WORM_DROPPER.PB

To identify and delete the malware/grayware file:

1. Insert your Windows Installation CD in your CD-rom.
2. Press the restart button of your computer.
3. When prompted, press any key to boot from the CD.
4. When prompted on the Main Menu, type r to enter the recovery console.
   (Note: On Windows 2000, after pressing r, type c to choose the Recovery Console in the repair options screen.)
5. When prompted, type your administrator password to log on.
6. Once logged in, type the drive that contains Windows in the command prompt that appears, then press Enter.
7. Type the drive that contains Windows, then press Enter.
8. Type the following, then press Enter:
   del {malware/grayware path and file name}
9. Repeat the above procedure for all files detected earlier.
10. Type exit to restart the system normally.

To delete registry keys this malware/grayware created:

1. Open Registry Editor. To do this, click Start>Run, type regedit in the text box provided, then press Enter.
2. In the left panel of the Registry Editor window, double-click the following:
   HKEY_CURRENT_USER>Software
3. Still in the left panel, locate and delete the key:
   frticb
4. Again Still in the left panel, locate and delete the key:
   xoahvr
5. Close Registry Editor.

To delete the registry value this malware created:

1. Open Registry Editor. To do this, click Start>Run, type regedit in the text box provided, then press Enter.
2. In the left panel of the Registry Editor window, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Run
3. In the right panel, locate and delete the entry:
   ogjebnl = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
4. Again In the right panel, locate and delete the entry:
   kttrogc = %Program Files%\Common Files\System\intfljg.exe
5. In the left panel of the Registry Editor window, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>360rpt.exe
6. In the right panel, locate and delete the entry:
   Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
7. In the left panel of the Registry Editor window, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>360Safe.exe
8. In the right panel, locate and delete the entry:
   Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
9. In the left panel of the Registry Editor window, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>360tray.exe
10. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
11. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>adam.exe
12. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
13. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>AgentSvr.exe
14. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
15. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>AppSvc32.exe
16. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
17. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>ArSwp.exe
18. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
19. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>AST.exe
20. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
21. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>autoruns.exe
22. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
23. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>AvastU3.exe
24. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
25. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>avconsol.exe
26. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
27. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>avgrssvc.exe
28. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
29. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>AvMonitor.exe
30. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
31. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>avp.com
32. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
33. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>avp.exe
34. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
35. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>CCenter.exe
36. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
37. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>ccSvcHst.exe
38. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
39. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>EGHOST.exe
40. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
41. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>FileDsty.exe
42. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
43. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>FTCleanerShell.exe
44. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
45. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>FYFireWall.exe
46. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
47. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>ghost.exe
48. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
49. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>HijackThis.exe
50. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
51. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>IceSword.exe
52. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
53. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>iparmo.exe
54. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
55. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>Iparmor.exe
56. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
57. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>irsetup.exe
58. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
59. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>isPwdSvc.exe
60. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
61. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>kabaload.exe
62. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
63. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KaScrScn.SCR
64. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
65. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KASMain.exe
66. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
67. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KASTask.exe
68. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
69. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KAV32.exe
70. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
71. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KAVDX.exe
72. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
73. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KAVPF.exe
74. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
75. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KAVPFW.exe
76. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
77. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KAVSetup.exe
78. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
79. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KAVStart.exe
80. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
81. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KISLnchr.exe
82. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
83. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KMailMon.exe
84. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
85. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KMFilter.exe
86. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
87. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KPFW32.exe
88. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
89. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KPFW32X.exe
90. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
91. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KPfwSvc.exe
92. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
93. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KRegEx.exe
94. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
95. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KRepair.com
96. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
97. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KsLoader.exe
98. In the right panel, locate and delete the entry:
    Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
99. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KVCenter.kxp
100. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
101. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KvDetect.exe
102. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
103. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KvfwMcl.exe
104. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
105. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KVMonXP.kxp
106. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
107. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KVMonXP_1.kxp
108. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
109. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>kvol.exe
110. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
111. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>kvolself.exe
112. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
113. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KvReport.kxp
114. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
115. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KVScan.kxp
116. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
117. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KVSrvXP.exe
118. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
119. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KVStub.kxp
120. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
121. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>kvupload.exe
122. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
123. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>kvwsc.exe
124. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
125. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KvXP.kxp
126. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
127. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KvXP_1.kxp
128. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
129. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KWatch.exe
130. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
131. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KWatch9x.exe
132. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
133. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KWatchX.exe
134. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
135. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>loaddll.exe
136. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
137. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>MagicSet.exe
138. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
139. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>mcconsol.exe
140. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
141. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>mmqczj.exe
142. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
143. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>mmsk.exe
144. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
145. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>Navapsvc.exe
146. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
147. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>Navapw32.exe
148. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
149. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>nod32.exe
150. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
151. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>nod32krn.exe
152. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
153. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>nod32kui.exe
154. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
155. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>NPFMntor.exe
156. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
157. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>PFW.exe
158. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
159. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>PFWLiveUpdate.exe
160. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
161. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>QHSET.exe
162. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
163. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>QQDoctor.exe
164. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
165. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>QQKav.exe
166. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
167. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>QQLiveUpdate.exe
168. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
169. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>QQSC.exe
170. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
171. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>QQUpdateCenter.exe
172. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
173. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>Ras.exe
174. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
175. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>Rav.exe
176. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
177. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>RavMon.exe
178. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
179. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>RavMonD.exe
180. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
181. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>RavStub.exe
182. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
183. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>RavTask.exe
184. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
185. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>RegClean.exe
186. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
187. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>rfwcfg.exe
188. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
189. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>rfwmain.exe
190. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
191. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>rfwsrv.exe
192. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
193. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>RsAgent.exe
194. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
195. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>Rsaupd.exe
196. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
197. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>rstrui.exe
198. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
199. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>runiep.exe
200. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
201. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>safelive.exe
202. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
203. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>scan32.exe
204. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
205. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>shcfg32.exe
206. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
207. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>SmartUp.exe
208. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
209. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>SREng.EXE
210. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
211. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>symlcsvc.exe
212. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
213. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>SysSafe.exe
214. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
215. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>Timwp.exe
216. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
217. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>TrojanDetector.exe
218. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
219. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>Trojanwall.exe
220. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
221. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>TrojDie.kxp
222. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
223. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>UIHost.exe
224. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
225. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>UmxAgent.exe
226. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
227. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>UmxAttachment.exe
228. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
229. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>UmxCfg.exe
230. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
231. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>UmxFwHlp.exe
232. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
233. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>UmxPol.exe
234. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
235. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>upiea.exe
236. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
237. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>UpLive.exe
238. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
239. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>USBCleaner.exe
240. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
241. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>vsstat.exe
242. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
243. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>webscanx.exe
244. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
245. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>WoptiClean.exe
246. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
247. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>zjb.exe
248. In the right panel, locate and delete the entry:
     Debugger = %Program Files%\Common Files\Microsoft Shared\osgjaaj.exe
249. Close Registry Editor.

To restore the registry value this malware/grayware modified:

1. Open Registry Editor. Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Services>wuauserv
3. In the right panel, locate the registry value:
   Start = 4
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   Start = 2
5. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Services>wscsvc
6. In the right panel, locate the registry value:
   Start = 4
7. Right-click on the value name and choose Modify. Change the value data of this entry to:
   Start = 2
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Services>SharedAccess
9. In the right panel, locate the registry value:
   Start = 4
10. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Start = 2
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Advanced>Folder>SuperHidden
12. In the right panel, locate the registry value:
    Type = checkbox2
13. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Type = checkbox
14. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>Advanced
15. In the right panel, locate the registry value:
    ShowSuperHidden = 0
16. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ShowSuperHidden = 1
17. Close Registry Editor.

Restoring a File to its Original Location

1. Click Start>Run.
2. In the text box, type the following:
   command /c copy %System%\verclsids.exe %System%\verclsid.exe
3. Press Enter.

To delete the malware/grayware/spyware file:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   %Program Files%\Common Files\Microsoft Shared\kttrogc.inf
   %Program Files%\Common Files\System\kttrogc.inf
   %System%\verclsids.exe

3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the file then press SHIFT+DELETE to permanently delete the file.