TSPY_QQFISH.SMD

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CLASSES_ROOT
3. Still in the left panel, locate and delete the key:
   ATLDownLoadProgressBar.DownLoadProgressBar.1
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ATLDownLoadProgressBar.DownLoadProgressBar.1
5. Still in the left panel, locate and delete the key:
   CLSID
6. Again Still in the left panel, locate and delete the key:
   ATLDownLoadProgressBar.DownLoadProgressBar
7. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ATLDownLoadProgressBar.DownLoadProgressBar
8. Still in the left panel, locate and delete the key:
   CLSID
9. Again Still in the left panel, locate and delete the key:
   CurVer
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
11. Still in the left panel, locate and delete the key:
    {AC414988-E5BB-4C2C-873B-EA53D2F3D23A}
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{AC414988-E5BB-4C2C-873B-EA53D2F3D23A}
13. Still in the left panel, locate and delete the key:
    ProgID
14. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
15. Again Still in the left panel, locate and delete the key:
    Programmable
16. Again Still in the left panel, locate and delete the key:
    InprocServer32
17. Again Still in the left panel, locate and delete the key:
    Control
18. Again Still in the left panel, locate and delete the key:
    Insertable
19. Again Still in the left panel, locate and delete the key:
    ToolboxBitmap32
20. Again Still in the left panel, locate and delete the key:
    MiscStatus
21. Again Still in the left panel, locate and delete the key:
    TypeLib
22. Again Still in the left panel, locate and delete the key:
    Version
23. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
24. Still in the left panel, locate and delete the key:
    {7B0F8D4E-2C8D-4F2A-805B-0E35BF90B713}
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{7B0F8D4E-2C8D-4F2A-805B-0E35BF90B713}
26. Still in the left panel, locate and delete the key:
    1.0
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{7B0F8D4E-2C8D-4F2A-805B-0E35BF90B713}>1.0
28. Still in the left panel, locate and delete the key:
    FLAGS
29. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{7B0F8D4E-2C8D-4F2A-805B-0E35BF90B713}>1.0>0
30. Still in the left panel, locate and delete the key:
    win32
31. Again Still in the left panel, locate and delete the key:
    HELPDIR
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
33. Still in the left panel, locate and delete the key:
    {042C7AAC-BD4A-4450-AA0C-AAC3A30CA19E}
34. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{042C7AAC-BD4A-4450-AA0C-AAC3A30CA19E}
35. Still in the left panel, locate and delete the key:
    ProxyStubClsid
36. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
37. Again Still in the left panel, locate and delete the key:
    TypeLib
38. In the left panel, double-click the following:
    HKEY_CURRENT_USER>ATLDownLoadProgressBar.DownLoadProgressBar.1
39. Still in the left panel, locate and delete the key:
    CLSID
40. In the left panel, double-click the following:
    HKEY_CURRENT_USER>ATLDownLoadProgressBar.DownLoadProgressBar
41. Still in the left panel, locate and delete the key:
    CLSID
42. Again Still in the left panel, locate and delete the key:
    CurVer
43. In the left panel, double-click the following:
    HKEY_CURRENT_USER>CLSID
44. Still in the left panel, locate and delete the key:
    {AC414988-E5BB-4C2C-873B-EA53D2F3D23A}
45. In the left panel, double-click the following:
    HKEY_CURRENT_USER>CLSID>{AC414988-E5BB-4C2C-873B-EA53D2F3D23A}
46. Still in the left panel, locate and delete the key:
    ProgID
47. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
48. Again Still in the left panel, locate and delete the key:
    Programmable
49. Again Still in the left panel, locate and delete the key:
    InprocServer32
50. Again Still in the left panel, locate and delete the key:
    Control
51. Again Still in the left panel, locate and delete the key:
    Insertable
52. Again Still in the left panel, locate and delete the key:
    ToolboxBitmap32
53. Again Still in the left panel, locate and delete the key:
    MiscStatus
54. Again Still in the left panel, locate and delete the key:
    TypeLib
55. Again Still in the left panel, locate and delete the key:
    Version
56. Again Still in the left panel, locate and delete the key:
    TypeLib
57. In the left panel, double-click the following:
    HKEY_CURRENT_USER>TypeLib
58. Still in the left panel, locate and delete the key:
    {7B0F8D4E-2C8D-4F2A-805B-0E35BF90B713}
59. In the left panel, double-click the following:
    HKEY_CURRENT_USER>TypeLib>{7B0F8D4E-2C8D-4F2A-805B-0E35BF90B713}
60. Still in the left panel, locate and delete the key:
    1.0
61. In the left panel, double-click the following:
    HKEY_CURRENT_USER>TypeLib>{7B0F8D4E-2C8D-4F2A-805B-0E35BF90B713}>1.0
62. Still in the left panel, locate and delete the key:
    FLAGS
63. In the left panel, double-click the following:
    HKEY_CURRENT_USER>TypeLib>{7B0F8D4E-2C8D-4F2A-805B-0E35BF90B713}>1.0>0
64. Still in the left panel, locate and delete the key:
    win32
65. Again Still in the left panel, locate and delete the key:
    HELPDIR
66. Again Still in the left panel, locate and delete the key:
    Interface
67. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Interface
68. Still in the left panel, locate and delete the key:
    {042C7AAC-BD4A-4450-AA0C-AAC3A30CA19E}
69. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Interface>{042C7AAC-BD4A-4450-AA0C-AAC3A30CA19E}
70. Still in the left panel, locate and delete the key:
    ProxyStubClsid
71. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
72. Again Still in the left panel, locate and delete the key:
    TypeLib
73. Again Still in the left panel, locate and delete the key:
    {8DB3A21B-4F5A-4D45-AE1A-0F03E72A6E8F}
74. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{8DB3A21B-4F5A-4D45-AE1A-0F03E72A6E8F}
75. Still in the left panel, locate and delete the key:
    1.1
76. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{8DB3A21B-4F5A-4D45-AE1A-0F03E72A6E8F}>1.1
77. Still in the left panel, locate and delete the key:
    FLAGS
78. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{8DB3A21B-4F5A-4D45-AE1A-0F03E72A6E8F}>1.1>0
79. Still in the left panel, locate and delete the key:
    win32
80. Again Still in the left panel, locate and delete the key:
    HELPDIR
81. Again Still in the left panel, locate and delete the key:
    {80F1D1E4-9D20-4501-B0F1-196A6B302060}
82. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{80F1D1E4-9D20-4501-B0F1-196A6B302060}
83. Still in the left panel, locate and delete the key:
    ProxyStubClsid
84. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
85. Again Still in the left panel, locate and delete the key:
    TypeLib
86. Again Still in the left panel, locate and delete the key:
    {6B1C04D4-FE66-4828-92E0-EEBCC8959BF3}
87. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{6B1C04D4-FE66-4828-92E0-EEBCC8959BF3}
88. Still in the left panel, locate and delete the key:
    ProxyStubClsid
89. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
90. Again Still in the left panel, locate and delete the key:
    TypeLib
91. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID
92. Still in the left panel, locate and delete the key:
    {38943A5A-33BB-4D28-909A-BF52B994D26A}
93. Again Still in the left panel, locate and delete the key:
    {C728DAB8-FDF5-4CD7-89DD-879D25794C77}
94. Again Still in the left panel, locate and delete the key:
    KOOPLAYER.CCTVPlayerCtrl.1
95. In the left panel, double-click the following:
    HKEY_CURRENT_USER>TypeLib>{8DB3A21B-4F5A-4D45-AE1A-0F03E72A6E8F}
96. Still in the left panel, locate and delete the key:
    1.1
97. In the left panel, double-click the following:
    HKEY_CURRENT_USER>TypeLib>{8DB3A21B-4F5A-4D45-AE1A-0F03E72A6E8F}>1.1
98. Still in the left panel, locate and delete the key:
    FLAGS
99. In the left panel, double-click the following:
    HKEY_CURRENT_USER>TypeLib>{8DB3A21B-4F5A-4D45-AE1A-0F03E72A6E8F}>1.1>0
100. Still in the left panel, locate and delete the key:
     win32
101. Again Still in the left panel, locate and delete the key:
     HELPDIR
102. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Interface>{80F1D1E4-9D20-4501-B0F1-196A6B302060}
103. Still in the left panel, locate and delete the key:
     ProxyStubClsid
104. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
105. Again Still in the left panel, locate and delete the key:
     TypeLib
106. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Interface>{6B1C04D4-FE66-4828-92E0-EEBCC8959BF3}
107. Still in the left panel, locate and delete the key:
     ProxyStubClsid
108. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
109. Again Still in the left panel, locate and delete the key:
     TypeLib
110. Again Still in the left panel, locate and delete the key:
     {0179B775-DF94-4BF5-8EF6-63BE876D1845}
111. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{0179B775-DF94-4BF5-8EF6-63BE876D1845}
112. Still in the left panel, locate and delete the key:
     1.0
113. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{0179B775-DF94-4BF5-8EF6-63BE876D1845}>1.0
114. Still in the left panel, locate and delete the key:
     FLAGS
115. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{0179B775-DF94-4BF5-8EF6-63BE876D1845}>1.0>0
116. Still in the left panel, locate and delete the key:
     win32
117. Again Still in the left panel, locate and delete the key:
     HELPDIR
118. Again Still in the left panel, locate and delete the key:
     {EC161D49-0007-47E2-8741-2C0BB6CF3893}
119. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{EC161D49-0007-47E2-8741-2C0BB6CF3893}
120. Still in the left panel, locate and delete the key:
     ProxyStubClsid
121. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
122. Again Still in the left panel, locate and delete the key:
     TypeLib
123. Again Still in the left panel, locate and delete the key:
     {C55E048A-B88B-4B9E-974F-0777AAAB4C48}
124. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C55E048A-B88B-4B9E-974F-0777AAAB4C48}
125. Still in the left panel, locate and delete the key:
     ProxyStubClsid
126. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
127. Again Still in the left panel, locate and delete the key:
     TypeLib
128. Again Still in the left panel, locate and delete the key:
     {070CA17A-4BD2-4612-83B4-32B1B9159B48}
129. Again Still in the left panel, locate and delete the key:
     ULIVECTRL.ULiveCtrlCtrl.1
130. Again Still in the left panel, locate and delete the key:
     Downloader.DLoader.1
131. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Downloader.DLoader.1
132. Still in the left panel, locate and delete the key:
     CLSID
133. Again Still in the left panel, locate and delete the key:
     Downloader.DLoader
134. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Downloader.DLoader
135. Still in the left panel, locate and delete the key:
     CLSID
136. Again Still in the left panel, locate and delete the key:
     CurVer
137. Again Still in the left panel, locate and delete the key:
     {78ABDC59-D8E7-44D3-9A76-9A0918C52B4A}
138. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{78ABDC59-D8E7-44D3-9A76-9A0918C52B4A}
139. Still in the left panel, locate and delete the key:
     ProgID
140. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
141. Again Still in the left panel, locate and delete the key:
     Programmable
142. Again Still in the left panel, locate and delete the key:
     InprocServer32
143. Again Still in the left panel, locate and delete the key:
     Control
144. Again Still in the left panel, locate and delete the key:
     MiscStatus
145. Again Still in the left panel, locate and delete the key:
     TypeLib
146. Again Still in the left panel, locate and delete the key:
     Version
147. Again Still in the left panel, locate and delete the key:
     {8A6847C0-D132-4FDC-A667-7751C0075A0E}
148. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{8A6847C0-D132-4FDC-A667-7751C0075A0E}
149. Still in the left panel, locate and delete the key:
     1.0
150. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{8A6847C0-D132-4FDC-A667-7751C0075A0E}>1.0
151. Still in the left panel, locate and delete the key:
     FLAGS
152. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{8A6847C0-D132-4FDC-A667-7751C0075A0E}>1.0>0
153. Still in the left panel, locate and delete the key:
     win32
154. Again Still in the left panel, locate and delete the key:
     HELPDIR
155. Again Still in the left panel, locate and delete the key:
     {7AA7A8C8-6BA1-4F68-BB44-CA01D82830FB}
156. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{7AA7A8C8-6BA1-4F68-BB44-CA01D82830FB}
157. Still in the left panel, locate and delete the key:
     ProxyStubClsid
158. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
159. Again Still in the left panel, locate and delete the key:
     TypeLib
160. Again Still in the left panel, locate and delete the key:
     {E9536BC6-75F4-4CC7-A0AC-56A366BB9D12}
161. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{E9536BC6-75F4-4CC7-A0AC-56A366BB9D12}
162. Still in the left panel, locate and delete the key:
     ProxyStubClsid
163. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
164. Again Still in the left panel, locate and delete the key:
     TypeLib
165. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{AC414988-E5BB-4C2C-873B-EA53D2F3D23A}>InprocServer32
3. In the right panel, locate and delete the entry:
   ThreadingModel = "Apartment"
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{042C7AAC-BD4A-4450-AA0C-AAC3A30CA19E}>TypeLib
5. In the right panel, locate and delete the entry:
   Version = "1.0"
6. In the left panel, double-click the following:
   HKEY_CURRENT_USER>CLSID>{AC414988-E5BB-4C2C-873B-EA53D2F3D23A}>InprocServer32
7. In the right panel, locate and delete the entry:
   ThreadingModel = "Apartment"
8. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Interface>{042C7AAC-BD4A-4450-AA0C-AAC3A30CA19E}>TypeLib
9. In the right panel, locate and delete the entry:
   Version = "1.0"
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{80F1D1E4-9D20-4501-B0F1-196A6B302060}>TypeLib
11. In the right panel, locate and delete the entry:
    Version = "1.1"
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{6B1C04D4-FE66-4828-92E0-EEBCC8959BF3}>TypeLib
13. In the right panel, locate and delete the entry:
    Version = "1.1"
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{38943A5A-33BB-4D28-909A-BF52B994D26A}
15. In the right panel, locate and delete the entry:
    InprocServer32 = "%Program Files%\C5EF~1\Kernel\cctv\CCTVPL~1.OCX"
16. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>KOOPLAYER.CCTVPlayerCtrl.1
17. In the right panel, locate and delete the entry:
    CLSID = "{C728DAB8-FDF5-4CD7-89DD-879D25794C77}"
18. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{C728DAB8-FDF5-4CD7-89DD-879D25794C77}
19. In the right panel, locate and delete the entry:
    ProgID = "KOOPLAYER.CCTVPlayerCtrl.1"
20. Again In the right panel, locate and delete the entry:
    InprocServer32 = "%Program Files%\C5EF~1\Kernel\cctv\CCTVPL~1.OCX"
21. Again In the right panel, locate and delete the entry:
    ToolboxBitmap32 = "%Program Files%\C5EF~1\Kernel\cctv\CCTVPL~1.OCX, 1"
22. Again In the right panel, locate and delete the entry:
    MiscStatus = "0"
23. Again In the right panel, locate and delete the entry:
    MiscStatus\1 = "131473"
24. Again In the right panel, locate and delete the entry:
    TypeLib = "{8DB3A21B-4F5A-4D45-AE1A-0F03E72A6E8F}"
25. Again In the right panel, locate and delete the entry:
    Version = "1.1"
26. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{C728DAB8-FDF5-4CD7-89DD-879D25794C77}>InprocServer32
27. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
28. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Interface>{80F1D1E4-9D20-4501-B0F1-196A6B302060}>TypeLib
29. In the right panel, locate and delete the entry:
    Version = "1.1"
30. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Interface>{6B1C04D4-FE66-4828-92E0-EEBCC8959BF3}>TypeLib
31. In the right panel, locate and delete the entry:
    Version = "1.1"
32. In the left panel, double-click the following:
    HKEY_CURRENT_USER>CLSID>{38943A5A-33BB-4D28-909A-BF52B994D26A}
33. In the right panel, locate and delete the entry:
    InprocServer32 = "%Program Files%\C5EF~1\Kernel\cctv\CCTVPL~1.OCX"
34. In the left panel, double-click the following:
    HKEY_CURRENT_USER>KOOPLAYER.CCTVPlayerCtrl.1
35. In the right panel, locate and delete the entry:
    CLSID = "{C728DAB8-FDF5-4CD7-89DD-879D25794C77}"
36. In the left panel, double-click the following:
    HKEY_CURRENT_USER>CLSID>{C728DAB8-FDF5-4CD7-89DD-879D25794C77}
37. In the right panel, locate and delete the entry:
    ProgID = "KOOPLAYER.CCTVPlayerCtrl.1"
38. Again In the right panel, locate and delete the entry:
    InprocServer32 = "%Program Files%\C5EF~1\Kernel\cctv\CCTVPL~1.OCX"
39. Again In the right panel, locate and delete the entry:
    ToolboxBitmap32 = "%Program Files%\C5EF~1\Kernel\cctv\CCTVPL~1.OCX, 1"
40. Again In the right panel, locate and delete the entry:
    MiscStatus = "0"
41. Again In the right panel, locate and delete the entry:
    MiscStatus\1 = "131473"
42. Again In the right panel, locate and delete the entry:
    TypeLib = "{8DB3A21B-4F5A-4D45-AE1A-0F03E72A6E8F}"
43. Again In the right panel, locate and delete the entry:
    Version = "1.1"
44. In the left panel, double-click the following:
    HKEY_CURRENT_USER>CLSID>{C728DAB8-FDF5-4CD7-89DD-879D25794C77}>InprocServer32
45. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
46. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{EC161D49-0007-47E2-8741-2C0BB6CF3893}>TypeLib
47. In the right panel, locate and delete the entry:
    Version = "1.0"
48. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C55E048A-B88B-4B9E-974F-0777AAAB4C48}>TypeLib
49. In the right panel, locate and delete the entry:
    Version = "1.0"
50. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ULIVECTRL.ULiveCtrlCtrl.1
51. In the right panel, locate and delete the entry:
    CLSID = "{070CA17A-4BD2-4612-83B4-32B1B9159B48}"
52. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{070CA17A-4BD2-4612-83B4-32B1B9159B48}
53. In the right panel, locate and delete the entry:
    ProgID = "ULIVECTRL.ULiveCtrlCtrl.1"
54. Again In the right panel, locate and delete the entry:
    InprocServer32 = "%Program Files%\C5EF~1\Kernel\sina\UCLIVE~1.OCX"
55. Again In the right panel, locate and delete the entry:
    ToolboxBitmap32 = "%Program Files%\C5EF~1\Kernel\sina\UCLIVE~1.OCX, 1"
56. Again In the right panel, locate and delete the entry:
    MiscStatus = "0"
57. Again In the right panel, locate and delete the entry:
    MiscStatus\1 = "131473"
58. Again In the right panel, locate and delete the entry:
    TypeLib = "{0179B775-DF94-4BF5-8EF6-63BE876D1845}"
59. Again In the right panel, locate and delete the entry:
    Version = "1.0"
60. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{070CA17A-4BD2-4612-83B4-32B1B9159B48}>InprocServer32
61. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
62. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{78ABDC59-D8E7-44D3-9A76-9A0918C52B4A}>InprocServer32
63. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
64. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{7AA7A8C8-6BA1-4F68-BB44-CA01D82830FB}>TypeLib
65. In the right panel, locate and delete the entry:
    Version = "1.0"
66. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{E9536BC6-75F4-4CC7-A0AC-56A366BB9D12}>TypeLib
67. In the right panel, locate and delete the entry:
    Version = "1.0"
68. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • \kb.exe
   • \9ptvs1.exe
   • \SVCHOST.exe
   • \8001.exe
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\languages\Chinese BIG5.Ini
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\languages\Chinese GB.Ini
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\languages\English.Ini
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\languages\Japanese.ini
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\chis.ini
   • %Start Menu%\Programs\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ.lnk
   • %Start Menu%\Programs\Æô¶¯\ÌÚѶQQ.lnk
   • %Desktop%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ.lnk
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\info.ini
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\readme.txt
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel\cctv\CCTVPlayer.ocx
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel\cctv\CCTVUpdateInstall.dll
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel\sina\State.dll
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel\sina\UCLiveCore.dll
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel\sina\UCLiveCtrl.ocx
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel\sina\clear.bat
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel\sina\downloader.dll
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel\sina\liveupdate.dll
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel\sina\zlib.dll
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel\sina\°²×°.bat
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\9ptv.exe
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel\uusee\in_net.dll
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel\uusee\out_mmshttp.dll
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel\uusee\seeplayer.ocx
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel\uusee\trafficlight.dll
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • \kb.exe
   • \9ptvs1.exe
   • \SVCHOST.exe
   • \8001.exe
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\languages\Chinese BIG5.Ini
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\languages\Chinese GB.Ini
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\languages\English.Ini
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\languages\Japanese.ini
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\chis.ini
   • %Start Menu%\Programs\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ.lnk
   • %Start Menu%\Programs\Æô¶¯\ÌÚѶQQ.lnk
   • %Desktop%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ.lnk
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\info.ini
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\readme.txt
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel\cctv\CCTVPlayer.ocx
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel\cctv\CCTVUpdateInstall.dll
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel\sina\State.dll
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel\sina\UCLiveCore.dll
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel\sina\UCLiveCtrl.ocx
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel\sina\clear.bat
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel\sina\downloader.dll
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel\sina\liveupdate.dll
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel\sina\zlib.dll
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel\sina\°²×°.bat
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\9ptv.exe
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel\uusee\in_net.dll
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel\uusee\out_mmshttp.dll
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel\uusee\seeplayer.ocx
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel\uusee\trafficlight.dll
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\languages
   • %System Root%\Documents and Settings\Administrator
   • %Start Menu%\Programs\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel\cctv
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel\sina
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel\uusee
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\languages
   • %System Root%\Documents and Settings\Administrator
   • %Start Menu%\Programs\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel\cctv
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel\sina
   • %Program Files%\¾ÅÆ·¼«ËÙÍøÂçµçÓ°µçÊÓ\Kernel\uusee