SPYW_EXFRIENDER

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>SOFTWARE
3. Still in the left panel, locate and delete the key:
   DynConIE
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall
5. Still in the left panel, locate and delete the key:
   SpyAlert
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Policies
7. Still in the left panel, locate and delete the key:
   Ext
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Policies>Ext
9. Still in the left panel, locate and delete the key:
   CLSID
10. In the left panel, double-click the following:
    HKEY_CURRENT_USER>SOFTWARE>Microsoft>Internet Explorer
11. Still in the left panel, locate and delete the key:
    MAO Settings
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Google>Chrome>Extensions
13. Still in the left panel, locate and delete the key:
    igjjkeeamkpihpncmmbgdkhdnjpcfmfb
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID
15. Still in the left panel, locate and delete the key:
    {384997EE-E3BE-49C4-9ECA-C62B7C08128A}
16. Again Still in the left panel, locate and delete the key:
    DynConIE.DLL
17. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT
18. Still in the left panel, locate and delete the key:
    DynConIE.DynConIEObject.1
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>DynConIE.DynConIEObject.1
20. Still in the left panel, locate and delete the key:
    CLSID
21. Again Still in the left panel, locate and delete the key:
    DynConIE.DynConIEObject
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>DynConIE.DynConIEObject
23. Still in the left panel, locate and delete the key:
    CLSID
24. Again Still in the left panel, locate and delete the key:
    CurVer
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
26. Still in the left panel, locate and delete the key:
    {44ed99e2-16a6-4b89-80d6-5b21cf42e78b}
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{44ed99e2-16a6-4b89-80d6-5b21cf42e78b}
28. Still in the left panel, locate and delete the key:
    ProgID
29. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
30. Again Still in the left panel, locate and delete the key:
    Programmable
31. Again Still in the left panel, locate and delete the key:
    InprocServer32
32. Again Still in the left panel, locate and delete the key:
    TypeLib
33. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
34. Still in the left panel, locate and delete the key:
    {781CA792-9B6E-400B-B36F-15C097D2CA54}
35. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{781CA792-9B6E-400B-B36F-15C097D2CA54}
36. Still in the left panel, locate and delete the key:
    1.0
37. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{781CA792-9B6E-400B-B36F-15C097D2CA54}>1.0
38. Still in the left panel, locate and delete the key:
    FLAGS
39. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{781CA792-9B6E-400B-B36F-15C097D2CA54}>1.0>0
40. Still in the left panel, locate and delete the key:
    win32
41. Again Still in the left panel, locate and delete the key:
    HELPDIR
42. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
43. Still in the left panel, locate and delete the key:
    {2830488C-079B-45C2-88B6-AFE4EAA2DF85}
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{2830488C-079B-45C2-88B6-AFE4EAA2DF85}
45. Still in the left panel, locate and delete the key:
    ProxyStubClsid
46. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
47. Again Still in the left panel, locate and delete the key:
    TypeLib
48. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows Script
49. Still in the left panel, locate and delete the key:
    Settings
50. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>DynConIE
3. In the right panel, locate and delete the entry:
   cid = "d51c845d2d4e4bd3"
4. Again In the right panel, locate and delete the entry:
   id = "d51c845d2d4e4bd3ac785136aebe0514"
5. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>SpyAlert
6. In the right panel, locate and delete the entry:
   DisplayIcon = "%Program Files%\SpyAlert\SpyAlert.ico"
7. Again In the right panel, locate and delete the entry:
   DisplayName = "Spy Alert"
8. Again In the right panel, locate and delete the entry:
   Publisher = "Long Mile Solutions, LLC"
9. Again In the right panel, locate and delete the entry:
   HelpLink = "http://www.{BLOCKED}rtapp.com/about.html"
10. Again In the right panel, locate and delete the entry:
    DisplayVersion = "2.6.20"
11. Again In the right panel, locate and delete the entry:
    UninstallString = "%Program Files%\SpyAlert\uninstall.exe /kb
12. Again In the right panel, locate and delete the entry:
    EstimatedSize = "451"
13. Again In the right panel, locate and delete the entry:
    InstallDate = "20130614"
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>policies>Ext
15. In the right panel, locate and delete the entry:
    ListBox_Support_CLSID = "1"
16. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>policies>Ext>CLSID
17. In the right panel, locate and delete the entry:
    {FED6A736-129B-49C7-857E-25FC91E87DB3} = "1"
18. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>MAO Settings
19. In the right panel, locate and delete the entry:
    AddonLoadTimeThreshold = "3e8"
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Google>Chrome>Extensions>igjjkeeamkpihpncmmbgdkhdnjpcfmfb
21. In the right panel, locate and delete the entry:
    version = "2.6.20"
22. Again In the right panel, locate and delete the entry:
    path = "%Program Files%\SpyAlert\Chrome\common.crx"
23. Again In the right panel, locate and delete the entry:
    AddonLoadTimeThreshold = "271"
24. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>DynConIE.DLL
25. In the right panel, locate and delete the entry:
    AppID = "{384997EE-E3BE-49C4-9ECA-C62B7C08128A}"
26. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{44ed99e2-16a6-4b89-80d6-5b21cf42e78b}>InprocServer32
27. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
28. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Browser Helper Objects>{44ed99e2-16a6-4b89-80d6-5b21cf42e78b}
29. In the right panel, locate and delete the entry:
    NoExplorer = "1"
30. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{2830488C-079B-45C2-88B6-AFE4EAA2DF85}>TypeLib
31. In the right panel, locate and delete the entry:
    Version = "1.0"
32. Again In the right panel, locate and delete the entry:
    ver = "2.6.20628"
33. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows Script>Settings
34. In the right panel, locate and delete the entry:
    JITDebug = "0"
35. Close Registry Editor.

To restore registry values this malware/grayware modified:

1. Open Registry Editor. To do this:
   
   • On Windows 2000, XP, and Server 2003:
     Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
   • On Windows Vista and 7:
     Click the Start button, type REGEDIT in the Search input field then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Zones>3
3. In the right panel, locate the registry value:
   1609 = "0"
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   1609 = "1"
5. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %User Temp%\nsc3.tmp\System.dll
   • %User Temp%\nsc3.tmp\modern-wizard.bmp
   • %User Temp%\nsc3.tmp\inetc.dll
   • %User Temp%\nsc3.tmp\response.txt
   • %User Temp%\nsc3.tmp\nsDialogs.dll
   • %User Temp%\nsc3.tmp\Processes.dll
   • %User Temp%\nsc3.tmp\KillProcWMI.dll
   • %Program Files%\SpyAlert\SpyAlert.ico
   • %Program Files%\SpyAlert\Chrome\common.crx
   • %Program Files%\SpyAlert\Firefox\chrome.manifest
   • %Program Files%\SpyAlert\Firefox\install.rdf
   • %Program Files%\SpyAlert\Firefox\chrome\content\main.js
   • %Program Files%\SpyAlert\Firefox\chrome\content\overlay.xul
   • %Program Files%\SpyAlert\IE\common.dll
   • %Program Files%\SpyAlert\Uninstall.exe
   • %User Profile%\support@spyalertapp.com\chrome.manifest
   • %User Profile%\support@spyalertapp.com\install.rdf
   • %User Profile%\content\main.js
   • %User Profile%\content\overlay.xul
   • %User Temp%\nsc3.tmp\util_ex.dll
   • %User Temp%\nsc3.tmp\version.dll
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %User Temp%\nsc3.tmp\System.dll
   • %User Temp%\nsc3.tmp\modern-wizard.bmp
   • %User Temp%\nsc3.tmp\inetc.dll
   • %User Temp%\nsc3.tmp\response.txt
   • %User Temp%\nsc3.tmp\nsDialogs.dll
   • %User Temp%\nsc3.tmp\Processes.dll
   • %User Temp%\nsc3.tmp\KillProcWMI.dll
   • %Program Files%\SpyAlert\SpyAlert.ico
   • %Program Files%\SpyAlert\Chrome\common.crx
   • %Program Files%\SpyAlert\Firefox\chrome.manifest
   • %Program Files%\SpyAlert\Firefox\install.rdf
   • %Program Files%\SpyAlert\Firefox\chrome\content\main.js
   • %Program Files%\SpyAlert\Firefox\chrome\content\overlay.xul
   • %Program Files%\SpyAlert\IE\common.dll
   • %Program Files%\SpyAlert\Uninstall.exe
   • %User Profile%\support@spyalertapp.com\chrome.manifest
   • %User Profile%\support@spyalertapp.com\install.rdf
   • %User Profile%\content\main.js
   • %User Profile%\content\overlay.xul
   • %User Temp%\nsc3.tmp\util_ex.dll
   • %User Temp%\nsc3.tmp\version.dll
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\Wilbert
   • %User Profile%\LOCALS~1
   • %User Temp%\nsc3.tmp
   • %Program Files%\SpyAlert
   • %Program Files%\SpyAlert\Chrome
   • %Program Files%\SpyAlert\Firefox
   • %Program Files%\SpyAlert\Firefox\chrome
   • %Program Files%\SpyAlert\Firefox\chrome\content
   • %Program Files%\SpyAlert\IE
   • %System Root%\Documents and Settings\Wilbert
   • %User Profile%\Application Data\Mozilla
   • %User Profile%\Mozilla\Firefox
   • %User Profile%\Firefox\extensions
   • %User Profile%\extensions\support@spyalertapp.com
   • %User Profile%\support@spyalertapp.com\chrome
   • %User Profile%\chrome\content
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\Wilbert
   • %User Profile%\LOCALS~1
   • %User Temp%\nsc3.tmp
   • %Program Files%\SpyAlert
   • %Program Files%\SpyAlert\Chrome
   • %Program Files%\SpyAlert\Firefox
   • %Program Files%\SpyAlert\Firefox\chrome
   • %Program Files%\SpyAlert\Firefox\chrome\content
   • %Program Files%\SpyAlert\IE
   • %System Root%\Documents and Settings\Wilbert
   • %User Profile%\Application Data\Mozilla
   • %User Profile%\Mozilla\Firefox
   • %User Profile%\Firefox\extensions
   • %User Profile%\extensions\support@spyalertapp.com
   • %User Profile%\support@spyalertapp.com\chrome
   • %User Profile%\chrome\content