PUA_Besttoolbars

To delete the registry key this malware/grayware created:

1. Open Registry Editor.
   » For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run, type regedit in the text box provided, and then press Enter.
   » For Windows Vista, Windows 7, and Windows Server 2008 users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, and Windows Server 2012 users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_USERS>.DEFAULT>Software>Microsoft>Internet Explorer>LowRegistry
3. Still in the left panel, locate and delete the key:
   IntelliConnect
4. In the left panel, double-click the following:
   HKEY_USERS>S-1-5-19>Software>Microsoft>Internet Explorer>LowRegistry
5. Still in the left panel, locate and delete the key:
   IntelliConnect
6. In the left panel, double-click the following:
   HKEY_USERS>S-1-5-19_Classes>Software>Microsoft>Internet Explorer>LowRegistry
7. Still in the left panel, locate and delete the key:
   IntelliConnect
8. In the left panel, double-click the following:
   HKEY_USERS>S-1-5-20>Software>Microsoft>Internet Explorer>LowRegistry
9. Still in the left panel, locate and delete the key:
   IntelliConnect
10. In the left panel, double-click the following:
    HKEY_USERS>S-1-5-20_Classes>Software>Microsoft>Internet Explorer>LowRegistry
11. Still in the left panel, locate and delete the key:
    IntelliConnect
12. In the left panel, double-click the following:
    HKEY_USERS>S-1-5-21-1645522239-1292428093-682003330-1003>Software>Microsoft>Internet Explorer>LowRegistry
13. Still in the left panel, locate and delete the key:
    IntelliConnect
14. In the left panel, double-click the following:
    HKEY_USERS>S-1-5-21-1645522239-1292428093-682003330-1003_Classes>Software>Microsoft>Internet Explorer>LowRegistry
15. Still in the left panel, locate and delete the key:
    IntelliConnect
16. In the left panel, double-click the following:
    HKEY_USERS>.DEFAULT>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities
17. Still in the left panel, locate and delete the key:
    Search Accelerator
18. In the left panel, double-click the following:
    HKEY_USERS>.DEFAULT>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator
19. Still in the left panel, locate and delete the key:
    cch.com
20. In the left panel, double-click the following:
    HKEY_USERS>.DEFAULT>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com
21. Still in the left panel, locate and delete the key:
    Action1
22. In the left panel, double-click the following:
    HKEY_USERS>.DEFAULT>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action1
23. Still in the left panel, locate and delete the key:
    execute
24. In the left panel, double-click the following:
    HKEY_USERS>.DEFAULT>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action1>execute
25. Still in the left panel, locate and delete the key:
    Parameter1
26. Again Still in the left panel, locate and delete the key:
    Parameter2
27. Again Still in the left panel, locate and delete the key:
    Parameter3
28. Again Still in the left panel, locate and delete the key:
    Parameter4
29. Again Still in the left panel, locate and delete the key:
    Parameter5
30. Again Still in the left panel, locate and delete the key:
    Action2
31. In the left panel, double-click the following:
    HKEY_USERS>.DEFAULT>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action2
32. Still in the left panel, locate and delete the key:
    execute
33. In the left panel, double-click the following:
    HKEY_USERS>.DEFAULT>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action2>execute
34. Still in the left panel, locate and delete the key:
    Parameter1
35. Again Still in the left panel, locate and delete the key:
    Parameter2
36. Again Still in the left panel, locate and delete the key:
    Parameter3
37. Again Still in the left panel, locate and delete the key:
    Parameter4
38. Again Still in the left panel, locate and delete the key:
    Parameter5
39. In the left panel, double-click the following:
    HKEY_USERS>S-1-5-19>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities
40. Still in the left panel, locate and delete the key:
    Search Accelerator
41. In the left panel, double-click the following:
    HKEY_USERS>S-1-5-19>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator
42. Still in the left panel, locate and delete the key:
    cch.com
43. In the left panel, double-click the following:
    HKEY_USERS>S-1-5-19>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com
44. Still in the left panel, locate and delete the key:
    Action1
45. In the left panel, double-click the following:
    HKEY_USERS>S-1-5-19>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action1
46. Still in the left panel, locate and delete the key:
    execute
47. In the left panel, double-click the following:
    HKEY_USERS>S-1-5-19>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action1>execute
48. Still in the left panel, locate and delete the key:
    Parameter1
49. Again Still in the left panel, locate and delete the key:
    Parameter2
50. Again Still in the left panel, locate and delete the key:
    Parameter3
51. Again Still in the left panel, locate and delete the key:
    Parameter4
52. Again Still in the left panel, locate and delete the key:
    Parameter5
53. Again Still in the left panel, locate and delete the key:
    Action2
54. In the left panel, double-click the following:
    HKEY_USERS>S-1-5-19>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action2
55. Still in the left panel, locate and delete the key:
    execute
56. In the left panel, double-click the following:
    HKEY_USERS>S-1-5-19>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action2>execute
57. Still in the left panel, locate and delete the key:
    Parameter1
58. Again Still in the left panel, locate and delete the key:
    Parameter2
59. Again Still in the left panel, locate and delete the key:
    Parameter3
60. Again Still in the left panel, locate and delete the key:
    Parameter4
61. Again Still in the left panel, locate and delete the key:
    Parameter5
62. In the left panel, double-click the following:
    HKEY_USERS>S-1-5-19_Classes>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities
63. Still in the left panel, locate and delete the key:
    Search Accelerator
64. In the left panel, double-click the following:
    HKEY_USERS>S-1-5-19_Classes>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator
65. Still in the left panel, locate and delete the key:
    cch.com
66. In the left panel, double-click the following:
    HKEY_USERS>S-1-5-19_Classes>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com
67. Still in the left panel, locate and delete the key:
    Action1
68. In the left panel, double-click the following:
    HKEY_USERS>S-1-5-19_Classes>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action1
69. Still in the left panel, locate and delete the key:
    execute
70. In the left panel, double-click the following:
    HKEY_USERS>S-1-5-19_Classes>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action1>execute
71. Still in the left panel, locate and delete the key:
    Parameter1
72. Again Still in the left panel, locate and delete the key:
    Parameter2
73. Again Still in the left panel, locate and delete the key:
    Parameter3
74. Again Still in the left panel, locate and delete the key:
    Parameter4
75. Again Still in the left panel, locate and delete the key:
    Parameter5
76. Again Still in the left panel, locate and delete the key:
    Action2
77. In the left panel, double-click the following:
    HKEY_USERS>S-1-5-19_Classes>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action2
78. Still in the left panel, locate and delete the key:
    execute
79. In the left panel, double-click the following:
    HKEY_USERS>S-1-5-19_Classes>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action2>execute
80. Still in the left panel, locate and delete the key:
    Parameter1
81. Again Still in the left panel, locate and delete the key:
    Parameter2
82. Again Still in the left panel, locate and delete the key:
    Parameter3
83. Again Still in the left panel, locate and delete the key:
    Parameter4
84. Again Still in the left panel, locate and delete the key:
    Parameter5
85. In the left panel, double-click the following:
    HKEY_USERS>S-1-5-20>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities
86. Still in the left panel, locate and delete the key:
    Search Accelerator
87. In the left panel, double-click the following:
    HKEY_USERS>S-1-5-20>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator
88. Still in the left panel, locate and delete the key:
    cch.com
89. In the left panel, double-click the following:
    HKEY_USERS>S-1-5-20>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com
90. Still in the left panel, locate and delete the key:
    Action1
91. In the left panel, double-click the following:
    HKEY_USERS>S-1-5-20>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action1
92. Still in the left panel, locate and delete the key:
    execute
93. In the left panel, double-click the following:
    HKEY_USERS>S-1-5-20>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action1>execute
94. Still in the left panel, locate and delete the key:
    Parameter1
95. Again Still in the left panel, locate and delete the key:
    Parameter2
96. Again Still in the left panel, locate and delete the key:
    Parameter3
97. Again Still in the left panel, locate and delete the key:
    Parameter4
98. Again Still in the left panel, locate and delete the key:
    Parameter5
99. Again Still in the left panel, locate and delete the key:
    Action2
100. In the left panel, double-click the following:
     HKEY_USERS>S-1-5-20>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action2
101. Still in the left panel, locate and delete the key:
     execute
102. In the left panel, double-click the following:
     HKEY_USERS>S-1-5-20>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action2>execute
103. Still in the left panel, locate and delete the key:
     Parameter1
104. Again Still in the left panel, locate and delete the key:
     Parameter2
105. Again Still in the left panel, locate and delete the key:
     Parameter3
106. Again Still in the left panel, locate and delete the key:
     Parameter4
107. Again Still in the left panel, locate and delete the key:
     Parameter5
108. In the left panel, double-click the following:
     HKEY_USERS>S-1-5-20_Classes>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities
109. Still in the left panel, locate and delete the key:
     Search Accelerator
110. In the left panel, double-click the following:
     HKEY_USERS>S-1-5-20_Classes>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator
111. Still in the left panel, locate and delete the key:
     cch.com
112. In the left panel, double-click the following:
     HKEY_USERS>S-1-5-20_Classes>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com
113. Still in the left panel, locate and delete the key:
     Action1
114. In the left panel, double-click the following:
     HKEY_USERS>S-1-5-20_Classes>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action1
115. Still in the left panel, locate and delete the key:
     execute
116. In the left panel, double-click the following:
     HKEY_USERS>S-1-5-20_Classes>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action1>execute
117. Still in the left panel, locate and delete the key:
     Parameter1
118. Again Still in the left panel, locate and delete the key:
     Parameter2
119. Again Still in the left panel, locate and delete the key:
     Parameter3
120. Again Still in the left panel, locate and delete the key:
     Parameter4
121. Again Still in the left panel, locate and delete the key:
     Parameter5
122. Again Still in the left panel, locate and delete the key:
     Action2
123. In the left panel, double-click the following:
     HKEY_USERS>S-1-5-20_Classes>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action2
124. Still in the left panel, locate and delete the key:
     execute
125. In the left panel, double-click the following:
     HKEY_USERS>S-1-5-20_Classes>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action2>execute
126. Still in the left panel, locate and delete the key:
     Parameter1
127. Again Still in the left panel, locate and delete the key:
     Parameter2
128. Again Still in the left panel, locate and delete the key:
     Parameter3
129. Again Still in the left panel, locate and delete the key:
     Parameter4
130. Again Still in the left panel, locate and delete the key:
     Parameter5
131. In the left panel, double-click the following:
     HKEY_USERS>S-1-5-21-1645522239-1292428093-682003330-1003>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities
132. Still in the left panel, locate and delete the key:
     Search Accelerator
133. In the left panel, double-click the following:
     HKEY_USERS>S-1-5-21-1645522239-1292428093-682003330-1003>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator
134. Still in the left panel, locate and delete the key:
     cch.com
135. In the left panel, double-click the following:
     HKEY_USERS>S-1-5-21-1645522239-1292428093-682003330-1003>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com
136. Still in the left panel, locate and delete the key:
     Action1
137. In the left panel, double-click the following:
     HKEY_USERS>S-1-5-21-1645522239-1292428093-682003330-1003>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action1
138. Still in the left panel, locate and delete the key:
     execute
139. In the left panel, double-click the following:
     HKEY_USERS>S-1-5-21-1645522239-1292428093-682003330-1003>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action1>execute
140. Still in the left panel, locate and delete the key:
     Parameter1
141. Again Still in the left panel, locate and delete the key:
     Parameter2
142. Again Still in the left panel, locate and delete the key:
     Parameter3
143. Again Still in the left panel, locate and delete the key:
     Parameter4
144. Again Still in the left panel, locate and delete the key:
     Parameter5
145. Again Still in the left panel, locate and delete the key:
     Action2
146. In the left panel, double-click the following:
     HKEY_USERS>S-1-5-21-1645522239-1292428093-682003330-1003>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action2
147. Still in the left panel, locate and delete the key:
     execute
148. In the left panel, double-click the following:
     HKEY_USERS>S-1-5-21-1645522239-1292428093-682003330-1003>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action2>execute
149. Still in the left panel, locate and delete the key:
     Parameter1
150. Again Still in the left panel, locate and delete the key:
     Parameter2
151. Again Still in the left panel, locate and delete the key:
     Parameter3
152. Again Still in the left panel, locate and delete the key:
     Parameter4
153. Again Still in the left panel, locate and delete the key:
     Parameter5
154. In the left panel, double-click the following:
     HKEY_USERS>S-1-5-21-1645522239-1292428093-682003330-1003_Classes>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities
155. Still in the left panel, locate and delete the key:
     Search Accelerator
156. In the left panel, double-click the following:
     HKEY_USERS>S-1-5-21-1645522239-1292428093-682003330-1003_Classes>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator
157. Still in the left panel, locate and delete the key:
     cch.com
158. In the left panel, double-click the following:
     HKEY_USERS>S-1-5-21-1645522239-1292428093-682003330-1003_Classes>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com
159. Still in the left panel, locate and delete the key:
     Action1
160. In the left panel, double-click the following:
     HKEY_USERS>S-1-5-21-1645522239-1292428093-682003330-1003_Classes>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action1
161. Still in the left panel, locate and delete the key:
     execute
162. In the left panel, double-click the following:
     HKEY_USERS>S-1-5-21-1645522239-1292428093-682003330-1003_Classes>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action1>execute
163. Still in the left panel, locate and delete the key:
     Parameter1
164. Again Still in the left panel, locate and delete the key:
     Parameter2
165. Again Still in the left panel, locate and delete the key:
     Parameter3
166. Again Still in the left panel, locate and delete the key:
     Parameter4
167. Again Still in the left panel, locate and delete the key:
     Parameter5
168. Again Still in the left panel, locate and delete the key:
     Action2
169. In the left panel, double-click the following:
     HKEY_USERS>S-1-5-21-1645522239-1292428093-682003330-1003_Classes>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action2
170. Still in the left panel, locate and delete the key:
     execute
171. In the left panel, double-click the following:
     HKEY_USERS>S-1-5-21-1645522239-1292428093-682003330-1003_Classes>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action2>execute
172. Still in the left panel, locate and delete the key:
     Parameter1
173. Again Still in the left panel, locate and delete the key:
     Parameter2
174. Again Still in the left panel, locate and delete the key:
     Parameter3
175. Again Still in the left panel, locate and delete the key:
     Parameter4
176. Again Still in the left panel, locate and delete the key:
     Parameter5
177. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>Software>Google>Chrome>NativeMessagingHosts
178. Still in the left panel, locate and delete the key:
     intelliconnect.sendmessages
179. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Uninstall
180. Still in the left panel, locate and delete the key:
     IntelliConnect Search
181. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer
182. Still in the left panel, locate and delete the key:
     MINIE
183. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software
184. Still in the left panel, locate and delete the key:
     IntelliConnect Search
185. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Low Rights>ElevationPolicy
186. Still in the left panel, locate and delete the key:
     {83BC8A3A-5770-4b45-87A3-02D65C3076C3}
187. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Main>FeatureControl
188. Still in the left panel, locate and delete the key:
     FEATURE_BROWSER_EMULATION
189. Again Still in the left panel, locate and delete the key:
     FEATURE_WEBOC_MOVESIZECHILD
190. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID
191. Still in the left panel, locate and delete the key:
     {18B9B16E-716F-43DF-A6AD-512C7D2EB983}
192. Again Still in the left panel, locate and delete the key:
     BackgroundHost.EXE
193. In the left panel, double-click the following:
     HKEY_CLASSES_ROOT
194. Still in the left panel, locate and delete the key:
     IntelliConnect Search.BackgroundHostObject.1
195. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>IntelliConnect Search.BackgroundHostObject.1
196. Still in the left panel, locate and delete the key:
     CLSID
197. Again Still in the left panel, locate and delete the key:
     IntelliConnect Search.BackgroundHostObject
198. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>IntelliConnect Search.BackgroundHostObject
199. Still in the left panel, locate and delete the key:
     CLSID
200. Again Still in the left panel, locate and delete the key:
     CurVer
201. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
202. Still in the left panel, locate and delete the key:
     {B1039E2E-E4AF-40A0-9094-81C031D14A22}
203. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B1039E2E-E4AF-40A0-9094-81C031D14A22}
204. Still in the left panel, locate and delete the key:
     ProgID
205. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
206. Again Still in the left panel, locate and delete the key:
     Programmable
207. Again Still in the left panel, locate and delete the key:
     LocalServer32
208. Again Still in the left panel, locate and delete the key:
     TypeLib
209. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
210. Still in the left panel, locate and delete the key:
     {450F902B-A690-4DB7-BD66-B77E525F75FD}
211. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{450F902B-A690-4DB7-BD66-B77E525F75FD}
212. Still in the left panel, locate and delete the key:
     1.0
213. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{450F902B-A690-4DB7-BD66-B77E525F75FD}>1.0
214. Still in the left panel, locate and delete the key:
     FLAGS
215. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{450F902B-A690-4DB7-BD66-B77E525F75FD}>1.0>0
216. Still in the left panel, locate and delete the key:
     win32
217. Again Still in the left panel, locate and delete the key:
     HELPDIR
218. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
219. Still in the left panel, locate and delete the key:
     {43969E3F-3E7C-4911-A8F1-79C6CA6AC731}
220. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{43969E3F-3E7C-4911-A8F1-79C6CA6AC731}
221. Still in the left panel, locate and delete the key:
     ProxyStubClsid
222. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
223. Again Still in the left panel, locate and delete the key:
     TypeLib
224. Again Still in the left panel, locate and delete the key:
     {19975B78-1907-4DD6-A437-4C48120F46A4}
225. Again Still in the left panel, locate and delete the key:
     AddonsFramework.DLL
226. Again Still in the left panel, locate and delete the key:
     {0D30A607-2ACE-4028-AC3D-E78BDDF97EB8}
227. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{0D30A607-2ACE-4028-AC3D-E78BDDF97EB8}
228. Still in the left panel, locate and delete the key:
     1.0
229. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{0D30A607-2ACE-4028-AC3D-E78BDDF97EB8}>1.0
230. Still in the left panel, locate and delete the key:
     FLAGS
231. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{0D30A607-2ACE-4028-AC3D-E78BDDF97EB8}>1.0>0
232. Still in the left panel, locate and delete the key:
     win32
233. Again Still in the left panel, locate and delete the key:
     HELPDIR
234. Again Still in the left panel, locate and delete the key:
     {94CADA2E-1D3F-419F-8A3D-06C58EDF53C8}
235. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{94CADA2E-1D3F-419F-8A3D-06C58EDF53C8}
236. Still in the left panel, locate and delete the key:
     ProxyStubClsid
237. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
238. Again Still in the left panel, locate and delete the key:
     TypeLib
239. Again Still in the left panel, locate and delete the key:
     {C1995F88-1C7F-40D7-B0FA-6F107F6308B8}
240. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C1995F88-1C7F-40D7-B0FA-6F107F6308B8}
241. Still in the left panel, locate and delete the key:
     ProxyStubClsid
242. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
243. Again Still in the left panel, locate and delete the key:
     TypeLib
244. Again Still in the left panel, locate and delete the key:
     {9E52EB8B-8DD9-4605-AD36-D352BCD482F2}
245. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{9E52EB8B-8DD9-4605-AD36-D352BCD482F2}
246. Still in the left panel, locate and delete the key:
     ProxyStubClsid
247. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
248. Again Still in the left panel, locate and delete the key:
     TypeLib
249. Again Still in the left panel, locate and delete the key:
     {A1440EC3-F0FA-407A-B811-DE6668C06D29}
250. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A1440EC3-F0FA-407A-B811-DE6668C06D29}
251. Still in the left panel, locate and delete the key:
     ProxyStubClsid
252. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
253. Again Still in the left panel, locate and delete the key:
     TypeLib
254. Again Still in the left panel, locate and delete the key:
     {B9A84AD0-5777-46FD-8B8F-1EBD06750FBC}
255. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B9A84AD0-5777-46FD-8B8F-1EBD06750FBC}
256. Still in the left panel, locate and delete the key:
     ProxyStubClsid
257. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
258. Again Still in the left panel, locate and delete the key:
     TypeLib
259. Again Still in the left panel, locate and delete the key:
     {395AFE6E-8308-48DB-89BE-ED5F4AA3D3EC}
260. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{395AFE6E-8308-48DB-89BE-ED5F4AA3D3EC}
261. Still in the left panel, locate and delete the key:
     ProxyStubClsid
262. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
263. Again Still in the left panel, locate and delete the key:
     TypeLib
264. Again Still in the left panel, locate and delete the key:
     {045F91B3-695F-423A-98C7-8DE3C47AA020}
265. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{045F91B3-695F-423A-98C7-8DE3C47AA020}
266. Still in the left panel, locate and delete the key:
     ProxyStubClsid
267. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
268. Again Still in the left panel, locate and delete the key:
     TypeLib
269. Again Still in the left panel, locate and delete the key:
     {BBBE01ED-0F1E-44DB-88C1-5CC1AEE3B462}
270. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BBBE01ED-0F1E-44DB-88C1-5CC1AEE3B462}
271. Still in the left panel, locate and delete the key:
     ProxyStubClsid
272. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
273. Again Still in the left panel, locate and delete the key:
     TypeLib
274. Again Still in the left panel, locate and delete the key:
     {F9EB11AB-9384-4736-9B33-993940F88895}
275. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{F9EB11AB-9384-4736-9B33-993940F88895}
276. Still in the left panel, locate and delete the key:
     ProxyStubClsid
277. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
278. Again Still in the left panel, locate and delete the key:
     TypeLib
279. Again Still in the left panel, locate and delete the key:
     {43B390F0-6BA2-45CA-ABF2-5DB0CEE9B49D}
280. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{43B390F0-6BA2-45CA-ABF2-5DB0CEE9B49D}
281. Still in the left panel, locate and delete the key:
     ProxyStubClsid
282. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
283. Again Still in the left panel, locate and delete the key:
     TypeLib
284. Again Still in the left panel, locate and delete the key:
     {E4A994B0-5550-4680-A4C6-B9470B888069}
285. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{E4A994B0-5550-4680-A4C6-B9470B888069}
286. Still in the left panel, locate and delete the key:
     ProxyStubClsid
287. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
288. Again Still in the left panel, locate and delete the key:
     TypeLib
289. Again Still in the left panel, locate and delete the key:
     {EE95078D-518C-4FD2-8093-FD1D4E33D3CA}
290. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{EE95078D-518C-4FD2-8093-FD1D4E33D3CA}
291. Still in the left panel, locate and delete the key:
     ProxyStubClsid
292. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
293. Again Still in the left panel, locate and delete the key:
     TypeLib
294. Again Still in the left panel, locate and delete the key:
     {C815E3DA-0823-49B0-9270-D1771D58B317}
295. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C815E3DA-0823-49B0-9270-D1771D58B317}
296. Still in the left panel, locate and delete the key:
     ProxyStubClsid
297. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
298. Again Still in the left panel, locate and delete the key:
     TypeLib
299. Again Still in the left panel, locate and delete the key:
     {1348BD1B-C32A-41A7-9BD4-5377AA1AB925}
300. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{1348BD1B-C32A-41A7-9BD4-5377AA1AB925}
301. Still in the left panel, locate and delete the key:
     ProxyStubClsid
302. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
303. Again Still in the left panel, locate and delete the key:
     TypeLib
304. Again Still in the left panel, locate and delete the key:
     {562B9316-C08A-444A-9482-62080DD851AE}
305. Again Still in the left panel, locate and delete the key:
     ScriptHost.DLL
306. Again Still in the left panel, locate and delete the key:
     IntelliConnect Search.ScriptHostObject.1
307. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>IntelliConnect Search.ScriptHostObject.1
308. Still in the left panel, locate and delete the key:
     CLSID
309. Again Still in the left panel, locate and delete the key:
     IntelliConnect Search.ScriptHostObject
310. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>IntelliConnect Search.ScriptHostObject
311. Still in the left panel, locate and delete the key:
     CLSID
312. Again Still in the left panel, locate and delete the key:
     CurVer
313. Again Still in the left panel, locate and delete the key:
     {D26D85EB-E331-40D9-A4C5-FE975A11EC59}
314. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{D26D85EB-E331-40D9-A4C5-FE975A11EC59}
315. Still in the left panel, locate and delete the key:
     ProgID
316. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
317. Again Still in the left panel, locate and delete the key:
     Programmable
318. Again Still in the left panel, locate and delete the key:
     InprocServer32
319. Again Still in the left panel, locate and delete the key:
     TypeLib
320. Again Still in the left panel, locate and delete the key:
     IntelliConnect Search.Tool.1
321. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>IntelliConnect Search.Tool.1
322. Still in the left panel, locate and delete the key:
     CLSID
323. Again Still in the left panel, locate and delete the key:
     IntelliConnect Search.Tool
324. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>IntelliConnect Search.Tool
325. Still in the left panel, locate and delete the key:
     CLSID
326. Again Still in the left panel, locate and delete the key:
     CurVer
327. Again Still in the left panel, locate and delete the key:
     {39D4315D-D55B-431B-BF4B-97122C514BC7}
328. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{39D4315D-D55B-431B-BF4B-97122C514BC7}
329. Still in the left panel, locate and delete the key:
     ProgID
330. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
331. Again Still in the left panel, locate and delete the key:
     Programmable
332. Again Still in the left panel, locate and delete the key:
     InprocServer32
333. Again Still in the left panel, locate and delete the key:
     TypeLib
334. Again Still in the left panel, locate and delete the key:
     {3E8745A9-50B0-4099-AC2E-E29BC3D1ED2D}
335. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{3E8745A9-50B0-4099-AC2E-E29BC3D1ED2D}
336. Still in the left panel, locate and delete the key:
     1.0
337. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{3E8745A9-50B0-4099-AC2E-E29BC3D1ED2D}>1.0
338. Still in the left panel, locate and delete the key:
     FLAGS
339. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{3E8745A9-50B0-4099-AC2E-E29BC3D1ED2D}>1.0>0
340. Still in the left panel, locate and delete the key:
     win32
341. Again Still in the left panel, locate and delete the key:
     HELPDIR
342. Again Still in the left panel, locate and delete the key:
     IntelliConnect Search.Navbar.1
343. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>IntelliConnect Search.Navbar.1
344. Still in the left panel, locate and delete the key:
     CLSID
345. Again Still in the left panel, locate and delete the key:
     IntelliConnect Search.Navbar
346. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>IntelliConnect Search.Navbar
347. Still in the left panel, locate and delete the key:
     CLSID
348. Again Still in the left panel, locate and delete the key:
     CurVer
349. Again Still in the left panel, locate and delete the key:
     {7DFF2557-208E-4581-90D9-0B84D3DEC35A}
350. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{7DFF2557-208E-4581-90D9-0B84D3DEC35A}
351. Still in the left panel, locate and delete the key:
     ProgID
352. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
353. Again Still in the left panel, locate and delete the key:
     Programmable
354. Again Still in the left panel, locate and delete the key:
     InprocServer32
355. Again Still in the left panel, locate and delete the key:
     TypeLib
356. Again Still in the left panel, locate and delete the key:
     {562B9317-C08A-444A-9482-62080DD851AE}
357. Again Still in the left panel, locate and delete the key:
     ButtonSite.DLL
358. Again Still in the left panel, locate and delete the key:
     {CB11C844-9744-482E-9CF4-AFF116F8618E}
359. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{CB11C844-9744-482E-9CF4-AFF116F8618E}
360. Still in the left panel, locate and delete the key:
     1.0
361. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{CB11C844-9744-482E-9CF4-AFF116F8618E}>1.0
362. Still in the left panel, locate and delete the key:
     FLAGS
363. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{CB11C844-9744-482E-9CF4-AFF116F8618E}>1.0>0
364. Still in the left panel, locate and delete the key:
     win32
365. Again Still in the left panel, locate and delete the key:
     HELPDIR
366. Again Still in the left panel, locate and delete the key:
     {544C2426-48FD-4C40-AE3B-31257FF334D0}
367. Again Still in the left panel, locate and delete the key:
     RegistryHelper.DLL
368. Again Still in the left panel, locate and delete the key:
     {A4341726-E922-47bb-86A6-23F4F4F67342}
369. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{A4341726-E922-47bb-86A6-23F4F4F67342}
370. Still in the left panel, locate and delete the key:
     InprocServer32
371. Again Still in the left panel, locate and delete the key:
     TypeLib
372. Again Still in the left panel, locate and delete the key:
     RegistryHelper.RegistryHelperObject.1
373. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>RegistryHelper.RegistryHelperObject.1
374. Still in the left panel, locate and delete the key:
     CLSID
375. Again Still in the left panel, locate and delete the key:
     RegistryHelper.RegistryHelperObject
376. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>RegistryHelper.RegistryHelperObject
377. Still in the left panel, locate and delete the key:
     CLSID
378. Again Still in the left panel, locate and delete the key:
     CurVer
379. Again Still in the left panel, locate and delete the key:
     {1917AB4C-E2E9-42ae-A51E-B5750F160BFB}
380. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{1917AB4C-E2E9-42ae-A51E-B5750F160BFB}
381. Still in the left panel, locate and delete the key:
     ProgID
382. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
383. Again Still in the left panel, locate and delete the key:
     Programmable
384. Again Still in the left panel, locate and delete the key:
     Implemented Categories
385. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{1917AB4C-E2E9-42ae-A51E-B5750F160BFB}>Implemented Categories
386. Still in the left panel, locate and delete the key:
     {7DD95801-9882-11CF-9FA9-00AA006C42C4}
387. Again Still in the left panel, locate and delete the key:
     {7DD95802-9882-11CF-9FA9-00AA006C42C4}
388. Again Still in the left panel, locate and delete the key:
     InprocServer32
389. Again Still in the left panel, locate and delete the key:
     TypeLib
390. Again Still in the left panel, locate and delete the key:
     {567A1ED0-A437-401F-9D84-A2B19CD697B5}
391. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{567A1ED0-A437-401F-9D84-A2B19CD697B5}
392. Still in the left panel, locate and delete the key:
     1.0
393. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{567A1ED0-A437-401F-9D84-A2B19CD697B5}>1.0
394. Still in the left panel, locate and delete the key:
     FLAGS
395. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{567A1ED0-A437-401F-9D84-A2B19CD697B5}>1.0>0
396. Still in the left panel, locate and delete the key:
     win32
397. Again Still in the left panel, locate and delete the key:
     HELPDIR
398. Again Still in the left panel, locate and delete the key:
     {E809EB5C-E1A2-4CD0-AF2B-705CB533F7B8}
399. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{E809EB5C-E1A2-4CD0-AF2B-705CB533F7B8}
400. Still in the left panel, locate and delete the key:
     ProxyStubClsid
401. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
402. Again Still in the left panel, locate and delete the key:
     TypeLib
403. Again Still in the left panel, locate and delete the key:
     {B887CA3B-D82B-4A01-AD29-E97444D01CE6}
404. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B887CA3B-D82B-4A01-AD29-E97444D01CE6}
405. Still in the left panel, locate and delete the key:
     ProxyStubClsid
406. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
407. Again Still in the left panel, locate and delete the key:
     TypeLib
408. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor.
   » For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run, type regedit in the text box provided, and then press Enter.
   » For Windows Vista, Windows 7, and Windows Server 2008 users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, and Windows Server 2012 users, right-click on the lower-left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>LowRegistry>IntelliConnect
3. In the right panel, locate and delete the entry:
   Version = "1.0.10.29"
4. Again In the right panel, locate and delete the entry:
   InstallUpdate = "msie;chrome;firefox"
5. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator
6. In the right panel, locate and delete the entry:
   DefaultActivity = "cch.com"
7. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com
8. In the right panel, locate and delete the entry:
   Description = "Find Friends on google."
9. Again In the right panel, locate and delete the entry:
   HomepageURL = "http://{BLOCKED}h.com"
10. Again In the right panel, locate and delete the entry:
    Domain = "cch.com"
11. Again In the right panel, locate and delete the entry:
    Verb = "Search Accelerator"
12. Again In the right panel, locate and delete the entry:
    DisplayName = "Search with IntelliConnect"
13. Again In the right panel, locate and delete the entry:
    Type = "1"
14. Again In the right panel, locate and delete the entry:
    Enabled = "1"
15. Again In the right panel, locate and delete the entry:
    Deleted = "0"
16. Again In the right panel, locate and delete the entry:
    ActionCount = "2"
17. Again In the right panel, locate and delete the entry:
    ContentMask = "6"
18. Again In the right panel, locate and delete the entry:
    Icon = "%Program Files%\IntelliConnect Search\img\green-16.ico"
19. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action1
20. In the right panel, locate and delete the entry:
    Context = "selection"
21. Again In the right panel, locate and delete the entry:
    HasPreview = "0"
22. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action1>execute
23. In the right panel, locate and delete the entry:
    Action = "https://{BLOCKED}hconnect.{BLOCKED}h.com/icsearch/SearchRedirect.aspx"
24. Again In the right panel, locate and delete the entry:
    Method = "get"
25. Again In the right panel, locate and delete the entry:
    Enctype = "application/x-www-form-urlencoded"
26. Again In the right panel, locate and delete the entry:
    Accept-charset = "utf-8"
27. Again In the right panel, locate and delete the entry:
    ParamCount = "5"
28. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action1>execute>Parameter1
29. In the right panel, locate and delete the entry:
    Name = "userid"
30. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action1>execute>Parameter2
31. In the right panel, locate and delete the entry:
    Name = "env"
32. Again In the right panel, locate and delete the entry:
    Value = "prod"
33. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action1>execute>Parameter3
34. In the right panel, locate and delete the entry:
    Name = "searchtype"
35. Again In the right panel, locate and delete the entry:
    Value = "context"
36. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action1>execute>Parameter4
37. In the right panel, locate and delete the entry:
    Name = "version"
38. Again In the right panel, locate and delete the entry:
    Value = "1.0.10.29"
39. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action1>execute>Parameter5
40. In the right panel, locate and delete the entry:
    Name = "query"
41. Again In the right panel, locate and delete the entry:
    Value = "{selection}"
42. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action2
43. In the right panel, locate and delete the entry:
    Context = "link"
44. Again In the right panel, locate and delete the entry:
    HasPreview = "0"
45. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action2>execute
46. In the right panel, locate and delete the entry:
    Action = "https://{BLOCKED}hconnect.{BLOCKED}h.com/icsearch/SearchRedirect.aspx"
47. Again In the right panel, locate and delete the entry:
    Method = "get"
48. Again In the right panel, locate and delete the entry:
    Enctype = "application/x-www-form-urlencoded"
49. Again In the right panel, locate and delete the entry:
    Accept-charset = "utf-8"
50. Again In the right panel, locate and delete the entry:
    ParamCount = "5"
51. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action2>execute>Parameter1
52. In the right panel, locate and delete the entry:
    Name = "userid"
53. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action2>execute>Parameter2
54. In the right panel, locate and delete the entry:
    Name = "env"
55. Again In the right panel, locate and delete the entry:
    Value = "prod"
56. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action2>execute>Parameter3
57. In the right panel, locate and delete the entry:
    Name = "searchtype"
58. Again In the right panel, locate and delete the entry:
    Value = "context"
59. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action2>execute>Parameter4
60. In the right panel, locate and delete the entry:
    Name = "version"
61. Again In the right panel, locate and delete the entry:
    Value = "1.0.10.29"
62. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Internet Settings>Activities>Search Accelerator>cch.com>Action2>execute>Parameter5
63. In the right panel, locate and delete the entry:
    Name = "query"
64. Again In the right panel, locate and delete the entry:
    Value = "{linkText}"
65. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>IntelliConnect Search
66. In the right panel, locate and delete the entry:
    DisplayName = "IntelliConnect® Search"
67. Again In the right panel, locate and delete the entry:
    UninstallString = "%Program Files%\IntelliConnect Search\uninstall.exe"
68. Again In the right panel, locate and delete the entry:
    DisplayVersion = "1.0.10.29"
69. Again In the right panel, locate and delete the entry:
    Publisher = "Wolters Kluwer"
70. Again In the right panel, locate and delete the entry:
    URLInfoAbout = "https://intelliconnect.{BLOCKED}h.com"
71. Again In the right panel, locate and delete the entry:
    DisplayIcon = "%Program Files%\IntelliConnect Search\uninstall.exe"
72. Again In the right panel, locate and delete the entry:
    InstDir = "%Program Files%\IntelliConnect Search"
73. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>MINIE
74. In the right panel, locate and delete the entry:
    CommandBarEnabled = "1"
75. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>IntelliConnect Search
76. In the right panel, locate and delete the entry:
    elevationPolicyGuid = "{83BC8A3A-5770-4b45-87A3-02D65C3076C3}"
77. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Low Rights>ElevationPolicy>{83BC8A3A-5770-4b45-87A3-02D65C3076C3}
78. In the right panel, locate and delete the entry:
    Policy = "3"
79. Again In the right panel, locate and delete the entry:
    AppPath = "%Program Files%\IntelliConnect Search"
80. Again In the right panel, locate and delete the entry:
    AppName = "BackgroundHost.exe"
81. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Main>FeatureControl>FEATURE_WEBOC_MOVESIZECHILD
82. In the right panel, locate and delete the entry:
    BackgroundHost.exe = "1"
83. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>BackgroundHost.EXE
84. In the right panel, locate and delete the entry:
    AppID = "{18B9B16E-716F-43DF-A6AD-512C7D2EB983}"
85. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{43969E3F-3E7C-4911-A8F1-79C6CA6AC731}>TypeLib
86. In the right panel, locate and delete the entry:
    Version = "1.0"
87. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>AddonsFramework.DLL
88. In the right panel, locate and delete the entry:
    AppID = "{19975B78-1907-4DD6-A437-4C48120F46A4}"
89. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{94CADA2E-1D3F-419F-8A3D-06C58EDF53C8}>TypeLib
90. In the right panel, locate and delete the entry:
    Version = "1.0"
91. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C1995F88-1C7F-40D7-B0FA-6F107F6308B8}>TypeLib
92. In the right panel, locate and delete the entry:
    Version = "1.0"
93. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{9E52EB8B-8DD9-4605-AD36-D352BCD482F2}>TypeLib
94. In the right panel, locate and delete the entry:
    Version = "1.0"
95. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A1440EC3-F0FA-407A-B811-DE6668C06D29}>TypeLib
96. In the right panel, locate and delete the entry:
    Version = "1.0"
97. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B9A84AD0-5777-46FD-8B8F-1EBD06750FBC}>TypeLib
98. In the right panel, locate and delete the entry:
    Version = "1.0"
99. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{395AFE6E-8308-48DB-89BE-ED5F4AA3D3EC}>TypeLib
100. In the right panel, locate and delete the entry:
     Version = "1.0"
101. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{045F91B3-695F-423A-98C7-8DE3C47AA020}>TypeLib
102. In the right panel, locate and delete the entry:
     Version = "1.0"
103. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BBBE01ED-0F1E-44DB-88C1-5CC1AEE3B462}>TypeLib
104. In the right panel, locate and delete the entry:
     Version = "1.0"
105. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{F9EB11AB-9384-4736-9B33-993940F88895}>TypeLib
106. In the right panel, locate and delete the entry:
     Version = "1.0"
107. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{43B390F0-6BA2-45CA-ABF2-5DB0CEE9B49D}>TypeLib
108. In the right panel, locate and delete the entry:
     Version = "1.0"
109. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{E4A994B0-5550-4680-A4C6-B9470B888069}>TypeLib
110. In the right panel, locate and delete the entry:
     Version = "1.0"
111. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{EE95078D-518C-4FD2-8093-FD1D4E33D3CA}>TypeLib
112. In the right panel, locate and delete the entry:
     Version = "1.0"
113. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C815E3DA-0823-49B0-9270-D1771D58B317}>TypeLib
114. In the right panel, locate and delete the entry:
     Version = "1.0"
115. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{1348BD1B-C32A-41A7-9BD4-5377AA1AB925}>TypeLib
116. In the right panel, locate and delete the entry:
     Version = "1.0"
117. Again In the right panel, locate and delete the entry:
     installId = "E5323541-FA37-4f42-A64A-12A5B1B18BEA"
118. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>ScriptHost.DLL
119. In the right panel, locate and delete the entry:
     AppID = "{562B9316-C08A-444A-9482-62080DD851AE}"
120. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Browser Helper Objects>{D26D85EB-E331-40D9-A4C5-FE975A11EC59}
121. In the right panel, locate and delete the entry:
     NoExplorer = "1"
122. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{D26D85EB-E331-40D9-A4C5-FE975A11EC59}>InprocServer32
123. In the right panel, locate and delete the entry:
     ThreadingModel = "Apartment"
124. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{39D4315D-D55B-431B-BF4B-97122C514BC7}>InprocServer32
125. In the right panel, locate and delete the entry:
     ThreadingModel = "Apartment"
126. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{7DFF2557-208E-4581-90D9-0B84D3DEC35A}>InprocServer32
127. In the right panel, locate and delete the entry:
     ThreadingModel = "Apartment"
128. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>ButtonSite.DLL
129. In the right panel, locate and delete the entry:
     AppID = "{562B9317-C08A-444A-9482-62080DD851AE}"
130. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>RegistryHelper.DLL
131. In the right panel, locate and delete the entry:
     AppID = "{544C2426-48FD-4C40-AE3B-31257FF334D0}"
132. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{A4341726-E922-47bb-86A6-23F4F4F67342}>InprocServer32
133. In the right panel, locate and delete the entry:
     ThreadingModel = "Apartment"
134. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{1917AB4C-E2E9-42ae-A51E-B5750F160BFB}>InprocServer32
135. In the right panel, locate and delete the entry:
     ThreadingModel = "Apartment"
136. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{1917AB4C-E2E9-42ae-A51E-B5750F160BFB}
137. In the right panel, locate and delete the entry:
     AppID = "{544C2426-48FD-4C40-AE3B-31257FF334D0}"
138. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{E809EB5C-E1A2-4CD0-AF2B-705CB533F7B8}>TypeLib
139. In the right panel, locate and delete the entry:
     Version = "1.0"
140. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B887CA3B-D82B-4A01-AD29-E97444D01CE6}>TypeLib
141. In the right panel, locate and delete the entry:
     Version = "1.0"
142. Close Registry Editor.

To manually delete a malware/grayware file from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the File name* input box, type the following:
   
   • %User Temp%\nst3.tmp\System.dll
   • %User Temp%\nst3.tmp\point1.bmp
   • %User Temp%\nst3.tmp\point2.bmp
   • %User Temp%\nst3.tmp\point3.bmp
   • %User Temp%\nst3.tmp\chrome.bmp
   • %User Temp%\nst3.tmp\ie9install.gif
   • %User Temp%\nst3.tmp\license.txt
   • %User Temp%\nst3.tmp\UserInfo.dll
   • %User Temp%\nst3.tmp\UAC.dll
   • %User Temp%\nst3.tmp\modern-header.bmp
   • %User Temp%\nst3.tmp\modern-wizard.bmp
   • %User Temp%\nst3.tmp\nsDialogs.dll
   • %Program Files%\IntelliConnect Search\AddonsFramework.Typelib.dll
   • %Program Files%\IntelliConnect Search\AddonsFramework.Typelib64.dll
   • %Program Files%\IntelliConnect Search\BackgroundHost.exe
   • %Program Files%\IntelliConnect Search\BackgroundHost64.exe
   • %Program Files%\IntelliConnect Search\ButtonSite.dll
   • %Program Files%\IntelliConnect Search\ButtonSite64.dll
   • %Program Files%\IntelliConnect Search\CallWebService.exe
   • %Program Files%\IntelliConnect Search\RegistryHelper.dll
   • %Program Files%\IntelliConnect Search\RegistryHelper64.dll
   • %Program Files%\IntelliConnect Search\ScriptHost.dll
   • %Program Files%\IntelliConnect Search\ScriptHost64.dll
   • %Program Files%\IntelliConnect Search\background.html
   • %Program Files%\IntelliConnect Search\bg.js
   • %Program Files%\IntelliConnect Search\browsers.js
   • %Program Files%\IntelliConnect Search\config.xml
   • %Program Files%\IntelliConnect Search\content.js
   • %Program Files%\IntelliConnect Search\csp.js
   • %Program Files%\IntelliConnect Search\icschrome.exe
   • %Program Files%\IntelliConnect Search\intelliconnect.sendmessages.json
   • %Program Files%\IntelliConnect Search\jquery-1.11.0.min.js
   • %Program Files%\IntelliConnect Search\jquery-1.9.1.min.js
   • %Program Files%\IntelliConnect Search\jquery.base64.js
   • %Program Files%\IntelliConnect Search\jquery.browser.min.js
   • %Program Files%\IntelliConnect Search\jquery.min.map
   • %Program Files%\IntelliConnect Search\json2.min.js
   • %Program Files%\IntelliConnect Search\manifest.json
   • %Program Files%\IntelliConnect Search\postmessage.js
   • %Program Files%\IntelliConnect Search\img\green-128.ico
   • %Program Files%\IntelliConnect Search\img\green-128.png
   • %Program Files%\IntelliConnect Search\img\green-16.ico
   • %Program Files%\IntelliConnect Search\img\green-16.png
   • %Program Files%\IntelliConnect Search\img\green-18.ico
   • %Program Files%\IntelliConnect Search\img\green-18.png
   • %Program Files%\IntelliConnect Search\img\green-2.png
   • %Program Files%\IntelliConnect Search\img\green-24.png
   • %Program Files%\IntelliConnect Search\img\green-48.ico
   • %Program Files%\IntelliConnect Search\img\green-48.png
   • %Program Files%\IntelliConnect Search\img\green2-128.png
   • %Program Files%\IntelliConnect Search\img\green2-16.png
   • %Program Files%\IntelliConnect Search\img\green2-18.png
   • %Program Files%\IntelliConnect Search\img\green2-24.png
   • %Program Files%\IntelliConnect Search\img\green2-48.png
   • %Program Files%\IntelliConnect Search\img\large-red.png
   • %Program Files%\IntelliConnect Search\img\red-128.png
   • %Program Files%\IntelliConnect Search\img\red-16.png
   • %Program Files%\IntelliConnect Search\img\red-18.png
   • %Program Files%\IntelliConnect Search\img\red-24.png
   • %Program Files%\IntelliConnect Search\img\red-48.png
   • %Program Files%\IntelliConnect Search\img\right-red.png
   • %Program Files%\IntelliConnect Search\img\toolbar icon v1.0.png
   • %Program Files%\IntelliConnect Search\popup\intelliPopup.js
   • %Program Files%\IntelliConnect Search\popup\jquery.modal.js
   • %Program Files%\IntelliConnect Search\popup\popup.html
   • %Program Files%\IntelliConnect Search\styles\cch.css
   • %Program Files%\IntelliConnect Search\styles\menu.css
   • %Program Files%\IntelliConnect Search\styles\popup.css
   • %User Temp%\nst3.tmp\xml.dll
   • %Program Files%\IntelliConnect Search\uninstall.exe
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: The file name input box title varies depending on the Windows version (e.g. Search for files or folders named or All or part of the file name.).

• For Windows Vista, Windows 7, Windows Server 2008, Windows 8, Windows 8.1, and Windows Server 2012:

1. Open a Windows Explorer window.
   • For Windows Vista, 7, and Server 2008 users, click Start>Computer.
   • For Windows 8, 8.1, and Server 2012 users, right-click on the lower left corner of the screen,then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %User Temp%\nst3.tmp\System.dll
   • %User Temp%\nst3.tmp\point1.bmp
   • %User Temp%\nst3.tmp\point2.bmp
   • %User Temp%\nst3.tmp\point3.bmp
   • %User Temp%\nst3.tmp\chrome.bmp
   • %User Temp%\nst3.tmp\ie9install.gif
   • %User Temp%\nst3.tmp\license.txt
   • %User Temp%\nst3.tmp\UserInfo.dll
   • %User Temp%\nst3.tmp\UAC.dll
   • %User Temp%\nst3.tmp\modern-header.bmp
   • %User Temp%\nst3.tmp\modern-wizard.bmp
   • %User Temp%\nst3.tmp\nsDialogs.dll
   • %Program Files%\IntelliConnect Search\AddonsFramework.Typelib.dll
   • %Program Files%\IntelliConnect Search\AddonsFramework.Typelib64.dll
   • %Program Files%\IntelliConnect Search\BackgroundHost.exe
   • %Program Files%\IntelliConnect Search\BackgroundHost64.exe
   • %Program Files%\IntelliConnect Search\ButtonSite.dll
   • %Program Files%\IntelliConnect Search\ButtonSite64.dll
   • %Program Files%\IntelliConnect Search\CallWebService.exe
   • %Program Files%\IntelliConnect Search\RegistryHelper.dll
   • %Program Files%\IntelliConnect Search\RegistryHelper64.dll
   • %Program Files%\IntelliConnect Search\ScriptHost.dll
   • %Program Files%\IntelliConnect Search\ScriptHost64.dll
   • %Program Files%\IntelliConnect Search\background.html
   • %Program Files%\IntelliConnect Search\bg.js
   • %Program Files%\IntelliConnect Search\browsers.js
   • %Program Files%\IntelliConnect Search\config.xml
   • %Program Files%\IntelliConnect Search\content.js
   • %Program Files%\IntelliConnect Search\csp.js
   • %Program Files%\IntelliConnect Search\icschrome.exe
   • %Program Files%\IntelliConnect Search\intelliconnect.sendmessages.json
   • %Program Files%\IntelliConnect Search\jquery-1.11.0.min.js
   • %Program Files%\IntelliConnect Search\jquery-1.9.1.min.js
   • %Program Files%\IntelliConnect Search\jquery.base64.js
   • %Program Files%\IntelliConnect Search\jquery.browser.min.js
   • %Program Files%\IntelliConnect Search\jquery.min.map
   • %Program Files%\IntelliConnect Search\json2.min.js
   • %Program Files%\IntelliConnect Search\manifest.json
   • %Program Files%\IntelliConnect Search\postmessage.js
   • %Program Files%\IntelliConnect Search\img\green-128.ico
   • %Program Files%\IntelliConnect Search\img\green-128.png
   • %Program Files%\IntelliConnect Search\img\green-16.ico
   • %Program Files%\IntelliConnect Search\img\green-16.png
   • %Program Files%\IntelliConnect Search\img\green-18.ico
   • %Program Files%\IntelliConnect Search\img\green-18.png
   • %Program Files%\IntelliConnect Search\img\green-2.png
   • %Program Files%\IntelliConnect Search\img\green-24.png
   • %Program Files%\IntelliConnect Search\img\green-48.ico
   • %Program Files%\IntelliConnect Search\img\green-48.png
   • %Program Files%\IntelliConnect Search\img\green2-128.png
   • %Program Files%\IntelliConnect Search\img\green2-16.png
   • %Program Files%\IntelliConnect Search\img\green2-18.png
   • %Program Files%\IntelliConnect Search\img\green2-24.png
   • %Program Files%\IntelliConnect Search\img\green2-48.png
   • %Program Files%\IntelliConnect Search\img\large-red.png
   • %Program Files%\IntelliConnect Search\img\red-128.png
   • %Program Files%\IntelliConnect Search\img\red-16.png
   • %Program Files%\IntelliConnect Search\img\red-18.png
   • %Program Files%\IntelliConnect Search\img\red-24.png
   • %Program Files%\IntelliConnect Search\img\red-48.png
   • %Program Files%\IntelliConnect Search\img\right-red.png
   • %Program Files%\IntelliConnect Search\img\toolbar icon v1.0.png
   • %Program Files%\IntelliConnect Search\popup\intelliPopup.js
   • %Program Files%\IntelliConnect Search\popup\jquery.modal.js
   • %Program Files%\IntelliConnect Search\popup\popup.html
   • %Program Files%\IntelliConnect Search\styles\cch.css
   • %Program Files%\IntelliConnect Search\styles\menu.css
   • %Program Files%\IntelliConnect Search\styles\popup.css
   • %User Temp%\nst3.tmp\xml.dll
   • %Program Files%\IntelliConnect Search\uninstall.exe
3. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the File name* input box, type:
   
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\Wilbert
   • %User Profile%\LOCALS~1
   • %User Temp%\nst3.tmp
   • %Program Files%\IntelliConnect Search
   • %Program Files%\IntelliConnect Search\img
   • %Program Files%\IntelliConnect Search\popup
   • %Program Files%\IntelliConnect Search\styles
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\Wilbert
   • %User Profile%\LOCALS~1
   • %User Temp%\nst3.tmp
   • %Program Files%\IntelliConnect Search
   • %Program Files%\IntelliConnect Search\img
   • %Program Files%\IntelliConnect Search\popup
   • %Program Files%\IntelliConnect Search\styles
   *Note: The file name input box title varies depending on the Windows version (e.g. Search for files or folders named or All or part of the file name.).

For Windows Vista, Windows 7, Windows Server 2008, Windows 8, Windows 8.1, and Windows Server 2012:

1. Open a Windows Explorer window.
   • For Windows Vista, 7, and Server 2008 users, click Start>Computer.
   • For Windows 8, 8.1, and Server 2012 users, right-click on the lower left corner of the screen, then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\Wilbert
   • %User Profile%\LOCALS~1
   • %User Temp%\nst3.tmp
   • %Program Files%\IntelliConnect Search
   • %Program Files%\IntelliConnect Search\img
   • %Program Files%\IntelliConnect Search\popup
   • %Program Files%\IntelliConnect Search\styles
3. Once located, select the file then press SHIFT+DELETE to permanently delete the folder.
4. Repeat steps 2-3 for the remaining folders:
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\Wilbert
   • %User Profile%\LOCALS~1
   • %User Temp%\nst3.tmp
   • %Program Files%\IntelliConnect Search
   • %Program Files%\IntelliConnect Search\img
   • %Program Files%\IntelliConnect Search\popup
   • %Program Files%\IntelliConnect Search\styles
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.