TROJ_VBKRYPT.BSR

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Description>Microsoft>Rpc
3. Still in the left panel, locate and delete the key:
   UuidTemporaryData
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
5. Still in the left panel, locate and delete the key:
   {E648A558-BE60-49A4-BAC5-2695E85D26E3}
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{E648A558-BE60-49A4-BAC5-2695E85D26E3}
7. Still in the left panel, locate and delete the key:
   1.0
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{E648A558-BE60-49A4-BAC5-2695E85D26E3}>1.0
9. Still in the left panel, locate and delete the key:
   FLAGS
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{E648A558-BE60-49A4-BAC5-2695E85D26E3}>1.0>0
11. Still in the left panel, locate and delete the key:
    win32
12. Again Still in the left panel, locate and delete the key:
    HELPDIR
13. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
14. Still in the left panel, locate and delete the key:
    {A651969B-8EB5-4F06-BB8B-65452F293A0C}
15. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A651969B-8EB5-4F06-BB8B-65452F293A0C}
16. Still in the left panel, locate and delete the key:
    ProxyStubClsid
17. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
18. Again Still in the left panel, locate and delete the key:
    TypeLib
19. Again Still in the left panel, locate and delete the key:
    {35A00425-9DE1-40E1-BEBF-3E748B208BE8}
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{35A00425-9DE1-40E1-BEBF-3E748B208BE8}
21. Still in the left panel, locate and delete the key:
    ProxyStubClsid
22. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
23. Again Still in the left panel, locate and delete the key:
    TypeLib
24. Again Still in the left panel, locate and delete the key:
    {102553B6-D625-4E16-894D-BC920B679323}
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{102553B6-D625-4E16-894D-BC920B679323}
26. Still in the left panel, locate and delete the key:
    ProxyStubClsid
27. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
28. Again Still in the left panel, locate and delete the key:
    TypeLib
29. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID
30. Still in the left panel, locate and delete the key:
    {8ADE59D2-E140-45A8-ACEC-E2328134EB95}
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{8ADE59D2-E140-45A8-ACEC-E2328134EB95}
32. Still in the left panel, locate and delete the key:
    InprocServer32
33. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT
34. Still in the left panel, locate and delete the key:
    ShieldPO.Class
35. Again Still in the left panel, locate and delete the key:
    {0CD84BB4-61BD-4420-92E6-633F400468DF}
36. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{0CD84BB4-61BD-4420-92E6-633F400468DF}
37. Still in the left panel, locate and delete the key:
    InprocServer32
38. Again Still in the left panel, locate and delete the key:
    ShieldPO.cJPGU
39. Again Still in the left panel, locate and delete the key:
    {B8AD6634-A171-474C-8688-26021FDF2120}
40. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B8AD6634-A171-474C-8688-26021FDF2120}
41. Still in the left panel, locate and delete the key:
    InprocServer32
42. Again Still in the left panel, locate and delete the key:
    ShieldPO.cIMGU
43. In the left panel, double-click the following:
    HKEY_CURRENT_USER>SOFTWARE>Microsoft>Windows>CurrentVersion>Policies>Ext
44. Still in the left panel, locate and delete the key:
    CLSID
45. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext
46. Still in the left panel, locate and delete the key:
    PreApproved
47. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext>PreApproved
48. Still in the left panel, locate and delete the key:
    {8ADE59D2-E140-45A8-ACEC-E2328134EB95}
49. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Description>Microsoft>Rpc>UuidTemporaryData
3. In the right panel, locate and delete the entry:
   NetworkAddress = "{random values}"
4. Again In the right panel, locate and delete the entry:
   NetworkAddressLocal = "0"
5. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A651969B-8EB5-4F06-BB8B-65452F293A0C}>TypeLib
6. In the right panel, locate and delete the entry:
   Version = "1.0"
7. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{35A00425-9DE1-40E1-BEBF-3E748B208BE8}>TypeLib
8. In the right panel, locate and delete the entry:
   Version = "1.0"
9. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{102553B6-D625-4E16-894D-BC920B679323}>TypeLib
10. In the right panel, locate and delete the entry:
    Version = "1.0"
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{8ADE59D2-E140-45A8-ACEC-E2328134EB95}
12. In the right panel, locate and delete the entry:
    ProgID = "ShieldPO.Class"
13. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{8ADE59D2-E140-45A8-ACEC-E2328134EB95}>InprocServer32
14. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
15. Again In the right panel, locate and delete the entry:
    TypeLib = "{E648A558-BE60-49A4-BAC5-2695E85D26E3}"
16. Again In the right panel, locate and delete the entry:
    VERSION = "1.0"
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ShieldPO.Class
18. In the right panel, locate and delete the entry:
    Clsid = "{8ADE59D2-E140-45A8-ACEC-E2328134EB95}"
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{102553B6-D625-4E16-894D-BC920B679323}
20. In the right panel, locate and delete the entry:
    ProxyStubClsid = "{00020424-0000-0000-C000-000000000046}"
21. Again In the right panel, locate and delete the entry:
    ProxyStubClsid32 = "{00020424-0000-0000-C000-000000000046}"
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{0CD84BB4-61BD-4420-92E6-633F400468DF}
23. In the right panel, locate and delete the entry:
    ProgID = "ShieldPO.cJPGU"
24. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{0CD84BB4-61BD-4420-92E6-633F400468DF}>InprocServer32
25. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
26. Again In the right panel, locate and delete the entry:
    TypeLib = "{E648A558-BE60-49A4-BAC5-2695E85D26E3}"
27. Again In the right panel, locate and delete the entry:
    VERSION = "1.0"
28. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ShieldPO.cJPGU
29. In the right panel, locate and delete the entry:
    Clsid = "{0CD84BB4-61BD-4420-92E6-633F400468DF}"
30. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{35A00425-9DE1-40E1-BEBF-3E748B208BE8}
31. In the right panel, locate and delete the entry:
    ProxyStubClsid = "{00020424-0000-0000-C000-000000000046}"
32. Again In the right panel, locate and delete the entry:
    ProxyStubClsid32 = "{00020424-0000-0000-C000-000000000046}"
33. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B8AD6634-A171-474C-8688-26021FDF2120}
34. In the right panel, locate and delete the entry:
    ProgID = "ShieldPO.cIMGU"
35. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B8AD6634-A171-474C-8688-26021FDF2120}>InprocServer32
36. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
37. Again In the right panel, locate and delete the entry:
    TypeLib = "{E648A558-BE60-49A4-BAC5-2695E85D26E3}"
38. Again In the right panel, locate and delete the entry:
    VERSION = "1.0"
39. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ShieldPO.cIMGU
40. In the right panel, locate and delete the entry:
    Clsid = "{B8AD6634-A171-474C-8688-26021FDF2120}"
41. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A651969B-8EB5-4F06-BB8B-65452F293A0C}
42. In the right panel, locate and delete the entry:
    ProxyStubClsid = "{00020424-0000-0000-C000-000000000046}"
43. Again In the right panel, locate and delete the entry:
    ProxyStubClsid32 = "{00020424-0000-0000-C000-000000000046}"
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Browser Helper Objects>{8ADE59D2-E140-45A8-ACEC-E2328134EB95}
45. In the right panel, locate and delete the entry:
    NoExplorer = "1"
46. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Policies>Ext>CLSID
47. In the right panel, locate and delete the entry:
    {8ADE59D2-E140-45A8-ACEC-E2328134EB95} = "1"
48. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>policies>system
49. In the right panel, locate and delete the entry:
    EnableLUA = "0"
50. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %User Temp%\~DF8253668.tmp
   • %System%\shldpo2a.dll
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %User Temp%\~DF8253668.tmp
   • %System%\shldpo2a.dll
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.