ADW_BOXORE

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Software>Update
3. Still in the left panel, locate and delete the key:
   network
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Software>Update>network
5. Still in the left panel, locate and delete the key:
   {random key}
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Software>Update>UsageStats
7. Still in the left panel, locate and delete the key:
   Daily
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Software>Update>Clients
9. Still in the left panel, locate and delete the key:
   {8D358B02-92A9-4150-8A80-11B40FCCA1DC}
10. Again Still in the left panel, locate and delete the key:
    ClientState
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Software>Update>ClientState
12. Still in the left panel, locate and delete the key:
    {8D358B02-92A9-4150-8A80-11B40FCCA1DC}
13. Again Still in the left panel, locate and delete the key:
    ClientStateMedium
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID
15. Still in the left panel, locate and delete the key:
    {32451DFC-C23B-4E12-866C-FC7982238504}
16. Again Still in the left panel, locate and delete the key:
    SoftwareUpdate.exe
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes
18. Still in the left panel, locate and delete the key:
    SoftwareUpdate.CoreClass.1
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>SoftwareUpdate.CoreClass.1
20. Still in the left panel, locate and delete the key:
    CLSID
21. Again Still in the left panel, locate and delete the key:
    SoftwareUpdate.CoreClass
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>SoftwareUpdate.CoreClass
23. Still in the left panel, locate and delete the key:
    CLSID
24. Again Still in the left panel, locate and delete the key:
    CurVer
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
26. Still in the left panel, locate and delete the key:
    {32451DFC-C23B-4E12-866C-FC7982238504}
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{32451DFC-C23B-4E12-866C-FC7982238504}
28. Still in the left panel, locate and delete the key:
    ProgID
29. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
30. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>MozillaPlugins
31. Still in the left panel, locate and delete the key:
    {random key}
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>MozillaPlugins>@www.dlmanager.net/omaha/tools//Software Update;version=8
33. Still in the left panel, locate and delete the key:
    MimeTypes
34. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>MozillaPlugins>@www.dlmanager.net/omaha/tools//Software Update;version=8>MimeTypes
35. Still in the left panel, locate and delete the key:
    application/x-vnd.software.oneclickctrl.8
36. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion
37. Still in the left panel, locate and delete the key:
    Ext
38. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext
39. Still in the left panel, locate and delete the key:
    PreApproved
40. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext>PreApproved
41. Still in the left panel, locate and delete the key:
    {42AEFAF9-09D6-4185-87AE-DEDF6E955CB4}
42. Again Still in the left panel, locate and delete the key:
    Stats
43. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext>Stats
44. Still in the left panel, locate and delete the key:
    {42AEFAF9-09D6-4185-87AE-DEDF6E955CB4}
45. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext>Stats>{42AEFAF9-09D6-4185-87AE-DEDF6E955CB4}
46. Still in the left panel, locate and delete the key:
    iexplore
47. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext>Stats>{42AEFAF9-09D6-4185-87AE-DEDF6E955CB4}>iexplore
48. Still in the left panel, locate and delete the key:
    AllowedDomains
49. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext>Stats>{42AEFAF9-09D6-4185-87AE-DEDF6E955CB4}>iexplore>AllowedDomains
50. Still in the left panel, locate and delete the key:
    *
51. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Low Rights>ElevationPolicy
52. Still in the left panel, locate and delete the key:
    {42AEFAF9-09D6-4185-87AE-DEDF6E955CB4}
53. Again Still in the left panel, locate and delete the key:
    Software.OneClickCtrl.8
54. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Software.OneClickCtrl.8
55. Still in the left panel, locate and delete the key:
    CLSID
56. Again Still in the left panel, locate and delete the key:
    {42AEFAF9-09D6-4185-87AE-DEDF6E955CB4}
57. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{42AEFAF9-09D6-4185-87AE-DEDF6E955CB4}
58. Still in the left panel, locate and delete the key:
    ProgID
59. Again Still in the left panel, locate and delete the key:
    InprocServer32
60. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>MIME>Database>Content Type
61. Still in the left panel, locate and delete the key:
    application/x-vnd.software.oneclickctrl.8
62. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Installer
63. Still in the left panel, locate and delete the key:
    InProgress
64. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Installer>UserData>S-1-5-18>Components
65. Still in the left panel, locate and delete the key:
    DDA484E0EDB80C24F9BF67BE0A6EEA99
66. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Installer>UserData>S-1-5-18>Products>64A6E60055D801F4BB8AC269354B72B8
67. Still in the left panel, locate and delete the key:
    InstallProperties
68. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Uninstall
69. Still in the left panel, locate and delete the key:
    {006E6A46-8D55-4F10-BBA8-2C9653B4278B}
70. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Installer>UpgradeCodes
71. Still in the left panel, locate and delete the key:
    BA086F2D38A8E1A47912955A68B3AD24
72. Again Still in the left panel, locate and delete the key:
    Usage
73. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Installer>Features
74. Still in the left panel, locate and delete the key:
    64A6E60055D801F4BB8AC269354B72B8
75. Again Still in the left panel, locate and delete the key:
    Features
76. Again Still in the left panel, locate and delete the key:
    Patches
77. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Installer>Products
78. Still in the left panel, locate and delete the key:
    64A6E60055D801F4BB8AC269354B72B8
79. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Installer>UpgradeCodes
80. Still in the left panel, locate and delete the key:
    BA086F2D38A8E1A47912955A68B3AD24
81. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Installer>Products>64A6E60055D801F4BB8AC269354B72B8
82. Still in the left panel, locate and delete the key:
    SourceList
83. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Installer>Products>64A6E60055D801F4BB8AC269354B72B8>SourceList
84. Still in the left panel, locate and delete the key:
    Net
85. Again Still in the left panel, locate and delete the key:
    Media
86. Again Still in the left panel, locate and delete the key:
    TempPackages
87. Again Still in the left panel, locate and delete the key:
    {AC5C4189-A8A0-4C9D-8910-C9CEF8360077}
88. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{AC5C4189-A8A0-4C9D-8910-C9CEF8360077}
89. Still in the left panel, locate and delete the key:
    InProcServer32
90. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
91. Still in the left panel, locate and delete the key:
    {7A1BCE27-099C-4628-B63A-AEC00C6376B3}
92. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{7A1BCE27-099C-4628-B63A-AEC00C6376B3}
93. Still in the left panel, locate and delete the key:
    ProxyStubClsid32
94. Again Still in the left panel, locate and delete the key:
    NumMethods
95. Again Still in the left panel, locate and delete the key:
    {E12D7149-73EF-45E4-A1E9-99FD7DAE62D3}
96. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{E12D7149-73EF-45E4-A1E9-99FD7DAE62D3}
97. Still in the left panel, locate and delete the key:
    ProxyStubClsid32
98. Again Still in the left panel, locate and delete the key:
    NumMethods
99. Again Still in the left panel, locate and delete the key:
    {DBE82879-914A-422F-BAE9-2ECC80BE536F}
100. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{DBE82879-914A-422F-BAE9-2ECC80BE536F}
101. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
102. Again Still in the left panel, locate and delete the key:
     NumMethods
103. Again Still in the left panel, locate and delete the key:
     {AF3AFF7C-B9E9-48DD-9002-212B6DEAAC02}
104. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{AF3AFF7C-B9E9-48DD-9002-212B6DEAAC02}
105. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
106. Again Still in the left panel, locate and delete the key:
     NumMethods
107. Again Still in the left panel, locate and delete the key:
     {736EF78E-5A04-46F9-893E-EDEC6EA5DF45}
108. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{736EF78E-5A04-46F9-893E-EDEC6EA5DF45}
109. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
110. Again Still in the left panel, locate and delete the key:
     NumMethods
111. Again Still in the left panel, locate and delete the key:
     {F2B184F1-547C-4EE9-BFC4-AC489C7077D9}
112. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{F2B184F1-547C-4EE9-BFC4-AC489C7077D9}
113. Still in the left panel, locate and delete the key:
     ProxyStubClsid32
114. Again Still in the left panel, locate and delete the key:
     NumMethods
115. Again Still in the left panel, locate and delete the key:
     SoftwareUpdateProcessLauncher.1.0
116. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>SoftwareUpdateProcessLauncher.1.0
117. Still in the left panel, locate and delete the key:
     CLSID
118. Again Still in the left panel, locate and delete the key:
     SoftwareUpdateProcessLauncher
119. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>SoftwareUpdateProcessLauncher
120. Still in the left panel, locate and delete the key:
     CLSID
121. Again Still in the left panel, locate and delete the key:
     CurVer
122. Again Still in the left panel, locate and delete the key:
     {092A2C6B-43EE-4F9F-8F8E-14ED5E11C14B}
123. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{092A2C6B-43EE-4F9F-8F8E-14ED5E11C14B}
124. Still in the left panel, locate and delete the key:
     ProgID
125. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
126. Again Still in the left panel, locate and delete the key:
     LocalServer32
127. Again Still in the left panel, locate and delete the key:
     TypeLib
128. Again Still in the left panel, locate and delete the key:
     SoftwareUpdate.OnDemandCOMClassMachine.1.0
129. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>SoftwareUpdate.OnDemandCOMClassMachine.1.0
130. Still in the left panel, locate and delete the key:
     CLSID
131. Again Still in the left panel, locate and delete the key:
     SoftwareUpdate.OnDemandCOMClassMachine
132. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>SoftwareUpdate.OnDemandCOMClassMachine
133. Still in the left panel, locate and delete the key:
     CLSID
134. Again Still in the left panel, locate and delete the key:
     CurVer
135. Again Still in the left panel, locate and delete the key:
     {257A6158-1416-4B31-9BF8-29FF49F3814F}
136. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{257A6158-1416-4B31-9BF8-29FF49F3814F}
137. Still in the left panel, locate and delete the key:
     ProgID
138. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
139. Again Still in the left panel, locate and delete the key:
     LocalServer32
140. Again Still in the left panel, locate and delete the key:
     TypeLib
141. Again Still in the left panel, locate and delete the key:
     Elevation
142. Again Still in the left panel, locate and delete the key:
     secure-S-1-5-18
143. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Tracing>Microsoft
144. Still in the left panel, locate and delete the key:
     BITS
145. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Tracing>Microsoft>BITS
146. Still in the left panel, locate and delete the key:
     CtlGuid
147. Again Still in the left panel, locate and delete the key:
     BITS
148. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Software>Update>UsageStats>Daily
3. In the right panel, locate and delete the entry:
   LastTransmission = "53c698cb"
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Software>Update>Clients>{8D358B02-92A9-4150-8A80-11B40FCCA1DC}
5. In the right panel, locate and delete the entry:
   pv = "1.2.201.0"
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Software>Update
7. In the right panel, locate and delete the entry:
   path = "%Program Files%\Software\Update\SoftwareUpdate.exe"
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Software>Update>ClientState>{8D358B02-92A9-4150-8A80-11B40FCCA1DC}
9. In the right panel, locate and delete the entry:
   brand = "GGLS"
10. Again In the right panel, locate and delete the entry:
    InstallTime = "53c698d9"
11. Again In the right panel, locate and delete the entry:
    pv = "1.2.201.0"
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>SoftwareUpdate.exe
13. In the right panel, locate and delete the entry:
    AppID = "{32451DFC-C23B-4E12-866C-FC7982238504}"
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>{32451DFC-C23B-4E12-866C-FC7982238504}
15. In the right panel, locate and delete the entry:
    LocalService = "supdate"
16. Again In the right panel, locate and delete the entry:
    ServiceParameters = "/comsvc"
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{32451DFC-C23B-4E12-866C-FC7982238504}
18. In the right panel, locate and delete the entry:
    AppID = "{32451DFC-C23B-4E12-866C-FC7982238504}"
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>MozillaPlugins>{random key}
20. In the right panel, locate and delete the entry:
    Path = "%Program Files%\Software\Update\1.2.201.0\npSoftwareOneClick8.dll"
21. Again In the right panel, locate and delete the entry:
    Description = "Software Update"
22. Again In the right panel, locate and delete the entry:
    ProductName = "Software Update"
23. Again In the right panel, locate and delete the entry:
    Vendor = "Software"
24. Again In the right panel, locate and delete the entry:
    Version = "8"
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Low Rights>ElevationPolicy>{42AEFAF9-09D6-4185-87AE-DEDF6E955CB4}
26. In the right panel, locate and delete the entry:
    AppName = "SoftwareUpdate.exe"
27. Again In the right panel, locate and delete the entry:
    AppPath = "%Program Files%\Software\Update"
28. Again In the right panel, locate and delete the entry:
    Policy = "3"
29. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{42AEFAF9-09D6-4185-87AE-DEDF6E955CB4}>InprocServer32
30. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>MIME>Database>Content Type>application/x-vnd.software.oneclickctrl.8
32. In the right panel, locate and delete the entry:
    CLSID = "{42AEFAF9-09D6-4185-87AE-DEDF6E955CB4}"
33. Again In the right panel, locate and delete the entry:
    version = "1.2.201.0"
34. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Installer>UserData>S-1-5-18>Components>DDA484E0EDB80C24F9BF67BE0A6EEA99
35. In the right panel, locate and delete the entry:
    64A6E60055D801F4BB8AC269354B72B8 = "02:\SOFTWARE\Software\Update\MsiStubRun"
36. Again In the right panel, locate and delete the entry:
    MsiStubRun = "0"
37. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Installer>UserData>S-1-5-18>Products>64A6E60055D801F4BB8AC269354B72B8>InstallProperties
38. In the right panel, locate and delete the entry:
    LocalPackage = "%Windows%\Installer\234c5.msi"
39. Again In the right panel, locate and delete the entry:
    DisplayVersion = "1.2.201.0"
40. Again In the right panel, locate and delete the entry:
    InstallDate = "20140716"
41. Again In the right panel, locate and delete the entry:
    InstallSource = "%Program Files%\Software\Update\1.2.201.0"
42. Again In the right panel, locate and delete the entry:
    ModifyPath = "MsiExec.exe /I{006E6A46-8D55-4F10-BBA8-2C9653B4278B}"
43. Again In the right panel, locate and delete the entry:
    Publisher = "Boxore OU."
44. Again In the right panel, locate and delete the entry:
    EstimatedSize = "2c"
45. Again In the right panel, locate and delete the entry:
    SystemComponent = "1"
46. Again In the right panel, locate and delete the entry:
    UninstallString = "MsiExec.exe /I{006E6A46-8D55-4F10-BBA8-2C9653B4278B}"
47. Again In the right panel, locate and delete the entry:
    VersionMajor = "1"
48. Again In the right panel, locate and delete the entry:
    VersionMinor = "2"
49. Again In the right panel, locate and delete the entry:
    WindowsInstaller = "1"
50. Again In the right panel, locate and delete the entry:
    Version = "12c9"
51. Again In the right panel, locate and delete the entry:
    Language = "49"
52. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>{006E6A46-8D55-4F10-BBA8-2C9653B4278B}
53. In the right panel, locate and delete the entry:
    DisplayVersion = "1.2.201.0"
54. Again In the right panel, locate and delete the entry:
    InstallDate = "20140716"
55. Again In the right panel, locate and delete the entry:
    InstallSource = "%Program Files%\Software\Update\1.2.201.0"
56. Again In the right panel, locate and delete the entry:
    ModifyPath = "MsiExec.exe /I{006E6A46-8D55-4F10-BBA8-2C9653B4278B}"
57. Again In the right panel, locate and delete the entry:
    Publisher = "Boxore OU."
58. Again In the right panel, locate and delete the entry:
    EstimatedSize = "2c"
59. Again In the right panel, locate and delete the entry:
    SystemComponent = "1"
60. Again In the right panel, locate and delete the entry:
    UninstallString = "MsiExec.exe /I{006E6A46-8D55-4F10-BBA8-2C9653B4278B}"
61. Again In the right panel, locate and delete the entry:
    VersionMajor = "1"
62. Again In the right panel, locate and delete the entry:
    VersionMinor = "2"
63. Again In the right panel, locate and delete the entry:
    WindowsInstaller = "1"
64. Again In the right panel, locate and delete the entry:
    Version = "12c9"
65. Again In the right panel, locate and delete the entry:
    Language = "49"
66. Again In the right panel, locate and delete the entry:
    DisplayName = "Software Update Helper"
67. Again In the right panel, locate and delete the entry:
    DisplayName = "Software Update Helper"
68. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Installer>UserData>S-1-5-18>Products>64A6E60055D801F4BB8AC269354B72B8>Features
69. In the right panel, locate and delete the entry:
    Complete = "Q73Z'@UZN9}2_btMdNIY"
70. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Installer>Products>64A6E60055D801F4BB8AC269354B72B8
71. In the right panel, locate and delete the entry:
    ProductName = "Software Update Helper"
72. Again In the right panel, locate and delete the entry:
    PackageCode = "FEC987A1E3BBF1D42B4C4B4C5965C5E9"
73. Again In the right panel, locate and delete the entry:
    Language = "49"
74. Again In the right panel, locate and delete the entry:
    Version = "12c9"
75. Again In the right panel, locate and delete the entry:
    Assignment = "1"
76. Again In the right panel, locate and delete the entry:
    AdvertiseFlags = "184"
77. Again In the right panel, locate and delete the entry:
    InstanceType = "0"
78. Again In the right panel, locate and delete the entry:
    AuthorizedLUAApp = "0"
79. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Installer>Products>64A6E60055D801F4BB8AC269354B72B8>SourceList
80. In the right panel, locate and delete the entry:
    PackageName = "SoftwareUpdateHelper.msi"
81. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Installer>Products>64A6E60055D801F4BB8AC269354B72B8>SourceList>Net
82. In the right panel, locate and delete the entry:
    1 = "%Program Files%\Software\Update\1.2.201.0"
83. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Installer>Products>64A6E60055D801F4BB8AC269354B72B8>SourceList>Media
84. In the right panel, locate and delete the entry:
    1 = ";"
85. Again In the right panel, locate and delete the entry:
    LastUsedSource = "n;1;%Program Files%\Software\Update\1.2.201.0"
86. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Installer>TempPackages
87. In the right panel, locate and delete the entry:
    %Windows%\Installer\234c5.msi = "0"
88. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{AC5C4189-A8A0-4C9D-8910-C9CEF8360077}>InProcServer32
89. In the right panel, locate and delete the entry:
    ThreadingModel = "Both"
90. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{257A6158-1416-4B31-9BF8-29FF49F3814F}
91. In the right panel, locate and delete the entry:
    LocalizedString = "@%Program Files%\Software\Update\1.2.201.0\goopdate.dll,-3000"
92. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{257A6158-1416-4B31-9BF8-29FF49F3814F}>Elevation
93. In the right panel, locate and delete the entry:
    Enabled = "1"
94. Again In the right panel, locate and delete the entry:
    IconReference = "@%Program Files%\Software\Update\1.2.201.0\goopdate.dll,-1004"
95. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Tracing>Microsoft>BITS
96. In the right panel, locate and delete the entry:
    LogSessionName = "stdout"
97. Again In the right panel, locate and delete the entry:
    Active = "1"
98. Again In the right panel, locate and delete the entry:
    ControlFlags = "1"
99. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Tracing>Microsoft>BITS>CtlGuid
100. In the right panel, locate and delete the entry:
     Guid = "4a8aaa94-cfc4-46a7-8e4e-17bc45608f0a"
101. Again In the right panel, locate and delete the entry:
     BitNames = "{random characters}"
102. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>Control>BackupRestore>FilesNotToBackup
103. In the right panel, locate and delete the entry:
     BITS_metadata = "%User Profile%\Downloader\*"
104. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>BITS
105. In the right panel, locate and delete the entry:
     StateIndex = "0"
106. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %User Temp%\GUM1.tmp\SoftwareUpdate.exe
   • %User Temp%\GUM1.tmp\SoftwareCrashHandler.exe
   • %User Temp%\GUM1.tmp\goopdate.dll
   • %User Temp%\GUM1.tmp\npSoftwareOneClick8.dll
   • %User Temp%\GUM1.tmp\GoopdateBho.dll
   • %User Temp%\GUM1.tmp\SoftwareUpdateHelper.msi
   • %User Temp%\GUM1.tmp\goopdateres_ar.dll
   • %User Temp%\GUM1.tmp\goopdateres_bg.dll
   • %User Temp%\GUM1.tmp\goopdateres_bn.dll
   • %User Temp%\GUM1.tmp\goopdateres_ca.dll
   • %User Temp%\GUM1.tmp\goopdateres_cs.dll
   • %User Temp%\GUM1.tmp\goopdateres_da.dll
   • %User Temp%\GUM1.tmp\goopdateres_de.dll
   • %User Temp%\GUM1.tmp\goopdateres_el.dll
   • %User Temp%\GUM1.tmp\goopdateres_en.dll
   • %User Temp%\GUM1.tmp\goopdateres_en-GB.dll
   • %User Temp%\GUM1.tmp\goopdateres_es.dll
   • %User Temp%\GUM1.tmp\goopdateres_es-419.dll
   • %User Temp%\GUM1.tmp\goopdateres_et.dll
   • %User Temp%\GUM1.tmp\goopdateres_fa.dll
   • %User Temp%\GUM1.tmp\goopdateres_fi.dll
   • %User Temp%\GUM1.tmp\goopdateres_fil.dll
   • %User Temp%\GUM1.tmp\goopdateres_fr.dll
   • %User Temp%\GUM1.tmp\goopdateres_gu.dll
   • %User Temp%\GUM1.tmp\goopdateres_hi.dll
   • %User Temp%\GUM1.tmp\goopdateres_hr.dll
   • %User Temp%\GUM1.tmp\goopdateres_hu.dll
   • %User Temp%\GUM1.tmp\goopdateres_id.dll
   • %User Temp%\GUM1.tmp\goopdateres_is.dll
   • %User Temp%\GUM1.tmp\goopdateres_it.dll
   • %User Temp%\GUM1.tmp\goopdateres_iw.dll
   • %User Temp%\GUM1.tmp\goopdateres_ja.dll
   • %User Temp%\GUM1.tmp\goopdateres_kn.dll
   • %User Temp%\GUM1.tmp\goopdateres_ko.dll
   • %User Temp%\GUM1.tmp\goopdateres_lt.dll
   • %User Temp%\GUM1.tmp\goopdateres_lv.dll
   • %User Temp%\GUM1.tmp\goopdateres_ml.dll
   • %User Temp%\GUM1.tmp\goopdateres_mr.dll
   • %User Temp%\GUM1.tmp\goopdateres_ms.dll
   • %User Temp%\GUM1.tmp\goopdateres_nl.dll
   • %User Temp%\GUM1.tmp\goopdateres_no.dll
   • %User Temp%\GUM1.tmp\goopdateres_or.dll
   • %User Temp%\GUM1.tmp\goopdateres_pl.dll
   • %User Temp%\GUM1.tmp\goopdateres_pt-BR.dll
   • %User Temp%\GUM1.tmp\goopdateres_pt-PT.dll
   • %User Temp%\GUM1.tmp\goopdateres_ro.dll
   • %User Temp%\GUM1.tmp\goopdateres_ru.dll
   • %User Temp%\GUM1.tmp\goopdateres_sk.dll
   • %User Temp%\GUM1.tmp\goopdateres_sl.dll
   • %User Temp%\GUM1.tmp\goopdateres_sr.dll
   • %User Temp%\GUM1.tmp\goopdateres_sv.dll
   • %User Temp%\GUM1.tmp\goopdateres_ta.dll
   • %User Temp%\GUM1.tmp\goopdateres_te.dll
   • %User Temp%\GUM1.tmp\goopdateres_th.dll
   • %User Temp%\GUM1.tmp\goopdateres_tr.dll
   • %User Temp%\GUM1.tmp\goopdateres_uk.dll
   • %User Temp%\GUM1.tmp\goopdateres_ur.dll
   • %User Temp%\GUM1.tmp\goopdateres_vi.dll
   • %User Temp%\GUM1.tmp\goopdateres_zh-CN.dll
   • %User Temp%\GUM1.tmp\goopdateres_zh-TW.dll
   • %Windows%\Tasks\SoftwareUpdateTaskMachineCore.job
   • %Windows%\Tasks\SoftwareUpdateTaskMachineUA.job
   • %Windows%\Installer\234c2.msi
   • %Windows%\Installer\234c4.ipi
   • %Windows%\Installer\MSI8F.tmp
   • %Windows%\Installer\234c5.msi
   • %Windows%\Installer\234c7.ipi
   • %Windows%\Installer\MSIA7.tmp
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %User Temp%\GUM1.tmp\SoftwareUpdate.exe
   • %User Temp%\GUM1.tmp\SoftwareCrashHandler.exe
   • %User Temp%\GUM1.tmp\goopdate.dll
   • %User Temp%\GUM1.tmp\npSoftwareOneClick8.dll
   • %User Temp%\GUM1.tmp\GoopdateBho.dll
   • %User Temp%\GUM1.tmp\SoftwareUpdateHelper.msi
   • %User Temp%\GUM1.tmp\goopdateres_ar.dll
   • %User Temp%\GUM1.tmp\goopdateres_bg.dll
   • %User Temp%\GUM1.tmp\goopdateres_bn.dll
   • %User Temp%\GUM1.tmp\goopdateres_ca.dll
   • %User Temp%\GUM1.tmp\goopdateres_cs.dll
   • %User Temp%\GUM1.tmp\goopdateres_da.dll
   • %User Temp%\GUM1.tmp\goopdateres_de.dll
   • %User Temp%\GUM1.tmp\goopdateres_el.dll
   • %User Temp%\GUM1.tmp\goopdateres_en.dll
   • %User Temp%\GUM1.tmp\goopdateres_en-GB.dll
   • %User Temp%\GUM1.tmp\goopdateres_es.dll
   • %User Temp%\GUM1.tmp\goopdateres_es-419.dll
   • %User Temp%\GUM1.tmp\goopdateres_et.dll
   • %User Temp%\GUM1.tmp\goopdateres_fa.dll
   • %User Temp%\GUM1.tmp\goopdateres_fi.dll
   • %User Temp%\GUM1.tmp\goopdateres_fil.dll
   • %User Temp%\GUM1.tmp\goopdateres_fr.dll
   • %User Temp%\GUM1.tmp\goopdateres_gu.dll
   • %User Temp%\GUM1.tmp\goopdateres_hi.dll
   • %User Temp%\GUM1.tmp\goopdateres_hr.dll
   • %User Temp%\GUM1.tmp\goopdateres_hu.dll
   • %User Temp%\GUM1.tmp\goopdateres_id.dll
   • %User Temp%\GUM1.tmp\goopdateres_is.dll
   • %User Temp%\GUM1.tmp\goopdateres_it.dll
   • %User Temp%\GUM1.tmp\goopdateres_iw.dll
   • %User Temp%\GUM1.tmp\goopdateres_ja.dll
   • %User Temp%\GUM1.tmp\goopdateres_kn.dll
   • %User Temp%\GUM1.tmp\goopdateres_ko.dll
   • %User Temp%\GUM1.tmp\goopdateres_lt.dll
   • %User Temp%\GUM1.tmp\goopdateres_lv.dll
   • %User Temp%\GUM1.tmp\goopdateres_ml.dll
   • %User Temp%\GUM1.tmp\goopdateres_mr.dll
   • %User Temp%\GUM1.tmp\goopdateres_ms.dll
   • %User Temp%\GUM1.tmp\goopdateres_nl.dll
   • %User Temp%\GUM1.tmp\goopdateres_no.dll
   • %User Temp%\GUM1.tmp\goopdateres_or.dll
   • %User Temp%\GUM1.tmp\goopdateres_pl.dll
   • %User Temp%\GUM1.tmp\goopdateres_pt-BR.dll
   • %User Temp%\GUM1.tmp\goopdateres_pt-PT.dll
   • %User Temp%\GUM1.tmp\goopdateres_ro.dll
   • %User Temp%\GUM1.tmp\goopdateres_ru.dll
   • %User Temp%\GUM1.tmp\goopdateres_sk.dll
   • %User Temp%\GUM1.tmp\goopdateres_sl.dll
   • %User Temp%\GUM1.tmp\goopdateres_sr.dll
   • %User Temp%\GUM1.tmp\goopdateres_sv.dll
   • %User Temp%\GUM1.tmp\goopdateres_ta.dll
   • %User Temp%\GUM1.tmp\goopdateres_te.dll
   • %User Temp%\GUM1.tmp\goopdateres_th.dll
   • %User Temp%\GUM1.tmp\goopdateres_tr.dll
   • %User Temp%\GUM1.tmp\goopdateres_uk.dll
   • %User Temp%\GUM1.tmp\goopdateres_ur.dll
   • %User Temp%\GUM1.tmp\goopdateres_vi.dll
   • %User Temp%\GUM1.tmp\goopdateres_zh-CN.dll
   • %User Temp%\GUM1.tmp\goopdateres_zh-TW.dll
   • %Windows%\Tasks\SoftwareUpdateTaskMachineCore.job
   • %Windows%\Tasks\SoftwareUpdateTaskMachineUA.job
   • %Windows%\Installer\234c2.msi
   • %Windows%\Installer\234c4.ipi
   • %Windows%\Installer\MSI8F.tmp
   • %Windows%\Installer\234c5.msi
   • %Windows%\Installer\234c7.ipi
   • %Windows%\Installer\MSIA7.tmp
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %User Temp%\GUM1.tmp
   • %Application Data%\Software
   • %Application Data%\Software\CrashReports
   • %Program Files%\Software
   • %Program Files%\Software\CrashReports
   • %Program Files%\Software\Update
   • %Program Files%\Software\Update\1.2.201.0
   • %Program Files%\Software\Update\Offline
   • %User Profile%\Application Data\Software
   • %User Profile%\Software\Update
   • %User Profile%\Update\Download
   • %System Root%\MSI234c3.tmp
   • %System Root%\MSI234c6.tmp
   • %Application Data%\Software\Update
   • %Application Data%\Software\Update\Manifest
   • %Application Data%\Software\Update\Manifest\Initial
   • %User Profile%\Network\Downloader
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %User Temp%\GUM1.tmp
   • %Application Data%\Software
   • %Application Data%\Software\CrashReports
   • %Program Files%\Software
   • %Program Files%\Software\CrashReports
   • %Program Files%\Software\Update
   • %Program Files%\Software\Update\1.2.201.0
   • %Program Files%\Software\Update\Offline
   • %User Profile%\Application Data\Software
   • %User Profile%\Software\Update
   • %User Profile%\Update\Download
   • %System Root%\MSI234c3.tmp
   • %System Root%\MSI234c6.tmp
   • %Application Data%\Software\Update
   • %Application Data%\Software\Update\Manifest
   • %Application Data%\Software\Update\Manifest\Initial
   • %User Profile%\Network\Downloader