TROJ_PAM_0000050366.T3

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>SOFTWARE
3. Still in the left panel, locate and delete the key:
   1ClickDownload
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Uninstall
5. Still in the left panel, locate and delete the key:
   1ClickDownloader
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Google>Chrome>Extensions
7. Still in the left panel, locate and delete the key:
   jplinpmadfkdgipabgcdchbdikologlh
8. In the left panel, double-click the following:
   HKEY_CLASSES_ROOT>AppID>{5B1881D1-D9C7-46df-B041-1E593282C7D0}>Instl
9. Still in the left panel, locate and delete the key:
   Data
10. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>AppID>{EA28B360-05E0-4F93-8150-02891F1D8D3C}>Instl
11. Still in the left panel, locate and delete the key:
    Data
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall
13. Still in the left panel, locate and delete the key:
    BabylonToolbar
14. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software
15. Still in the left panel, locate and delete the key:
    SweetIM
16. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software
17. Still in the left panel, locate and delete the key:
    SweetIM
18. Again Still in the left panel, locate and delete the key:
    BabyTest
19. Again Still in the left panel, locate and delete the key:
    BabyTest
20. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT
21. Still in the left panel, locate and delete the key:
    Test.cap
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Babylon
23. Still in the left panel, locate and delete the key:
    Babylon Client
24. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Babylon>Babylon Client
25. Still in the left panel, locate and delete the key:
    DefaultSettings
26. Again Still in the left panel, locate and delete the key:
    Prod.cap
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>BabylonToolbar>BabylonToolbar
28. Still in the left panel, locate and delete the key:
    Instl
29. Again Still in the left panel, locate and delete the key:
    BabylonToolbar
30. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>AppID>{BDB69379-802F-4eaf-B541-F8DE92DD98DB}>instl
31. Still in the left panel, locate and delete the key:
    data
32. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>BabylonToolbar>BabylonToolbar
33. Still in the left panel, locate and delete the key:
    user
34. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID
35. Still in the left panel, locate and delete the key:
    {4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
36. Again Still in the left panel, locate and delete the key:
    escorTlbr.DLL
37. Again Still in the left panel, locate and delete the key:
    Babylon.dskBnd.1
38. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Babylon.dskBnd.1
39. Still in the left panel, locate and delete the key:
    CLSID
40. Again Still in the left panel, locate and delete the key:
    Babylon.dskBnd
41. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Babylon.dskBnd
42. Still in the left panel, locate and delete the key:
    CLSID
43. Again Still in the left panel, locate and delete the key:
    CurVer
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
45. Still in the left panel, locate and delete the key:
    {98889811-442D-49dd-99D7-DC866BE87DBC}
46. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{98889811-442D-49dd-99D7-DC866BE87DBC}
47. Still in the left panel, locate and delete the key:
    ProgID
48. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
49. Again Still in the left panel, locate and delete the key:
    Programmable
50. Again Still in the left panel, locate and delete the key:
    InprocServer32
51. Again Still in the left panel, locate and delete the key:
    TypeLib
52. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
53. Still in the left panel, locate and delete the key:
    {4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
54. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
55. Still in the left panel, locate and delete the key:
    1.0
56. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}>1.0
57. Still in the left panel, locate and delete the key:
    FLAGS
58. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}>1.0>0
59. Still in the left panel, locate and delete the key:
    win32
60. Again Still in the left panel, locate and delete the key:
    HELPDIR
61. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Low Rights>ElevationPolicy
62. Still in the left panel, locate and delete the key:
    {8375D9C8-634F-4ECB-8CF5-C7416BA5D542}
63. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer
64. Still in the left panel, locate and delete the key:
    Browser Helper Objects
65. Again Still in the left panel, locate and delete the key:
    {09C554C3-109B-483C-A06B-F14172F1A947}
66. Again Still in the left panel, locate and delete the key:
    escort.DLL
67. Again Still in the left panel, locate and delete the key:
    escort.escortIEPane.1
68. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>escort.escortIEPane.1
69. Still in the left panel, locate and delete the key:
    CLSID
70. Again Still in the left panel, locate and delete the key:
    escort.escortIEPane
71. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>escort.escortIEPane
72. Still in the left panel, locate and delete the key:
    CLSID
73. Again Still in the left panel, locate and delete the key:
    CurVer
74. Again Still in the left panel, locate and delete the key:
    {97F2FF5B-260C-4ccf-834A-2DDA4E29E39E}
75. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{97F2FF5B-260C-4ccf-834A-2DDA4E29E39E}
76. Still in the left panel, locate and delete the key:
    ProgID
77. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
78. Again Still in the left panel, locate and delete the key:
    Programmable
79. Again Still in the left panel, locate and delete the key:
    InprocServer32
80. Again Still in the left panel, locate and delete the key:
    TypeLib
81. Again Still in the left panel, locate and delete the key:
    escort.escrtBtn.1
82. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>escort.escrtBtn.1
83. Still in the left panel, locate and delete the key:
    CLSID
84. Again Still in the left panel, locate and delete the key:
    CurVer
85. Again Still in the left panel, locate and delete the key:
    {E46C8196-B634-44a1-AF6E-957C64278AB1}
86. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{E46C8196-B634-44a1-AF6E-957C64278AB1}
87. Still in the left panel, locate and delete the key:
    ProgID
88. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
89. Again Still in the left panel, locate and delete the key:
    Programmable
90. Again Still in the left panel, locate and delete the key:
    InprocServer32
91. Again Still in the left panel, locate and delete the key:
    TypeLib
92. Again Still in the left panel, locate and delete the key:
    bbylntlbr.bbylntlbrHlpr.1
93. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>bbylntlbr.bbylntlbrHlpr.1
94. Still in the left panel, locate and delete the key:
    CLSID
95. Again Still in the left panel, locate and delete the key:
    bbylntlbr.bbylntlbrHlpr
96. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>bbylntlbr.bbylntlbrHlpr
97. Still in the left panel, locate and delete the key:
    CLSID
98. Again Still in the left panel, locate and delete the key:
    CurVer
99. Again Still in the left panel, locate and delete the key:
    {2EECD738-5844-4a99-B4B6-146BF802613B}
100. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{2EECD738-5844-4a99-B4B6-146BF802613B}
101. Still in the left panel, locate and delete the key:
     ProgID
102. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
103. Again Still in the left panel, locate and delete the key:
     Programmable
104. Again Still in the left panel, locate and delete the key:
     InprocServer32
105. Again Still in the left panel, locate and delete the key:
     TypeLib
106. Again Still in the left panel, locate and delete the key:
     Implemented Categories
107. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{97F2FF5B-260C-4ccf-834A-2DDA4E29E39E}>Implemented Categories
108. Still in the left panel, locate and delete the key:
     {00021493-0000-0000-C000-000000000046}
109. Again Still in the left panel, locate and delete the key:
     Instance
110. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{97F2FF5B-260C-4ccf-834A-2DDA4E29E39E}>Instance
111. Still in the left panel, locate and delete the key:
     InitPropertyBag
112. Again Still in the left panel, locate and delete the key:
     {D7EE8177-D51E-4F89-92B6-83EA2EC40800}
113. Again Still in the left panel, locate and delete the key:
     escortApp.DLL
114. Again Still in the left panel, locate and delete the key:
     bbylnApp.appCore.1
115. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>bbylnApp.appCore.1
116. Still in the left panel, locate and delete the key:
     CLSID
117. Again Still in the left panel, locate and delete the key:
     bbylnApp.appCore
118. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>bbylnApp.appCore
119. Still in the left panel, locate and delete the key:
     CLSID
120. Again Still in the left panel, locate and delete the key:
     CurVer
121. Again Still in the left panel, locate and delete the key:
     {FFB9ADCB-8C79-4C29-81D3-74D46A93D370}
122. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{FFB9ADCB-8C79-4C29-81D3-74D46A93D370}
123. Still in the left panel, locate and delete the key:
     ProgID
124. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
125. Again Still in the left panel, locate and delete the key:
     Programmable
126. Again Still in the left panel, locate and delete the key:
     InprocServer32
127. Again Still in the left panel, locate and delete the key:
     TypeLib
128. Again Still in the left panel, locate and delete the key:
     {D7EE8177-D51E-4F89-92B6-83EA2EC40800}
129. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
130. Still in the left panel, locate and delete the key:
     1.0
131. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{D7EE8177-D51E-4F89-92B6-83EA2EC40800}>1.0
132. Still in the left panel, locate and delete the key:
     FLAGS
133. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{D7EE8177-D51E-4F89-92B6-83EA2EC40800}>1.0>0
134. Still in the left panel, locate and delete the key:
     win32
135. Again Still in the left panel, locate and delete the key:
     HELPDIR
136. Again Still in the left panel, locate and delete the key:
     {6E8BF012-2C85-4834-B10A-1B31AF173D70}
137. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{6E8BF012-2C85-4834-B10A-1B31AF173D70}
138. Still in the left panel, locate and delete the key:
     1.0
139. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{6E8BF012-2C85-4834-B10A-1B31AF173D70}>1.0
140. Still in the left panel, locate and delete the key:
     FLAGS
141. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{6E8BF012-2C85-4834-B10A-1B31AF173D70}>1.0>0
142. Still in the left panel, locate and delete the key:
     win32
143. Again Still in the left panel, locate and delete the key:
     HELPDIR
144. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
145. Still in the left panel, locate and delete the key:
     {E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}
146. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}
147. Still in the left panel, locate and delete the key:
     ProxyStubClsid
148. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
149. Again Still in the left panel, locate and delete the key:
     TypeLib
150. Again Still in the left panel, locate and delete the key:
     {44C3C1DB-2127-433C-98EC-4C9412B5FC3A}
151. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}
152. Still in the left panel, locate and delete the key:
     ProxyStubClsid
153. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
154. Again Still in the left panel, locate and delete the key:
     TypeLib
155. Again Still in the left panel, locate and delete the key:
     {E77EEF95-3E83-4BB8-9C0D-4A5163774997}
156. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{E77EEF95-3E83-4BB8-9C0D-4A5163774997}
157. Still in the left panel, locate and delete the key:
     ProxyStubClsid
158. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
159. Again Still in the left panel, locate and delete the key:
     TypeLib
160. Again Still in the left panel, locate and delete the key:
     {4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
161. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
162. Still in the left panel, locate and delete the key:
     ProxyStubClsid
163. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
164. Again Still in the left panel, locate and delete the key:
     TypeLib
165. Again Still in the left panel, locate and delete the key:
     {94C0B25D-3359-4B10-B227-F96A77DB773F}
166. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{94C0B25D-3359-4B10-B227-F96A77DB773F}
167. Still in the left panel, locate and delete the key:
     ProxyStubClsid
168. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
169. Again Still in the left panel, locate and delete the key:
     TypeLib
170. Again Still in the left panel, locate and delete the key:
     {B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}
171. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}
172. Still in the left panel, locate and delete the key:
     ProxyStubClsid
173. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
174. Again Still in the left panel, locate and delete the key:
     TypeLib
175. Again Still in the left panel, locate and delete the key:
     {B32672B3-F656-46E0-B584-FE61C0BB6037}
176. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B32672B3-F656-46E0-B584-FE61C0BB6037}
177. Still in the left panel, locate and delete the key:
     ProxyStubClsid
178. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
179. Again Still in the left panel, locate and delete the key:
     TypeLib
180. Again Still in the left panel, locate and delete the key:
     {706D4A4B-184A-4434-B331-296B07493D2D}
181. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{706D4A4B-184A-4434-B331-296B07493D2D}
182. Still in the left panel, locate and delete the key:
     ProxyStubClsid
183. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
184. Again Still in the left panel, locate and delete the key:
     TypeLib
185. Again Still in the left panel, locate and delete the key:
     {C2996524-2187-441F-A398-CD6CB6B3D020}
186. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C2996524-2187-441F-A398-CD6CB6B3D020}
187. Still in the left panel, locate and delete the key:
     ProxyStubClsid
188. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
189. Again Still in the left panel, locate and delete the key:
     TypeLib
190. Again Still in the left panel, locate and delete the key:
     {E047E227-5342-4D94-80F7-CFB154BF55BD}
191. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{E047E227-5342-4D94-80F7-CFB154BF55BD}
192. Still in the left panel, locate and delete the key:
     ProxyStubClsid
193. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
194. Again Still in the left panel, locate and delete the key:
     TypeLib
195. Again Still in the left panel, locate and delete the key:
     {BFE569F7-646C-4512-969B-9BE3E580D393}
196. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BFE569F7-646C-4512-969B-9BE3E580D393}
197. Still in the left panel, locate and delete the key:
     ProxyStubClsid
198. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
199. Again Still in the left panel, locate and delete the key:
     TypeLib
200. Again Still in the left panel, locate and delete the key:
     {B173667F-8395-4317-8DD6-45AD1FE00047}
201. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B173667F-8395-4317-8DD6-45AD1FE00047}
202. Still in the left panel, locate and delete the key:
     ProxyStubClsid
203. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
204. Again Still in the left panel, locate and delete the key:
     TypeLib
205. Again Still in the left panel, locate and delete the key:
     {8BE10F21-185F-4CA0-B789-9921674C3993}
206. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{8BE10F21-185F-4CA0-B789-9921674C3993}
207. Still in the left panel, locate and delete the key:
     ProxyStubClsid
208. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
209. Again Still in the left panel, locate and delete the key:
     TypeLib
210. Again Still in the left panel, locate and delete the key:
     {C2434722-5C85-4CA0-BA69-1B67E7AB3D68}
211. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}
212. Still in the left panel, locate and delete the key:
     ProxyStubClsid
213. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
214. Again Still in the left panel, locate and delete the key:
     TypeLib
215. Again Still in the left panel, locate and delete the key:
     {B12E99ED-69BD-437C-86BE-C862B9E5444D}
216. Again Still in the left panel, locate and delete the key:
     escortEng.DLL
217. Again Still in the left panel, locate and delete the key:
     b
218. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>b
219. Still in the left panel, locate and delete the key:
     CLSID
220. Again Still in the left panel, locate and delete the key:
     CurVer
221. Again Still in the left panel, locate and delete the key:
     {B8276A94-891D-453C-9FF3-715C042A2575}
222. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B8276A94-891D-453C-9FF3-715C042A2575}
223. Still in the left panel, locate and delete the key:
     ProgID
224. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
225. Again Still in the left panel, locate and delete the key:
     Programmable
226. Again Still in the left panel, locate and delete the key:
     InprocServer32
227. Again Still in the left panel, locate and delete the key:
     TypeLib
228. Again Still in the left panel, locate and delete the key:
     {35C1605E-438B-4D64-AAB1-8885F097A9B1}
229. Again Still in the left panel, locate and delete the key:
     esrv.EXE
230. Again Still in the left panel, locate and delete the key:
     esrv.BabylonESrvc.1
231. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>esrv.BabylonESrvc.1
232. Still in the left panel, locate and delete the key:
     CLSID
233. Again Still in the left panel, locate and delete the key:
     esrv.BabylonESrvc
234. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>esrv.BabylonESrvc
235. Still in the left panel, locate and delete the key:
     CLSID
236. Again Still in the left panel, locate and delete the key:
     CurVer
237. Again Still in the left panel, locate and delete the key:
     {291BCCC1-6890-484a-89D3-318C928DAC1B}
238. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{291BCCC1-6890-484a-89D3-318C928DAC1B}
239. Still in the left panel, locate and delete the key:
     ProgID
240. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
241. Again Still in the left panel, locate and delete the key:
     Programmable
242. Again Still in the left panel, locate and delete the key:
     LocalServer32
243. Again Still in the left panel, locate and delete the key:
     TypeLib
244. Again Still in the left panel, locate and delete the key:
     {35C1605E-438B-4D64-AAB1-8885F097A9B1}
245. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{35C1605E-438B-4D64-AAB1-8885F097A9B1}
246. Still in the left panel, locate and delete the key:
     1.0
247. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{35C1605E-438B-4D64-AAB1-8885F097A9B1}>1.0
248. Still in the left panel, locate and delete the key:
     FLAGS
249. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{35C1605E-438B-4D64-AAB1-8885F097A9B1}>1.0>0
250. Still in the left panel, locate and delete the key:
     win32
251. Again Still in the left panel, locate and delete the key:
     HELPDIR
252. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>1ClickDownload
3. In the right panel, locate and delete the entry:
   UID = "403898365"
4. Again In the right panel, locate and delete the entry:
   LastInstall = "30226544"
5. Again In the right panel, locate and delete the entry:
   LastInstall2 = "30226544"
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>1ClickDownloader
7. In the right panel, locate and delete the entry:
   DisplayName = "1ClickDownloader"
8. Again In the right panel, locate and delete the entry:
   UninstallString = "%Program Files%\1ClickDownload\uninstall.exe"
9. Again In the right panel, locate and delete the entry:
   DisplayVersion = "2.1 Build 26473"
10. Again In the right panel, locate and delete the entry:
    Publisher = "1ClickDownload"
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Google>Chrome>Extensions>jplinpmadfkdgipabgcdchbdikologlh
12. In the right panel, locate and delete the entry:
    path = "%Program Files%\1ClickDownload\1click11.crx"
13. Again In the right panel, locate and delete the entry:
    version = "1.1"
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>{5B1881D1-D9C7-46df-B041-1E593282C7D0}>Instl>Data
15. In the right panel, locate and delete the entry:
    afltId = "11111111"
16. Again In the right panel, locate and delete the entry:
    hrdId = "11111111"
17. Again In the right panel, locate and delete the entry:
    prtnrId = "11111111"
18. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>{EA28B360-05E0-4F93-8150-02891F1D8D3C}>Instl>Data
19. In the right panel, locate and delete the entry:
    afltId = "11111111"
20. Again In the right panel, locate and delete the entry:
    hrdId = "11111111"
21. Again In the right panel, locate and delete the entry:
    prtnrId = "11111111"
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>BabylonToolbar
23. In the right panel, locate and delete the entry:
    InstallDate = "20120308"
24. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>SweetIM
25. In the right panel, locate and delete the entry:
    simapp_id = "11111111"
26. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>SweetIM
27. In the right panel, locate and delete the entry:
    simapp_id = "11111111"
28. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Babylon>Babylon Client>DefaultSettings
29. In the right panel, locate and delete the entry:
    SetSearch = "3"
30. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Prod.cap
31. In the right panel, locate and delete the entry:
    tb = "mntr903"
32. Again In the right panel, locate and delete the entry:
    Info = "{random values}"
33. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>BabylonToolbar>BabylonToolbar>Instl
34. In the right panel, locate and delete the entry:
    babTrack = "affID
35. Again In the right panel, locate and delete the entry:
    srcExt = "ss"
36. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>BabylonToolbar>BabylonToolbar
37. In the right panel, locate and delete the entry:
    tlbrSrchUrl = "${TLBRSRCH_URL}"
38. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>{BDB69379-802F-4eaf-B541-F8DE92DD98DB}>instl>data
39. In the right panel, locate and delete the entry:
    tlbrSrchUrl = "${TLBRSRCH_URL}"
40. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>BabylonToolbar>BabylonToolbar>user
41. In the right panel, locate and delete the entry:
    dfltLng = "en"
42. Again In the right panel, locate and delete the entry:
    dfltLng = "en"
43. Again In the right panel, locate and delete the entry:
    instlRef = "sst"
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>escorTlbr.DLL
45. In the right panel, locate and delete the entry:
    AppID = "{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}"
46. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{98889811-442D-49dd-99D7-DC866BE87DBC}>InprocServer32
47. In the right panel, locate and delete the entry:
    ThreadingModel = "apartment"
48. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{98889811-442D-49dd-99D7-DC866BE87DBC}
49. In the right panel, locate and delete the entry:
    AppID = "{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}"
50. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Toolbar
51. In the right panel, locate and delete the entry:
    {98889811-442D-49dd-99D7-DC866BE87DBC} = "Babylon Toolbar"
52. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Low Rights>ElevationPolicy>{8375D9C8-634F-4ECB-8CF5-C7416BA5D542}
53. In the right panel, locate and delete the entry:
    Policy = "3"
54. Again In the right panel, locate and delete the entry:
    AppName = "BabylonToolbarsrv.exe"
55. Again In the right panel, locate and delete the entry:
    AppPath = "%Program Files%\BabylonToolbar\BabylonToolbar\1.5.3.17"
56. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Browser Helper Objects>{2EECD738-5844-4a99-B4B6-146BF802613B}
57. In the right panel, locate and delete the entry:
    NoExplorer = "1"
58. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>escort.DLL
59. In the right panel, locate and delete the entry:
    AppID = "{09C554C3-109B-483C-A06B-F14172F1A947}"
60. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{97F2FF5B-260C-4ccf-834A-2DDA4E29E39E}>InprocServer32
61. In the right panel, locate and delete the entry:
    ThreadingModel = "apartment"
62. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{97F2FF5B-260C-4ccf-834A-2DDA4E29E39E}
63. In the right panel, locate and delete the entry:
    AppID = "{09C554C3-109B-483C-A06B-F14172F1A947}"
64. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{E46C8196-B634-44a1-AF6E-957C64278AB1}>InprocServer32
65. In the right panel, locate and delete the entry:
    ThreadingModel = "apartment"
66. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{E46C8196-B634-44a1-AF6E-957C64278AB1}
67. In the right panel, locate and delete the entry:
    AppID = "{09C554C3-109B-483C-A06B-F14172F1A947}"
68. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{2EECD738-5844-4a99-B4B6-146BF802613B}>InprocServer32
69. In the right panel, locate and delete the entry:
    ThreadingModel = "apartment"
70. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{2EECD738-5844-4a99-B4B6-146BF802613B}
71. In the right panel, locate and delete the entry:
    AppID = "{09C554C3-109B-483C-A06B-F14172F1A947}"
72. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{97F2FF5B-260C-4ccf-834A-2DDA4E29E39E}>Instance
73. In the right panel, locate and delete the entry:
    CLSID = "{97F2FF5B-260C-4ccf-834A-2DDA4E29E39E}"
74. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{97F2FF5B-260C-4ccf-834A-2DDA4E29E39E}>Instance>InitPropertyBag
75. In the right panel, locate and delete the entry:
    URL = "about:blank"
76. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>escortApp.DLL
77. In the right panel, locate and delete the entry:
    AppID = "{D7EE8177-D51E-4F89-92B6-83EA2EC40800}"
78. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{FFB9ADCB-8C79-4C29-81D3-74D46A93D370}>InprocServer32
79. In the right panel, locate and delete the entry:
    ThreadingModel = "apartment"
80. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{FFB9ADCB-8C79-4C29-81D3-74D46A93D370}
81. In the right panel, locate and delete the entry:
    AppID = "{D7EE8177-D51E-4F89-92B6-83EA2EC40800}"
82. Again In the right panel, locate and delete the entry:
    afltId = "orgnl"
83. Again In the right panel, locate and delete the entry:
    cntrlId = "f0bdff950000000000000050568e00d9"
84. Again In the right panel, locate and delete the entry:
    hrdId = "f0bdff950000000000000050568e00d9"
85. Again In the right panel, locate and delete the entry:
    instlDay = "3c7b"
86. Again In the right panel, locate and delete the entry:
    prtnrId = "BabylonToolbar"
87. Again In the right panel, locate and delete the entry:
    sftId = "f36d58294bf541c59e3506a513a4fe12"
88. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}>TypeLib
89. In the right panel, locate and delete the entry:
    Version = "1.0"
90. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}>TypeLib
91. In the right panel, locate and delete the entry:
    Version = "1.0"
92. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{E77EEF95-3E83-4BB8-9C0D-4A5163774997}>TypeLib
93. In the right panel, locate and delete the entry:
    Version = "1.0"
94. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}>TypeLib
95. In the right panel, locate and delete the entry:
    Version = "1.0"
96. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{94C0B25D-3359-4B10-B227-F96A77DB773F}>TypeLib
97. In the right panel, locate and delete the entry:
    Version = "1.0"
98. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}>TypeLib
99. In the right panel, locate and delete the entry:
    Version = "1.0"
100. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B32672B3-F656-46E0-B584-FE61C0BB6037}>TypeLib
101. In the right panel, locate and delete the entry:
     Version = "1.0"
102. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{706D4A4B-184A-4434-B331-296B07493D2D}>TypeLib
103. In the right panel, locate and delete the entry:
     Version = "1.0"
104. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C2996524-2187-441F-A398-CD6CB6B3D020}>TypeLib
105. In the right panel, locate and delete the entry:
     Version = "1.0"
106. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{E047E227-5342-4D94-80F7-CFB154BF55BD}>TypeLib
107. In the right panel, locate and delete the entry:
     Version = "1.0"
108. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BFE569F7-646C-4512-969B-9BE3E580D393}>TypeLib
109. In the right panel, locate and delete the entry:
     Version = "1.0"
110. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B173667F-8395-4317-8DD6-45AD1FE00047}>TypeLib
111. In the right panel, locate and delete the entry:
     Version = "1.0"
112. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{8BE10F21-185F-4CA0-B789-9921674C3993}>TypeLib
113. In the right panel, locate and delete the entry:
     Version = "1.0"
114. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}>TypeLib
115. In the right panel, locate and delete the entry:
     Version = "1.0"
116. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>escortEng.DLL
117. In the right panel, locate and delete the entry:
     AppID = "{B12E99ED-69BD-437C-86BE-C862B9E5444D}"
118. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B8276A94-891D-453C-9FF3-715C042A2575}>InprocServer32
119. In the right panel, locate and delete the entry:
     ThreadingModel = "apartment"
120. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B8276A94-891D-453C-9FF3-715C042A2575}
121. In the right panel, locate and delete the entry:
     AppID = "{B12E99ED-69BD-437C-86BE-C862B9E5444D}"
122. Again In the right panel, locate and delete the entry:
     vrsni = "1.5.3.17"
123. Again In the right panel, locate and delete the entry:
     afltId = "babsst"
124. Again In the right panel, locate and delete the entry:
     smplGrp = "none"
125. Again In the right panel, locate and delete the entry:
     tlbrId = "base"
126. Again In the right panel, locate and delete the entry:
     InstallDir = "%Program Files%\BabylonToolbar\BabylonToolbar\1.5.3.17"
127. Again In the right panel, locate and delete the entry:
     DisplayName = "Babylon toolbar on IE"
128. Again In the right panel, locate and delete the entry:
     UninstallString = "%Program Files%\BabylonToolbar\BabylonToolbar\1.5.3.17\uninstall.exe"
129. Again In the right panel, locate and delete the entry:
     NoModify = "1"
130. Again In the right panel, locate and delete the entry:
     NoRepair = "1"
131. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>esrv.EXE
132. In the right panel, locate and delete the entry:
     AppID = "{35C1605E-438B-4D64-AAB1-8885F097A9B1}"
133. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{291BCCC1-6890-484a-89D3-318C928DAC1B}>LocalServer32
134. In the right panel, locate and delete the entry:
     ThreadingModel = "apartment"
135. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{291BCCC1-6890-484a-89D3-318C928DAC1B}
136. In the right panel, locate and delete the entry:
     AppID = "{35C1605E-438B-4D64-AAB1-8885F097A9B1}"
137. Close Registry Editor.

To restore the registry value this malware/grayware/spyware modified:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Main
3. In the right panel, locate the registry value:
   Start Page = "{random characters}"
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   Start Page = "http://www.microsoft.com/isapi/redir.dll?prd
5. Close Registry Editor.

To delete malware/grayware component files:

1. Search for the following files:
   
   • %User Temp%\nsz2.tmp\System.dll
   • %User Temp%\nsz2.tmp\NSISdl.dll
   • %User Temp%\nsz2.tmp\getCountry
   • %User Temp%\nsz2.tmp\inetc3.dll
   • %User Temp%\nsz2.tmp\gC0
   • 35
   • %Program Files%\1ClickDownload\IPL_(All_teams_theme_songs).magnet
   • mainpacklt.exe
   • %User Temp%\nsz2.tmp\nsDialogs.dll
   • %User Temp%\nsz2.tmp\skip.bmp
   • %User Temp%\nsz2.tmp\accept.bmp
   • %User Temp%\nsz2.tmp\accept1.bmp
   • %User Temp%\nsz2.tmp\accept2.bmp
   • %User Temp%\nsz2.tmp\accept3.bmp
   • %User Temp%\nsz2.tmp\decline.bmp
   • %User Temp%\nsz2.tmp\save.bmp
   • %User Temp%\nsz2.tmp\anon.bmp
   • %User Temp%\nsz2.tmp\1clogo.bmp
   • %User Temp%\nsz2.tmp\yontoo.bmp
   • %User Temp%\nsz2.tmp\1clogobvd.bmp
   • %User Temp%\nsz2.tmp\bab_on.bmp
   • %User Temp%\nsz2.tmp\bab_off.bmp
   • %User Temp%\nsz2.tmp\bab.bmp
   • %User Temp%\nsz2.tmp\fm.bmp
   • %User Temp%\nsz2.tmp\inc.bmp
   • %User Temp%\nsz2.tmp\EBanner.dll
   • %User Temp%\nsz2.tmp\getGFGCountry13
   • %Desktop%\Download IPL_(All_teams_theme_songs).lnk
   • %Program Files%\1ClickDownload\uninstall.exe
   • 1click11.crx
   • 1clicktemp.xpi
   • %User Temp%\nsz2.tmp\KillProcDLL.dll
   • BabDSetup.exe
   • %User Temp%\nsz2.tmp\getGFGCountry6
   • BVDDSetup.exe
   • %Program Files%\1ClickDownload\1ClickDownloader.exe
   • %Program Files%\1ClickDownload\1Click.cfg
   • bab033.tbinst.dat
   • bab091.norecovericon.dat
   • Babylon.dat
   • BExternal.dll
   • cmbx.png
   • common.js
   • eula.html
   • lngs.png
   • page1.css
   • page1.html
   • page1.js
   • page1Lrg.css
   • page2.css
   • page2.html
   • page2.js
   • page2Lrg.css
   • page9.html
   • pBar.gif
   • title1.png
   • title2.png
   • toolBar.jpg
   • vIcn.png
   • IECookieLow.dll
   • Setup.exe
   • SetupStrings.dat
   • sqlite3.dll
   • %User Temp%\F7BCB783-BAB0-7891-A2D4-A55145871553\Welcome.html
   • %Application Data%\Babylon\Setup\BExternal.zpb
   • %Application Data%\Babylon\Setup\Setup-tbmntr903.zpb
   • BabylonTB.xpi
   • MyBabylonTB.exe
   • TBConfig.inf
   • %User Temp%\nsz7.tmp\UserInfo.dll
   • %User Temp%\nsz7.tmp\System.dll
   • %User Temp%\nsz7.tmp\nsisos.dll
   • %User Temp%\F7BCB783-BAB0-7891-A2D4-A55145871553\nsa8.tmp
   • %User Temp%\F7BCB783-BAB0-7891-A2D4-A55145871553\nsq9.tmp
   • %User Temp%\nsz7.tmp\mt.dll
   • %User Temp%\nsz7.tmp\Time.dll
   • %User Temp%\F7BCB783-BAB0-7891-A2D4-A55145871553\nsgA.tmp
   • %User Temp%\F7BCB783-BAB0-7891-A2D4-A55145871553\nsgB.tmp
   • %User Temp%\F7BCB783-BAB0-7891-A2D4-A55145871553\nsvC.tmp
   • %User Temp%\F7BCB783-BAB0-7891-A2D4-A55145871553\nslD.tmp
   • %User Temp%\F7BCB783-BAB0-7891-A2D4-A55145871553\nsaE.tmp
   • %User Temp%\F7BCB783-BAB0-7891-A2D4-A55145871553\nsqF.tmp
   • %User Temp%\F7BCB783-BAB0-7891-A2D4-A55145871553\nsg10.tmp
   • %User Temp%\F7BCB783-BAB0-7891-A2D4-A55145871553\nsg11.tmp
   • %User Temp%\F7BCB783-BAB0-7891-A2D4-A55145871553\nsv12.tmp
   • %User Temp%\F7BCB783-BAB0-7891-A2D4-A55145871553\nsl13.tmp
   • %User Temp%\F7BCB783-BAB0-7891-A2D4-A55145871553\nsb14.tmp
   • %User Temp%\F7BCB783-BAB0-7891-A2D4-A55145871553\nsq15.tmp
   • %User Temp%\F7BCB783-BAB0-7891-A2D4-A55145871553\nsg16.tmp
   • %User Temp%\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbar4ffx.exe
   • %User Temp%\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbar4ie.exe
   • %User Temp%\F7BCB783-BAB0-7891-A2D4-A55145871553\nsq1F.tmp
   • %User Temp%\nsz7.tmp\InetLoad.dll
   • %User Temp%\BabylonToolbar\BabylonToolbar\1.5.3.17\nsis.js
   • %User Temp%\nsc18.tmp\nsisos.dll
   • %User Temp%\nsc18.tmp\System.dll
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\chrome.manifest
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\install.rdf
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\components\acplus-autocomplete.js
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\babylon.css
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\babylon.xul
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\server.js
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\tmplt.js
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\arwDwn.gif
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\bbyln.png
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\help_16.gif
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\home.gif
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\logo.PNG
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\privecy_16_hot.gif
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\tellafriend.gif
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\vssver.scc
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\flgs\Thumbs.db
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\flgs\ae.png
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\flgs\bg.png
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\flgs\ch.png
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\flgs\cn.png
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\flgs\cz.png
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\flgs\de.png
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\flgs\eg.png
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\flgs\en.png
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\flgs\es.png
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\flgs\fr.png
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\flgs\gr.png
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\flgs\he.png
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\flgs\il.png
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\flgs\it.png
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\flgs\ja.png
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\flgs\jp.png
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\flgs\nl.png
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\flgs\no.png
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\flgs\pl.png
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\flgs\pt.png
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\flgs\ro.png
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\flgs\ru.png
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\flgs\sa.png
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\flgs\se.png
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\flgs\sv.png
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\flgs\tr.png
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\flgs\ua.png
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\flgs\us.png
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\defaults\preferences\instlPref.js
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\mtstart.js
   • %User Temp%\BabylonToolbar\BabylonToolbar\1.5.3.17\nsx19.tmp
   • %User Temp%\BabylonToolbar\BabylonToolbar\1.5.3.17\nsd1A.tmp
   • %User Temp%\BabylonToolbar\BabylonToolbar\1.5.3.17\nss1B.tmp
   • %User Temp%\BabylonToolbar\BabylonToolbar\1.5.3.17\nsx1C.tmp
   • %User Temp%\nsa1E.tmp\UserInfo.dll
   • %User Temp%\nsa1E.tmp\System.dll
   • %User Temp%\nsa1E.tmp\nsisos.dll
   • %User Temp%\nsa1E.tmp\mt.dll
   • %User Temp%\nsa1E.tmp\Time.dll
   • %Program Files%\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll
   • %Program Files%\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarApp.dll
   • %Program Files%\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarEng.dll
   • %Program Files%\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll
   • %Program Files%\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarsrv.exe
   • %User Temp%\BabylonToolbar\BabylonToolbar\1.5.3.17\nst20.tmp
   • %User Temp%\BabylonToolbar\BabylonToolbar\1.5.3.17\nsi21.tmp
   • %User Temp%\BabylonToolbar\BabylonToolbar\1.5.3.17\nsf22.tmp
   • %Program Files%\BabylonToolbar\BabylonToolbar\1.5.3.17\uninstall.exe
   • %User Temp%\F7BCB783-BAB0-7891-A2D4-A55145871553\BExternal-9.0.3.35.zpb
   • %User Temp%\F7BCB783-BAB0-7891-A2D4-A55145871553\Setup-tbmntr903-9.0.3.35.zpb
   
   Note: To do a search for the following files, right-click Start then click Search... or Find..., depending on the version of Windows you are running. For each file to be deleted, type its file name in the Named input box. In the Look In drop-down list, select My Computer, then press Enter.
2. Once located, select the file then press SHIFT+DELETE to permanently delete the file.
3. Repeat the said steps for all files listed.

To delete malware/grayware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\ADMINI~1
   • %User Profile%\LOCALS~1
   • %User Temp%\nsz2.tmp
   • %Program Files%\1ClickDownload
   • %System Root%\Documents and Settings\Administrator
   • %User Profile%\Application Data\Mozilla
   • %User Profile%\Mozilla\Firefox
   • %User Profile%\Firefox\Profiles
   • %User Profile%\Profiles\extensions
   • %Desktop%\IPL (All teams theme songs)
   • %User Temp%\F7BCB783-BAB0-7891-A2D4-A55145871553
   • HtmlScreens
   • %User Profile%\Application Data\Babylon
   • %Program Files%\Babylon
   • %Program Files%\Babylon\Babylon-Pro
   • %Application Data%\Babylon
   • %Application Data%\Babylon\Setup
   • %User Temp%\nsz7.tmp
   • %User Profile%\Profiles\extensions
   • %User Profile%\extensions \extensions
   • %Program Files%\Mozilla Firefox
   • %Program Files%\Mozilla Firefox\extensions
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com
   • %User Temp%\BabylonToolbar
   • %User Temp%\BabylonToolbar\BabylonToolbar
   • %User Temp%\BabylonToolbar\BabylonToolbar\1.5.3.17
   • %User Temp%\nsc18.tmp
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\components
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\content\imgs\flgs
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\defaults
   • %Program Files%\Mozilla Firefox\extensions\ffxtlbr@babylon.com\defaults\preferences
   • %Program Files%\Mozilla Firefox\searchplugins
   • %User Temp%\nsa1E.tmp
   • %Program Files%\BabylonToolbar
   • %Program Files%\BabylonToolbar\BabylonToolbar
   • %Program Files%\BabylonToolbar\BabylonToolbar\1.5.3.17
   • %Program Files%\BabylonToolbar\BabylonToolbar\1.5.3.17\bh
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat the said steps for all folders listed.