TROJ_DNSCHANGER.USAV0109

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>3721
3. Still in the left panel, locate and delete the key:
   CnsMin
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBScript
5. Still in the left panel, locate and delete the key:
   OLEScript
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBS
7. Still in the left panel, locate and delete the key:
   OLEScript
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B54F3741-5B07-11cf-A4B0-00AA004A55E8}
9. Still in the left panel, locate and delete the key:
   OLEScript
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBScript Author
11. Still in the left panel, locate and delete the key:
    OLEScript
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBS Author
13. Still in the left panel, locate and delete the key:
    OLEScript
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B54F3742-5B07-11cf-A4B0-00AA004A55E8}
15. Still in the left panel, locate and delete the key:
    OLEScript
16. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBScript.Encode
17. Still in the left panel, locate and delete the key:
    OLEScript
18. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B54F3743-5B07-11cf-A4B0-00AA004A55E8}
19. Still in the left panel, locate and delete the key:
    OLEScript
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBScript.RegExp
21. Still in the left panel, locate and delete the key:
    OLEScript
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{3F4DACA4-160D-11D2-A8E9-00104B365C9F}
23. Still in the left panel, locate and delete the key:
    OLEScript
24. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>JScript
25. Still in the left panel, locate and delete the key:
    OLEScript
26. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>LiveScript
27. Still in the left panel, locate and delete the key:
    OLEScript
28. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>JavaScript
29. Still in the left panel, locate and delete the key:
    OLEScript
30. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>JavaScript1.1
31. Still in the left panel, locate and delete the key:
    OLEScript
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>JavaScript1.2
33. Still in the left panel, locate and delete the key:
    OLEScript
34. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>JavaScript1.3
35. Still in the left panel, locate and delete the key:
    OLEScript
36. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ECMAScript
37. Still in the left panel, locate and delete the key:
    OLEScript
38. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}
39. Still in the left panel, locate and delete the key:
    OLEScript
40. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>JScript Author
41. Still in the left panel, locate and delete the key:
    OLEScript
42. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>LiveScript Author
43. Still in the left panel, locate and delete the key:
    OLEScript
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>JavaScript Author
45. Still in the left panel, locate and delete the key:
    OLEScript
46. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>JavaScript1.1 Author
47. Still in the left panel, locate and delete the key:
    OLEScript
48. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>JavaScript1.2 Author
49. Still in the left panel, locate and delete the key:
    OLEScript
50. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}
51. Still in the left panel, locate and delete the key:
    OLEScript
52. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>JScript.Encode
53. Still in the left panel, locate and delete the key:
    OLEScript
54. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}
55. Still in the left panel, locate and delete the key:
    OLEScript
56. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>3721>CnsMin
3. In the right panel, locate and delete the entry:
   IIS = "&fb
4. In the left panel, double-click the following:
   HKEY_CLASSES_ROOT
5. In the right panel, locate and delete the entry:
   VBScript = "VB Script Language"
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBScript
7. In the right panel, locate and delete the entry:
   CLSID = "{B54F3741-5B07-11cf-A4B0-00AA004A55E8}"
8. Again In the right panel, locate and delete the entry:
   VBS = "VB Script Language"
9. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBS
10. In the right panel, locate and delete the entry:
    CLSID = "{B54F3741-5B07-11cf-A4B0-00AA004A55E8}"
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
12. In the right panel, locate and delete the entry:
    {B54F3741-5B07-11cf-A4B0-00AA004A55E8} = "VB Script Language"
13. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B54F3741-5B07-11cf-A4B0-00AA004A55E8}
14. In the right panel, locate and delete the entry:
    ProgID = "VBScript"
15. Again In the right panel, locate and delete the entry:
    InprocServer32 = "%System%\vbscript.dll"
16. Again In the right panel, locate and delete the entry:
    VBScript Author = "VB Script Language Authoring"
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBScript Author
18. In the right panel, locate and delete the entry:
    CLSID = "{B54F3742-5B07-11cf-A4B0-00AA004A55E8}"
19. Again In the right panel, locate and delete the entry:
    VBS Author = "VB Script Language Authoring"
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBS Author
21. In the right panel, locate and delete the entry:
    CLSID = "{B54F3742-5B07-11cf-A4B0-00AA004A55E8}"
22. Again In the right panel, locate and delete the entry:
    {B54F3742-5B07-11cf-A4B0-00AA004A55E8} = "VB Script Language Authoring"
23. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B54F3742-5B07-11cf-A4B0-00AA004A55E8}
24. In the right panel, locate and delete the entry:
    ProgID = "VBScript Author"
25. Again In the right panel, locate and delete the entry:
    InprocServer32 = "%System%\vbscript.dll"
26. Again In the right panel, locate and delete the entry:
    VBScript.Encode = "VBScript Language Encoding"
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBScript.Encode
28. In the right panel, locate and delete the entry:
    CLSID = "{B54F3743-5B07-11cf-A4B0-00AA004A55E8}"
29. Again In the right panel, locate and delete the entry:
    {B54F3743-5B07-11cf-A4B0-00AA004A55E8} = "VBScript Language Encoding"
30. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B54F3743-5B07-11cf-A4B0-00AA004A55E8}
31. In the right panel, locate and delete the entry:
    ProgID = "VBScript.Encode"
32. Again In the right panel, locate and delete the entry:
    InprocServer32 = "%System%\vbscript.dll"
33. Again In the right panel, locate and delete the entry:
    VBScript.RegExp = "VBScript Regular Expression"
34. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>VBScript.RegExp
35. In the right panel, locate and delete the entry:
    CLSID = "{3F4DACA4-160D-11D2-A8E9-00104B365C9F}"
36. Again In the right panel, locate and delete the entry:
    {3F4DACA4-160D-11D2-A8E9-00104B365C9F} = "VBScript Regular Expression"
37. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{3F4DACA4-160D-11D2-A8E9-00104B365C9F}
38. In the right panel, locate and delete the entry:
    ProgID = "VBScript.RegExp"
39. Again In the right panel, locate and delete the entry:
    InprocServer32 = "%System%\vbscript.dll"
40. Again In the right panel, locate and delete the entry:
    JScript = "JScript Language"
41. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>JScript
42. In the right panel, locate and delete the entry:
    CLSID = "{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}"
43. Again In the right panel, locate and delete the entry:
    LiveScript = "JScript Language"
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>LiveScript
45. In the right panel, locate and delete the entry:
    CLSID = "{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}"
46. Again In the right panel, locate and delete the entry:
    JavaScript = "JScript Language"
47. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>JavaScript
48. In the right panel, locate and delete the entry:
    CLSID = "{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}"
49. Again In the right panel, locate and delete the entry:
    JavaScript1.1 = "JScript Language"
50. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>JavaScript1.1
51. In the right panel, locate and delete the entry:
    CLSID = "{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}"
52. Again In the right panel, locate and delete the entry:
    JavaScript1.2 = "JScript Language"
53. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>JavaScript1.2
54. In the right panel, locate and delete the entry:
    CLSID = "{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}"
55. Again In the right panel, locate and delete the entry:
    JavaScript1.3 = "JScript Language"
56. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>JavaScript1.3
57. In the right panel, locate and delete the entry:
    CLSID = "{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}"
58. Again In the right panel, locate and delete the entry:
    ECMAScript = "JScript Language"
59. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ECMAScript
60. In the right panel, locate and delete the entry:
    CLSID = "{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}"
61. Again In the right panel, locate and delete the entry:
    {f414c260-6ac0-11cf-b6d1-00aa00bbbb58} = "JScript Language"
62. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}
63. In the right panel, locate and delete the entry:
    ProgID = "JScript"
64. Again In the right panel, locate and delete the entry:
    InprocServer32 = "%System%\jscript.dll"
65. Again In the right panel, locate and delete the entry:
    JScript Author = "JScript Language Authoring"
66. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>JScript Author
67. In the right panel, locate and delete the entry:
    CLSID = "{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}"
68. Again In the right panel, locate and delete the entry:
    LiveScript Author = "JScript Language Authoring"
69. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>LiveScript Author
70. In the right panel, locate and delete the entry:
    CLSID = "{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}"
71. Again In the right panel, locate and delete the entry:
    JavaScript Author = "JScript Language Authoring"
72. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>JavaScript Author
73. In the right panel, locate and delete the entry:
    CLSID = "{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}"
74. Again In the right panel, locate and delete the entry:
    JavaScript1.1 Author = "JScript Language Authoring"
75. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>JavaScript1.1 Author
76. In the right panel, locate and delete the entry:
    CLSID = "{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}"
77. Again In the right panel, locate and delete the entry:
    JavaScript1.2 Author = "JScript Language Authoring"
78. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>JavaScript1.2 Author
79. In the right panel, locate and delete the entry:
    CLSID = "{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}"
80. Again In the right panel, locate and delete the entry:
    {f414c261-6ac0-11cf-b6d1-00aa00bbbb58} = "JScript Language Authoring"
81. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}
82. In the right panel, locate and delete the entry:
    ProgID = "JScript Author"
83. Again In the right panel, locate and delete the entry:
    InprocServer32 = "%System%\jscript.dll"
84. Again In the right panel, locate and delete the entry:
    JScript.Encode = "JScript Language Encoding"
85. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>JScript.Encode
86. In the right panel, locate and delete the entry:
    CLSID = "{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}"
87. Again In the right panel, locate and delete the entry:
    {f414c262-6ac0-11cf-b6d1-00aa00bbbb58} = "JScript Language Encoding"
88. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}
89. In the right panel, locate and delete the entry:
    ProgID = "JScript.Encode"
90. Again In the right panel, locate and delete the entry:
    InprocServer32 = "%System%\jscript.dll"
91. Close Registry Editor.

To restore the registry value this malware/grayware/spyware modified:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B54F3741-5B07-11cf-A4B0-00AA004A55E8}>InprocServer32
3. In the right panel, locate the registry value:
   ThreadingModel = "Both"
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   ThreadingModel = "Both"
5. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B54F3742-5B07-11cf-A4B0-00AA004A55E8}>InprocServer32
6. In the right panel, locate the registry value:
   ThreadingModel = "Both"
7. Right-click on the value name and choose Modify. Change the value data of this entry to:
   ThreadingModel = "Both"
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B54F3743-5B07-11cf-A4B0-00AA004A55E8}>InprocServer32
9. In the right panel, locate the registry value:
   ThreadingModel = "Both"
10. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Both"
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{3F4DACA4-160D-11D2-A8E9-00104B365C9F}>InprocServer32
12. In the right panel, locate the registry value:
    ThreadingModel = "Apartment"
13. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Apartment"
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{3F4DACA0-160D-11D2-A8E9-00104B365C9F}>TypeLib
15. In the right panel, locate the registry value:
    Version = "1.0"
16. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "5.5"
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{3F4DACA1-160D-11D2-A8E9-00104B365C9F}>TypeLib
18. In the right panel, locate the registry value:
    Version = "1.0"
19. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "5.5"
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{3F4DACA2-160D-11D2-A8E9-00104B365C9F}>TypeLib
21. In the right panel, locate the registry value:
    Version = "1.0"
22. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "5.5"
23. Again In the right panel, locate the registry value:
    Version = "5.5"
24. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "5.5"
25. Again In the right panel, locate the registry value:
    Version = "5.5"
26. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "5.5"
27. Again In the right panel, locate the registry value:
    Version = "5.5"
28. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "5.5"
29. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Active Setup>Installed Components>{4f645220-306d-11d2-995d-00c04f98bbc9}
30. In the right panel, locate the registry value:
    IsInstalled = "1"
31. Right-click on the value name and choose Modify. Change the value data of this entry to:
    IsInstalled = "1"
32. Again In the right panel, locate the registry value:
    Version = "5,6,0,8820"
33. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Version = "5,6,0,8820"
34. Again In the right panel, locate the registry value:
    Locale = "EN"
35. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Locale = "EN"
36. Again In the right panel, locate the registry value:
    ComponentID = "MSVBScript"
37. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ComponentID = "MSVBScript"
38. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}>InprocServer32
39. In the right panel, locate the registry value:
    ThreadingModel = "Both"
40. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Both"
41. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}>InprocServer32
42. In the right panel, locate the registry value:
    ThreadingModel = "Both"
43. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Both"
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}>InprocServer32
45. In the right panel, locate the registry value:
    ThreadingModel = "Both"
46. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ThreadingModel = "Both"
47. Close Registry Editor.

To delete malware/grayware component files:

1. Search for the following files:
   
   • %User Temp%\nsj2.tmp
   • %User Temp%\nsj3.tmp\wmpns.dll
   • %User Temp%\nsj3.tmp\System.dll
   • %User Temp%\nsj3.tmp\ioSpecial.ini
   • %User Temp%\nsj3.tmp\modern-wizard.bmp
   • %User Temp%\nsj3.tmp\modern-header.bmp
   • %User Temp%\nsj3.tmp\InstallOptions.dll
   
   Note: To do a search for the following files, right-click Start then click Search... or Find..., depending on the version of Windows you are running. For each file to be deleted, type its file name in the Named input box. In the Look In drop-down list, select My Computer, then press Enter.
2. Once located, select the file then press SHIFT+DELETE to permanently delete the file.
3. Repeat the said steps for all files listed.

To delete the malware/grayware folder:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %User Temp%\nsj3.tmp
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.