right panel, locate the registry value:
    Version = "2.0"
94. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "2.0"
95. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{1EFB6595-857C-11D1-B16A-00C0F0283628}>TypeLib
96. In the right panel, locate the registry value:
    Version = "2.0"
97. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "2.0"
98. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{1EFB6597-857C-11D1-B16A-00C0F0283628}>TypeLib
99. In the right panel, locate the registry value:
    Version = "2.0"
100. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
101. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{1EFB6599-857C-11D1-B16A-00C0F0283628}>TypeLib
102. In the right panel, locate the registry value:
     Version = "2.0"
103. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
104. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{66833FE4-8583-11D1-B16A-00C0F0283628}>TypeLib
105. In the right panel, locate the registry value:
     Version = "2.0"
106. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
107. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{66833FE5-8583-11D1-B16A-00C0F0283628}>TypeLib
108. In the right panel, locate the registry value:
     Version = "2.0"
109. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
110. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{66833FE7-8583-11D1-B16A-00C0F0283628}>TypeLib
111. In the right panel, locate the registry value:
     Version = "2.0"
112. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
113. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{66833FE9-8583-11D1-B16A-00C0F0283628}>TypeLib
114. In the right panel, locate the registry value:
     Version = "2.0"
115. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
116. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{66833FEB-8583-11D1-B16A-00C0F0283628}>TypeLib
117. In the right panel, locate the registry value:
     Version = "2.0"
118. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
119. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{66833FED-8583-11D1-B16A-00C0F0283628}>TypeLib
120. In the right panel, locate the registry value:
     Version = "2.0"
121. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
122. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{8E3867A1-8586-11D1-B16A-00C0F0283628}>TypeLib
123. In the right panel, locate the registry value:
     Version = "2.0"
124. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
125. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{8E3867A2-8586-11D1-B16A-00C0F0283628}>TypeLib
126. In the right panel, locate the registry value:
     Version = "2.0"
127. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
128. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{8E3867A4-8586-11D1-B16A-00C0F0283628}>TypeLib
129. In the right panel, locate the registry value:
     Version = "2.0"
130. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
131. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{8E3867AA-8586-11D1-B16A-00C0F0283628}>TypeLib
132. In the right panel, locate the registry value:
     Version = "2.0"
133. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
134. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{35053A20-8589-11D1-B16A-00C0F0283628}>TypeLib
135. In the right panel, locate the registry value:
     Version = "2.0"
136. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
137. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{35053A21-8589-11D1-B16A-00C0F0283628}>TypeLib
138. In the right panel, locate the registry value:
     Version = "2.0"
139. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
140. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C74190B4-8589-11D1-B16A-00C0F0283628}>TypeLib
141. In the right panel, locate the registry value:
     Version = "2.0"
142. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
143. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C74190B5-8589-11D1-B16A-00C0F0283628}>TypeLib
144. In the right panel, locate the registry value:
     Version = "2.0"
145. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
146. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C74190B7-8589-11D1-B16A-00C0F0283628}>TypeLib
147. In the right panel, locate the registry value:
     Version = "2.0"
148. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
149. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C74190B8-8589-11D1-B16A-00C0F0283628}>TypeLib
150. In the right panel, locate the registry value:
     Version = "2.0"
151. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
152. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BDD1F049-858B-11D1-B16A-00C0F0283628}>TypeLib
153. In the right panel, locate the registry value:
     Version = "2.0"
154. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
155. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BDD1F04A-858B-11D1-B16A-00C0F0283628}>TypeLib
156. In the right panel, locate the registry value:
     Version = "2.0"
157. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
158. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BDD1F04C-858B-11D1-B16A-00C0F0283628}>TypeLib
159. In the right panel, locate the registry value:
     Version = "2.0"
160. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
161. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BDD1F04E-858B-11D1-B16A-00C0F0283628}>TypeLib
162. In the right panel, locate the registry value:
     Version = "2.0"
163. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
164. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BDD1F050-858B-11D1-B16A-00C0F0283628}>TypeLib
165. In the right panel, locate the registry value:
     Version = "2.0"
166. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
167. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BDD1F051-858B-11D1-B16A-00C0F0283628}>TypeLib
168. In the right panel, locate the registry value:
     Version = "2.0"
169. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
170. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BDD1F053-858B-11D1-B16A-00C0F0283628}>TypeLib
171. In the right panel, locate the registry value:
     Version = "2.0"
172. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
173. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BDD1F055-858B-11D1-B16A-00C0F0283628}>TypeLib
174. In the right panel, locate the registry value:
     Version = "2.0"
175. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
176. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{2C247F21-8591-11D1-B16A-00C0F0283628}>TypeLib
177. In the right panel, locate the registry value:
     Version = "2.0"
178. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
179. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{2C247F22-8591-11D1-B16A-00C0F0283628}>TypeLib
180. In the right panel, locate the registry value:
     Version = "2.0"
181. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
182. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{2C247F24-8591-11D1-B16A-00C0F0283628}>TypeLib
183. In the right panel, locate the registry value:
     Version = "2.0"
184. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
185. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{2C247F26-8591-11D1-B16A-00C0F0283628}>TypeLib
186. In the right panel, locate the registry value:
     Version = "2.0"
187. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
188. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{F08DF952-8592-11D1-B16A-00C0F0283628}>TypeLib
189. In the right panel, locate the registry value:
     Version = "2.0"
190. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
191. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{F08DF953-8592-11D1-B16A-00C0F0283628}>TypeLib
192. In the right panel, locate the registry value:
     Version = "2.0"
193. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
194. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C8A3DC00-8593-11D1-B16A-00C0F0283628}>TypeLib
195. In the right panel, locate the registry value:
     Version = "2.0"
196. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
197. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{DD9DA660-8594-11D1-B16A-00C0F0283628}>TypeLib
198. In the right panel, locate the registry value:
     Version = "2.0"
199. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
200. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{DD9DA662-8594-11D1-B16A-00C0F0283628}>TypeLib
201. In the right panel, locate the registry value:
     Version = "2.0"
202. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
203. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{DD9DA664-8594-11D1-B16A-00C0F0283628}>TypeLib
204. In the right panel, locate the registry value:
     Version = "2.0"
205. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
206. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{DD9DA665-8594-11D1-B16A-00C0F0283628}>TypeLib
207. In the right panel, locate the registry value:
     Version = "2.0"
208. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "2.0"
209. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{248DD896-BB45-11CF-9ABC-0080C7E7B78D}>InprocServer32
210. In the right panel, locate the registry value:
     ThreadingModel = "Apartment"
211. Right-click on the value name and choose Modify. Change the value data of this entry to:
     ThreadingModel = "Apartment"
212. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{248DD892-BB45-11CF-9ABC-0080C7E7B78D}>TypeLib
213. In the right panel, locate the registry value:
     Version = "1.0"
214. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "1.0"
215. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{248DD893-BB45-11CF-9ABC-0080C7E7B78D}>TypeLib
216. In the right panel, locate the registry value:
     Version = "1.0"
217. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "1.0"
218. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{F9043C85-F6F2-101A-A3C9-08002B2F49FB}>InprocServer32
219. In the right panel, locate the registry value:
     ThreadingModel = "Apartment"
220. Right-click on the value name and choose Modify. Change the value data of this entry to:
     ThreadingModel = "Apartment"
221. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{083039C2-13F4-11D1-8B7E-0000F8754DA1}>TypeLib
222. In the right panel, locate the registry value:
     Version = "1.2"
223. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "1.2"
224. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{F9043C87-F6F2-101A-A3C9-08002B2F49FB}>TypeLib
225. In the right panel, locate the registry value:
     Version = "1.2"
226. Right-click on the value name and choose Modify. Change the value data of this entry to:
     Version = "1.2"
227. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %User Temp%\is-01geu.tmp\{malware file name}.tmp
   • %User Temp%\is-TNTUH.tmp\_isetup\_RegDLL.tmp
   • %User Temp%\is-TNTUH.tmp\_isetup\_shfoldr.dll
   • %Program Files%\Havij 1.14 Free\unins000.dat
   • %Program Files%\Havij 1.14 Free\is-IDOER.tmp
   • %System%\is-EHK1K.tmp
   • %System%\is-EVP5O.tmp
   • %System%\is-PR2PO.tmp
   • %System%\is-UHAPU.tmp
   • %Program Files%\Havij 1.14 Free\is-M9I85.tmp
   • %Program Files%\Havij 1.14 Free\is-F4SHF.tmp
   • %Program Files%\Havij 1.14 Free\is-12HBA.tmp
   • %Program Files%\Havij 1.14 Free\is-7J84M.tmp
   • %Program Files%\Havij 1.14 Free\is-JLBST.tmp
   • %Program Files%\Havij 1.14 Free\is-89VK6.tmp
   • %Program Files%\Havij 1.14 Free\is-C9EVU.tmp
   • %Start Menu%\Programs\Havij 1.13 Free\Havij.lnk
   • %Start Menu%\Programs\Havij 1.13 Free\Read Me.lnk
   • %Start Menu%\Programs\Havij 1.13 Free\Help.lnk
   • %Start Menu%\Programs\Havij 1.13 Free\Uninstall Havij.lnk
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %User Temp%\is-01geu.tmp\{malware file name}.tmp
   • %User Temp%\is-TNTUH.tmp\_isetup\_RegDLL.tmp
   • %User Temp%\is-TNTUH.tmp\_isetup\_shfoldr.dll
   • %Program Files%\Havij 1.14 Free\unins000.dat
   • %Program Files%\Havij 1.14 Free\is-IDOER.tmp
   • %System%\is-EHK1K.tmp
   • %System%\is-EVP5O.tmp
   • %System%\is-PR2PO.tmp
   • %System%\is-UHAPU.tmp
   • %Program Files%\Havij 1.14 Free\is-M9I85.tmp
   • %Program Files%\Havij 1.14 Free\is-F4SHF.tmp
   • %Program Files%\Havij 1.14 Free\is-12HBA.tmp
   • %Program Files%\Havij 1.14 Free\is-7J84M.tmp
   • %Program Files%\Havij 1.14 Free\is-JLBST.tmp
   • %Program Files%\Havij 1.14 Free\is-89VK6.tmp
   • %Program Files%\Havij 1.14 Free\is-C9EVU.tmp
   • %Start Menu%\Programs\Havij 1.13 Free\Havij.lnk
   • %Start Menu%\Programs\Havij 1.13 Free\Read Me.lnk
   • %Start Menu%\Programs\Havij 1.13 Free\Help.lnk
   • %Start Menu%\Programs\Havij 1.13 Free\Uninstall Havij.lnk
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %User Temp%\is-01GEU.tmp
   • %User Temp%\is-TNTUH.tmp
   • %User Temp%\is-TNTUH.tmp\_isetup
   • %Program Files%\Havij 1.14 Free
   • %Start Menu%\Programs\Havij 1.13 Free
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %User Temp%\is-01GEU.tmp
   • %User Temp%\is-TNTUH.tmp
   • %User Temp%\is-TNTUH.tmp\_isetup
   • %Program Files%\Havij 1.14 Free
   • %Start Menu%\Programs\Havij 1.13 Free