TROJ_DONTOVO.SMJ

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Microsoft>Windows
3. Still in the left panel, locate and delete the key:
   Help
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>2BrightSparks
5. Still in the left panel, locate and delete the key:
   SyncBackSE
6. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>2BrightSparks
7. Still in the left panel, locate and delete the key:
   SyncBackSE
8. In the left panel, double-click the following:
   HKEY_CLASSES_ROOT
9. Still in the left panel, locate and delete the key:
   XceedSoftware.XceedZip.5
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>XceedSoftware.XceedZip.5
11. Still in the left panel, locate and delete the key:
    CLSID
12. Again Still in the left panel, locate and delete the key:
    Insertable
13. Again Still in the left panel, locate and delete the key:
    XceedSoftware.XceedZip
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>XceedSoftware.XceedZip
15. Still in the left panel, locate and delete the key:
    CLSID
16. Again Still in the left panel, locate and delete the key:
    CurVer
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
18. Still in the left panel, locate and delete the key:
    {DB797690-40E0-11D2-9BD5-0060082AE372}
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{DB797690-40E0-11D2-9BD5-0060082AE372}
20. Still in the left panel, locate and delete the key:
    ProgID
21. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
22. Again Still in the left panel, locate and delete the key:
    Programmable
23. Again Still in the left panel, locate and delete the key:
    InprocServer32
24. Again Still in the left panel, locate and delete the key:
    Control
25. Again Still in the left panel, locate and delete the key:
    Insertable
26. Again Still in the left panel, locate and delete the key:
    ToolboxBitmap32
27. Again Still in the left panel, locate and delete the key:
    MiscStatus
28. Again Still in the left panel, locate and delete the key:
    TypeLib
29. Again Still in the left panel, locate and delete the key:
    Version
30. Again Still in the left panel, locate and delete the key:
    Verb
31. Again Still in the left panel, locate and delete the key:
    XceedSoftware.XceedCompression.5
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>XceedSoftware.XceedCompression.5
33. Still in the left panel, locate and delete the key:
    CLSID
34. Again Still in the left panel, locate and delete the key:
    Insertable
35. Again Still in the left panel, locate and delete the key:
    XceedSoftware.XceedCompression
36. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>XceedSoftware.XceedCompression
37. Still in the left panel, locate and delete the key:
    CLSID
38. Again Still in the left panel, locate and delete the key:
    CurVer
39. Again Still in the left panel, locate and delete the key:
    {4C836512-BB70-11D2-A5A7-00105A9C91C6}
40. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{4C836512-BB70-11D2-A5A7-00105A9C91C6}
41. Still in the left panel, locate and delete the key:
    ProgID
42. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
43. Again Still in the left panel, locate and delete the key:
    Programmable
44. Again Still in the left panel, locate and delete the key:
    InprocServer32
45. Again Still in the left panel, locate and delete the key:
    Control
46. Again Still in the left panel, locate and delete the key:
    Insertable
47. Again Still in the left panel, locate and delete the key:
    ToolboxBitmap32
48. Again Still in the left panel, locate and delete the key:
    MiscStatus
49. Again Still in the left panel, locate and delete the key:
    TypeLib
50. Again Still in the left panel, locate and delete the key:
    Version
51. Again Still in the left panel, locate and delete the key:
    Verb
52. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
53. Still in the left panel, locate and delete the key:
    {DB797681-40E0-11D2-9BD5-0060082AE372}
54. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{DB797681-40E0-11D2-9BD5-0060082AE372}
55. Still in the left panel, locate and delete the key:
    5.3
56. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{DB797681-40E0-11D2-9BD5-0060082AE372}>5.3
57. Still in the left panel, locate and delete the key:
    FLAGS
58. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{DB797681-40E0-11D2-9BD5-0060082AE372}>5.3>0
59. Still in the left panel, locate and delete the key:
    win32
60. Again Still in the left panel, locate and delete the key:
    HELPDIR
61. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
62. Still in the left panel, locate and delete the key:
    {6CC24AD7-458C-45E6-B63C-8CC268A61EF7}
63. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{6CC24AD7-458C-45E6-B63C-8CC268A61EF7}
64. Still in the left panel, locate and delete the key:
    ProxyStubClsid
65. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
66. Again Still in the left panel, locate and delete the key:
    TypeLib
67. Again Still in the left panel, locate and delete the key:
    {DB79768F-40E0-11D2-9BD5-0060082AE372}
68. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{DB79768F-40E0-11D2-9BD5-0060082AE372}
69. Still in the left panel, locate and delete the key:
    ProxyStubClsid
70. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
71. Again Still in the left panel, locate and delete the key:
    TypeLib
72. Again Still in the left panel, locate and delete the key:
    {A0CECD40-EB84-11D2-A5CD-00105A9C91C6}
73. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A0CECD40-EB84-11D2-A5CD-00105A9C91C6}
74. Still in the left panel, locate and delete the key:
    ProxyStubClsid
75. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
76. Again Still in the left panel, locate and delete the key:
    TypeLib
77. Again Still in the left panel, locate and delete the key:
    {31C2DDD0-B692-11D4-BFE3-0060082AE372}
78. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{31C2DDD0-B692-11D4-BFE3-0060082AE372}
79. Still in the left panel, locate and delete the key:
    ProxyStubClsid
80. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
81. Again Still in the left panel, locate and delete the key:
    TypeLib
82. Again Still in the left panel, locate and delete the key:
    {CC6FD600-EE1D-11D4-801A-0060082AE372}
83. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{CC6FD600-EE1D-11D4-801A-0060082AE372}
84. Still in the left panel, locate and delete the key:
    ProxyStubClsid
85. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
86. Again Still in the left panel, locate and delete the key:
    TypeLib
87. Again Still in the left panel, locate and delete the key:
    {07189400-00F2-11D5-802D-0060082AE372}
88. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{07189400-00F2-11D5-802D-0060082AE372}
89. Still in the left panel, locate and delete the key:
    ProxyStubClsid
90. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
91. Again Still in the left panel, locate and delete the key:
    TypeLib
92. Again Still in the left panel, locate and delete the key:
    {BAA1401E-3F5F-47A4-870B-431D602D2488}
93. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BAA1401E-3F5F-47A4-870B-431D602D2488}
94. Still in the left panel, locate and delete the key:
    ProxyStubClsid
95. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
96. Again Still in the left panel, locate and delete the key:
    TypeLib
97. Again Still in the left panel, locate and delete the key:
    {7B78FDFA-2139-4FDC-9D81-4D4B9EF79271}
98. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{7B78FDFA-2139-4FDC-9D81-4D4B9EF79271}
99. Still in the left panel, locate and delete the key:
    ProxyStubClsid
100. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
101. Again Still in the left panel, locate and delete the key:
     TypeLib
102. Again Still in the left panel, locate and delete the key:
     {6991A191-8F4D-41CB-BFEA-5F5ED909FBD5}
103. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{6991A191-8F4D-41CB-BFEA-5F5ED909FBD5}
104. Still in the left panel, locate and delete the key:
     ProxyStubClsid
105. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
106. Again Still in the left panel, locate and delete the key:
     TypeLib
107. Again Still in the left panel, locate and delete the key:
     {AAC4831F-8C1F-434E-9F80-7F1B5B0036E0}
108. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{AAC4831F-8C1F-434E-9F80-7F1B5B0036E0}
109. Still in the left panel, locate and delete the key:
     ProxyStubClsid
110. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
111. Again Still in the left panel, locate and delete the key:
     TypeLib
112. Again Still in the left panel, locate and delete the key:
     {31C2DDD1-B692-11D4-BFE3-0060082AE372}
113. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{31C2DDD1-B692-11D4-BFE3-0060082AE372}
114. Still in the left panel, locate and delete the key:
     ProxyStubClsid
115. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
116. Again Still in the left panel, locate and delete the key:
     TypeLib
117. Again Still in the left panel, locate and delete the key:
     {31C2DDD2-B692-11D4-BFE3-0060082AE372}
118. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{31C2DDD2-B692-11D4-BFE3-0060082AE372}
119. Still in the left panel, locate and delete the key:
     ProxyStubClsid
120. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
121. Again Still in the left panel, locate and delete the key:
     TypeLib
122. Again Still in the left panel, locate and delete the key:
     {DB797691-40E0-11D2-9BD5-0060082AE372}
123. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{DB797691-40E0-11D2-9BD5-0060082AE372}
124. Still in the left panel, locate and delete the key:
     ProxyStubClsid
125. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
126. Again Still in the left panel, locate and delete the key:
     TypeLib
127. Again Still in the left panel, locate and delete the key:
     {77243A10-00F3-11D5-802D-0060082AE372}
128. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{77243A10-00F3-11D5-802D-0060082AE372}
129. Still in the left panel, locate and delete the key:
     ProxyStubClsid
130. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
131. Again Still in the left panel, locate and delete the key:
     TypeLib
132. Again Still in the left panel, locate and delete the key:
     {4C836511-BB70-11D2-A5A7-00105A9C91C6}
133. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{4C836511-BB70-11D2-A5A7-00105A9C91C6}
134. Still in the left panel, locate and delete the key:
     ProxyStubClsid
135. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
136. Again Still in the left panel, locate and delete the key:
     TypeLib
137. Again Still in the left panel, locate and delete the key:
     {05D56700-EB90-11D2-A5CD-00105A9C91C6}
138. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{05D56700-EB90-11D2-A5CD-00105A9C91C6}
139. Still in the left panel, locate and delete the key:
     ProxyStubClsid
140. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
141. Again Still in the left panel, locate and delete the key:
     TypeLib
142. Again Still in the left panel, locate and delete the key:
     {99C11080-CD22-11D4-BFFA-0060082AE372}
143. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{99C11080-CD22-11D4-BFFA-0060082AE372}
144. Still in the left panel, locate and delete the key:
     ProxyStubClsid
145. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
146. Again Still in the left panel, locate and delete the key:
     TypeLib
147. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>Help
3. In the right panel, locate and delete the entry:
   SyncbackSE.chm = "%Program Files%\2BrightSparks\SyncBackSE"
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>2BrightSparks>SyncBackSE
5. In the right panel, locate and delete the entry:
   InstalledPath = "%Program Files%\2BrightSparks\SyncBackSE"
6. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>2BrightSparks>SyncBackSE
7. In the right panel, locate and delete the entry:
   Language = "en"
8. Again In the right panel, locate and delete the entry:
   Language = "en"
9. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{DB797690-40E0-11D2-9BD5-0060082AE372}>InprocServer32
10. In the right panel, locate and delete the entry:
    ThreadingModel = "Both"
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{4C836512-BB70-11D2-A5A7-00105A9C91C6}>InprocServer32
12. In the right panel, locate and delete the entry:
    ThreadingModel = "Both"
13. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{6CC24AD7-458C-45E6-B63C-8CC268A61EF7}>TypeLib
14. In the right panel, locate and delete the entry:
    Version = "5.3"
15. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{DB79768F-40E0-11D2-9BD5-0060082AE372}>TypeLib
16. In the right panel, locate and delete the entry:
    Version = "5.3"
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A0CECD40-EB84-11D2-A5CD-00105A9C91C6}>TypeLib
18. In the right panel, locate and delete the entry:
    Version = "5.3"
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{31C2DDD0-B692-11D4-BFE3-0060082AE372}>TypeLib
20. In the right panel, locate and delete the entry:
    Version = "5.3"
21. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{CC6FD600-EE1D-11D4-801A-0060082AE372}>TypeLib
22. In the right panel, locate and delete the entry:
    Version = "5.3"
23. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{07189400-00F2-11D5-802D-0060082AE372}>TypeLib
24. In the right panel, locate and delete the entry:
    Version = "5.3"
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BAA1401E-3F5F-47A4-870B-431D602D2488}>TypeLib
26. In the right panel, locate and delete the entry:
    Version = "5.3"
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{7B78FDFA-2139-4FDC-9D81-4D4B9EF79271}>TypeLib
28. In the right panel, locate and delete the entry:
    Version = "5.3"
29. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{6991A191-8F4D-41CB-BFEA-5F5ED909FBD5}>TypeLib
30. In the right panel, locate and delete the entry:
    Version = "5.3"
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{AAC4831F-8C1F-434E-9F80-7F1B5B0036E0}>TypeLib
32. In the right panel, locate and delete the entry:
    Version = "5.3"
33. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{31C2DDD1-B692-11D4-BFE3-0060082AE372}>TypeLib
34. In the right panel, locate and delete the entry:
    Version = "5.3"
35. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{31C2DDD2-B692-11D4-BFE3-0060082AE372}>TypeLib
36. In the right panel, locate and delete the entry:
    Version = "5.3"
37. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{DB797691-40E0-11D2-9BD5-0060082AE372}>TypeLib
38. In the right panel, locate and delete the entry:
    Version = "5.3"
39. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{77243A10-00F3-11D5-802D-0060082AE372}>TypeLib
40. In the right panel, locate and delete the entry:
    Version = "5.3"
41. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{4C836511-BB70-11D2-A5A7-00105A9C91C6}>TypeLib
42. In the right panel, locate and delete the entry:
    Version = "5.3"
43. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{05D56700-EB90-11D2-A5CD-00105A9C91C6}>TypeLib
44. In the right panel, locate and delete the entry:
    Version = "5.3"
45. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{99C11080-CD22-11D4-BFFA-0060082AE372}>TypeLib
46. In the right panel, locate and delete the entry:
    Version = "5.3"
47. Close Registry Editor.

To delete malware/grayware/spyware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\ADMINI~1
   • %User Profile%\LOCALS~1
   • %User Temp%\nsc2.tmp
   • %User Temp%\is-KI48U.tmp
   • %User Temp%\is-J8M0P.tmp
   • %User Temp%\is-J8M0P.tmp\_isetup
   • %Program Files%\2BrightSparks
   • %Program Files%\2BrightSparks\SyncBackSE
   • %Application Data%\2BrightSparks
   • %Application Data%\2BrightSparks\SyncBack
   • %Program Files%\2BrightSparks\SyncBackSE\locale
   • %Program Files%\2BrightSparks\SyncBackSE\locale\CA
   • %Program Files%\2BrightSparks\SyncBackSE\locale\CA\LC_MESSAGES
   • %Program Files%\2BrightSparks\SyncBackSE\locale\DE
   • %Program Files%\2BrightSparks\SyncBackSE\locale\DE\LC_MESSAGES
   • %Program Files%\2BrightSparks\SyncBackSE\locale\ES
   • %Program Files%\2BrightSparks\SyncBackSE\locale\ES\LC_MESSAGES
   • %Program Files%\2BrightSparks\SyncBackSE\locale\FR
   • %Program Files%\2BrightSparks\SyncBackSE\locale\FR\LC_MESSAGES
   • %Program Files%\2BrightSparks\SyncBackSE\locale\IT
   • %Program Files%\2BrightSparks\SyncBackSE\locale\IT\LC_MESSAGES
   • %Program Files%\2BrightSparks\SyncBackSE\locale\NL
   • %Program Files%\2BrightSparks\SyncBackSE\locale\NL\LC_MESSAGES
   • %Program Files%\2BrightSparks\SyncBackSE\locale\PL
   • %Program Files%\2BrightSparks\SyncBackSE\locale\PL\LC_MESSAGES
   • %Program Files%\2BrightSparks\SyncBackSE\locale\PT_BR
   • %Program Files%\2BrightSparks\SyncBackSE\locale\PT_BR\LC_MESSAGES
   • %Program Files%\2BrightSparks\SyncBackSE\locale\ZH
   • %Program Files%\2BrightSparks\SyncBackSE\locale\ZH\LC_MESSAGES
   • %Program Files%\2BrightSparks\SyncBackSE\locale\ZH_HK
   • %Program Files%\2BrightSparks\SyncBackSE\locale\ZH_HK\LC_MESSAGES
   • %Program Files%\2BrightSparks\SyncBackSE\locale\HU
   • %Program Files%\2BrightSparks\SyncBackSE\locale\HU\LC_MESSAGES
   • %Program Files%\2BrightSparks\SyncBackSE\locale\CS
   • %Program Files%\2BrightSparks\SyncBackSE\locale\CS\LC_MESSAGES
   • %Program Files%\2BrightSparks\SyncBackSE\locale\NB
   • %Program Files%\2BrightSparks\SyncBackSE\locale\NB\LC_MESSAGES
   • %Program Files%\2BrightSparks\SyncBackSE\locale\SV
   • %Program Files%\2BrightSparks\SyncBackSE\locale\SV\LC_MESSAGES
   • %Program Files%\2BrightSparks\SyncBackSE\locale\JA
   • %Program Files%\2BrightSparks\SyncBackSE\locale\JA\LC_MESSAGES
   • %Start Menu%\Programs\2BrightSparks
   • %Start Menu%\Programs\2BrightSparks\SyncBackSE
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\ADMINI~1
   • %User Profile%\LOCALS~1
   • %User Temp%\nsc2.tmp
   • %User Temp%\is-KI48U.tmp
   • %User Temp%\is-J8M0P.tmp
   • %User Temp%\is-J8M0P.tmp\_isetup
   • %Program Files%\2BrightSparks
   • %Program Files%\2BrightSparks\SyncBackSE
   • %Application Data%\2BrightSparks
   • %Application Data%\2BrightSparks\SyncBack
   • %Program Files%\2BrightSparks\SyncBackSE\locale
   • %Program Files%\2BrightSparks\SyncBackSE\locale\CA
   • %Program Files%\2BrightSparks\SyncBackSE\locale\CA\LC_MESSAGES
   • %Program Files%\2BrightSparks\SyncBackSE\locale\DE
   • %Program Files%\2BrightSparks\SyncBackSE\locale\DE\LC_MESSAGES
   • %Program Files%\2BrightSparks\SyncBackSE\locale\ES
   • %Program Files%\2BrightSparks\SyncBackSE\locale\ES\LC_MESSAGES
   • %Program Files%\2BrightSparks\SyncBackSE\locale\FR
   • %Program Files%\2BrightSparks\SyncBackSE\locale\FR\LC_MESSAGES
   • %Program Files%\2BrightSparks\SyncBackSE\locale\IT
   • %Program Files%\2BrightSparks\SyncBackSE\locale\IT\LC_MESSAGES
   • %Program Files%\2BrightSparks\SyncBackSE\locale\NL
   • %Program Files%\2BrightSparks\SyncBackSE\locale\NL\LC_MESSAGES
   • %Program Files%\2BrightSparks\SyncBackSE\locale\PL
   • %Program Files%\2BrightSparks\SyncBackSE\locale\PL\LC_MESSAGES
   • %Program Files%\2BrightSparks\SyncBackSE\locale\PT_BR
   • %Program Files%\2BrightSparks\SyncBackSE\locale\PT_BR\LC_MESSAGES
   • %Program Files%\2BrightSparks\SyncBackSE\locale\ZH
   • %Program Files%\2BrightSparks\SyncBackSE\locale\ZH\LC_MESSAGES
   • %Program Files%\2BrightSparks\SyncBackSE\locale\ZH_HK
   • %Program Files%\2BrightSparks\SyncBackSE\locale\ZH_HK\LC_MESSAGES
   • %Program Files%\2BrightSparks\SyncBackSE\locale\HU
   • %Program Files%\2BrightSparks\SyncBackSE\locale\HU\LC_MESSAGES
   • %Program Files%\2BrightSparks\SyncBackSE\locale\CS
   • %Program Files%\2BrightSparks\SyncBackSE\locale\CS\LC_MESSAGES
   • %Program Files%\2BrightSparks\SyncBackSE\locale\NB
   • %Program Files%\2BrightSparks\SyncBackSE\locale\NB\LC_MESSAGES
   • %Program Files%\2BrightSparks\SyncBackSE\locale\SV
   • %Program Files%\2BrightSparks\SyncBackSE\locale\SV\LC_MESSAGES
   • %Program Files%\2BrightSparks\SyncBackSE\locale\JA
   • %Program Files%\2BrightSparks\SyncBackSE\locale\JA\LC_MESSAGES
   • %Start Menu%\Programs\2BrightSparks
   • %Start Menu%\Programs\2BrightSparks\SyncBackSE

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %User Temp%\nsc2.tmp\SyncBackSE_Setup.exe
   • %User Temp%\nsc2.tmp\binded.exe
   • %User Temp%\is-KI48U.tmp\SyncBackSE_Setup.tmp
   • %User Temp%\is-J8M0P.tmp\_isetup\_RegDLL.tmp
   • %User Temp%\is-J8M0P.tmp\_isetup\_shfoldr.dll
   • %User Temp%\is-J8M0P.tmp\Update3to4.exe
   • %User Temp%\is-J8M0P.tmp\Upgrading.htm
   • %User Temp%\is-J8M0P.tmp\upgrade-v3-v4-1.gif
   • %User Temp%\is-J8M0P.tmp\upgrade-v3-v4-2.gif
   • %User Temp%\is-J8M0P.tmp\upgrade-v3-v4-3.jpg
   • %User Temp%\is-J8M0P.tmp\issi_splash.bmp
   • %Program Files%\2BrightSparks\SyncBackSE\unins000.dat
   • %Program Files%\2BrightSparks\SyncBackSE\is-1GMBC.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-M5D6J.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-VQHDT.tmp
   • %Application Data%\2BrightSparks\SyncBack\is-1F8EL.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-2ICVM.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-N12N2.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-DFIN6.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-H4RG5.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-PFB65.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-25KIH.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-64I7I.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-EBO51.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-7ALTK.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-CPJIP.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-QBRVP.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-4OIH2.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-Q79OP.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-OM6LH.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-JPAKI.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-VR7S0.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-CKGUC.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-76OSI.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-1VDEM.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-HGSHI.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-47P96.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-997DJ.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-OHEAS.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-EEQ1G.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-TJA7U.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-FVFIC.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-FQNPS.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-NMCVJ.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\CA\LC_MESSAGES\is-Q9QTD.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\CA\LC_MESSAGES\is-91SON.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\DE\LC_MESSAGES\is-1QR0F.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\DE\LC_MESSAGES\is-H233I.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\DE\LC_MESSAGES\is-EV80A.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\ES\LC_MESSAGES\is-R2MI9.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\ES\LC_MESSAGES\is-4MLND.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\ES\LC_MESSAGES\is-BR996.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\FR\LC_MESSAGES\is-MM9RE.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\FR\LC_MESSAGES\is-SIEKT.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\FR\LC_MESSAGES\is-CEOBD.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\IT\LC_MESSAGES\is-L99G7.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\IT\LC_MESSAGES\is-PBADG.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\IT\LC_MESSAGES\is-9LEQ8.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\NL\LC_MESSAGES\is-5ABT8.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\NL\LC_MESSAGES\is-098SC.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\NL\LC_MESSAGES\is-QBR99.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\PL\LC_MESSAGES\is-3Q705.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\PL\LC_MESSAGES\is-07O1L.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\PT_BR\LC_MESSAGES\is-9V5LD.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\PT_BR\LC_MESSAGES\is-DBBLH.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\PT_BR\LC_MESSAGES\is-F0R89.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\ZH\LC_MESSAGES\is-J191C.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\ZH\LC_MESSAGES\is-0FL73.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\ZH_HK\LC_MESSAGES\is-M4UCU.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\HU\LC_MESSAGES\is-83HOE.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\HU\LC_MESSAGES\is-LNLP6.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\CS\LC_MESSAGES\is-RJ216.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\CS\LC_MESSAGES\is-1PVUB.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\NB\LC_MESSAGES\is-NG0QC.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\NB\LC_MESSAGES\is-EH5PR.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\SV\LC_MESSAGES\is-UH9ND.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\SV\LC_MESSAGES\is-DTSCE.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\SV\LC_MESSAGES\is-C1SRQ.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\JA\LC_MESSAGES\is-5TN82.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\JA\LC_MESSAGES\is-2MR1G.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\JA\LC_MESSAGES\is-RULDV.tmp
   • %Start Menu%\Programs\2BrightSparks\SyncBackSE\SyncBackSE.lnk
   • %Start Menu%\Programs\2BrightSparks\SyncBackSE\Help.lnk
   • %Start Menu%\Programs\2BrightSparks\SyncBackSE\Mailing List.lnk
   • %Start Menu%\Programs\2BrightSparks\SyncBackSE\Online Forums.lnk
   • %Start Menu%\Programs\2BrightSparks\SyncBackSE\Uninstall SyncBackSE.lnk
   • %Desktop%\SyncBackSE.lnk
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %User Temp%\nsc2.tmp\SyncBackSE_Setup.exe
   • %User Temp%\nsc2.tmp\binded.exe
   • %User Temp%\is-KI48U.tmp\SyncBackSE_Setup.tmp
   • %User Temp%\is-J8M0P.tmp\_isetup\_RegDLL.tmp
   • %User Temp%\is-J8M0P.tmp\_isetup\_shfoldr.dll
   • %User Temp%\is-J8M0P.tmp\Update3to4.exe
   • %User Temp%\is-J8M0P.tmp\Upgrading.htm
   • %User Temp%\is-J8M0P.tmp\upgrade-v3-v4-1.gif
   • %User Temp%\is-J8M0P.tmp\upgrade-v3-v4-2.gif
   • %User Temp%\is-J8M0P.tmp\upgrade-v3-v4-3.jpg
   • %User Temp%\is-J8M0P.tmp\issi_splash.bmp
   • %Program Files%\2BrightSparks\SyncBackSE\unins000.dat
   • %Program Files%\2BrightSparks\SyncBackSE\is-1GMBC.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-M5D6J.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-VQHDT.tmp
   • %Application Data%\2BrightSparks\SyncBack\is-1F8EL.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-2ICVM.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-N12N2.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-DFIN6.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-H4RG5.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-PFB65.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-25KIH.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-64I7I.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-EBO51.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-7ALTK.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-CPJIP.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-QBRVP.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-4OIH2.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-Q79OP.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-OM6LH.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-JPAKI.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-VR7S0.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-CKGUC.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-76OSI.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-1VDEM.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-HGSHI.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-47P96.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-997DJ.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-OHEAS.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-EEQ1G.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-TJA7U.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-FVFIC.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-FQNPS.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\is-NMCVJ.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\CA\LC_MESSAGES\is-Q9QTD.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\CA\LC_MESSAGES\is-91SON.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\DE\LC_MESSAGES\is-1QR0F.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\DE\LC_MESSAGES\is-H233I.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\DE\LC_MESSAGES\is-EV80A.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\ES\LC_MESSAGES\is-R2MI9.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\ES\LC_MESSAGES\is-4MLND.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\ES\LC_MESSAGES\is-BR996.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\FR\LC_MESSAGES\is-MM9RE.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\FR\LC_MESSAGES\is-SIEKT.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\FR\LC_MESSAGES\is-CEOBD.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\IT\LC_MESSAGES\is-L99G7.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\IT\LC_MESSAGES\is-PBADG.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\IT\LC_MESSAGES\is-9LEQ8.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\NL\LC_MESSAGES\is-5ABT8.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\NL\LC_MESSAGES\is-098SC.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\NL\LC_MESSAGES\is-QBR99.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\PL\LC_MESSAGES\is-3Q705.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\PL\LC_MESSAGES\is-07O1L.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\PT_BR\LC_MESSAGES\is-9V5LD.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\PT_BR\LC_MESSAGES\is-DBBLH.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\PT_BR\LC_MESSAGES\is-F0R89.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\ZH\LC_MESSAGES\is-J191C.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\ZH\LC_MESSAGES\is-0FL73.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\ZH_HK\LC_MESSAGES\is-M4UCU.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\HU\LC_MESSAGES\is-83HOE.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\HU\LC_MESSAGES\is-LNLP6.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\CS\LC_MESSAGES\is-RJ216.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\CS\LC_MESSAGES\is-1PVUB.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\NB\LC_MESSAGES\is-NG0QC.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\NB\LC_MESSAGES\is-EH5PR.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\SV\LC_MESSAGES\is-UH9ND.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\SV\LC_MESSAGES\is-DTSCE.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\SV\LC_MESSAGES\is-C1SRQ.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\JA\LC_MESSAGES\is-5TN82.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\JA\LC_MESSAGES\is-2MR1G.tmp
   • %Program Files%\2BrightSparks\SyncBackSE\locale\JA\LC_MESSAGES\is-RULDV.tmp
   • %Start Menu%\Programs\2BrightSparks\SyncBackSE\SyncBackSE.lnk
   • %Start Menu%\Programs\2BrightSparks\SyncBackSE\Help.lnk
   • %Start Menu%\Programs\2BrightSparks\SyncBackSE\Mailing List.lnk
   • %Start Menu%\Programs\2BrightSparks\SyncBackSE\Online Forums.lnk
   • %Start Menu%\Programs\2BrightSparks\SyncBackSE\Uninstall SyncBackSE.lnk
   • %Desktop%\SyncBackSE.lnk
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.