ADW_BETTERSURF

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>MediaPlayerV1alpha6918
3. Still in the left panel, locate and delete the key:
   Components
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Mozilla>Firefox
5. Still in the left panel, locate and delete the key:
   Extensions
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>MediaPlayerV1
7. Still in the left panel, locate and delete the key:
   Media Player
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall
9. Still in the left panel, locate and delete the key:
   MediaPlayerV1alpha6918
10. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer
11. Still in the left panel, locate and delete the key:
    Approved Extensions
12. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Group Policy Objects
13. Still in the left panel, locate and delete the key:
    {3926D1C4-C121-4F12-8669-1B53D27F3C4F}User
14. Again Still in the left panel, locate and delete the key:
    {3926D1C4-C121-4F12-8669-1B53D27F3C4F}Machine
15. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Group Policy Objects>{3926D1C4-C121-4F12-8669-1B53D27F3C4F}Machine>Software>Policies>Google>Chrome
16. Still in the left panel, locate and delete the key:
    ExtensionInstallForcelist
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
18. Still in the left panel, locate and delete the key:
    {6808e709-1416-4376-9808-aec865dfdd5b}
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{6808e709-1416-4376-9808-aec865dfdd5b}
20. Still in the left panel, locate and delete the key:
    Programmable
21. Again Still in the left panel, locate and delete the key:
    InprocServer32
22. Again Still in the left panel, locate and delete the key:
    TypeLib
23. Again Still in the left panel, locate and delete the key:
    Version
24. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
25. Still in the left panel, locate and delete the key:
    {BBB46DE5-8E4B-4691-A21B-0ABE61F8573C}
26. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{BBB46DE5-8E4B-4691-A21B-0ABE61F8573C}
27. Still in the left panel, locate and delete the key:
    1.1
28. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{BBB46DE5-8E4B-4691-A21B-0ABE61F8573C}>1.1
29. Still in the left panel, locate and delete the key:
    FLAGS
30. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{BBB46DE5-8E4B-4691-A21B-0ABE61F8573C}>1.1>0
31. Still in the left panel, locate and delete the key:
    win32
32. Again Still in the left panel, locate and delete the key:
    HELPDIR
33. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
34. Still in the left panel, locate and delete the key:
    {3C1ABA66-65EB-4135-A628-0A620468B07F}
35. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{3C1ABA66-65EB-4135-A628-0A620468B07F}
36. Still in the left panel, locate and delete the key:
    ProxyStubClsid
37. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
38. Again Still in the left panel, locate and delete the key:
    TypeLib
39. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>MediaPlayerV1alpha6918>Components
3. In the right panel, locate and delete the entry:
   Ie = "1"
4. Again In the right panel, locate and delete the entry:
   Ch = "1"
5. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Mozilla>Firefox>Extensions
6. In the right panel, locate and delete the entry:
   ext@MediaPlayerV1alpha6918.net = "%Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\ff"
7. Again In the right panel, locate and delete the entry:
   ff = "1"
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>MediaPlayerV1>Media Player
9. In the right panel, locate and delete the entry:
   installed = "1"
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>MediaPlayerV1alpha6918
11. In the right panel, locate and delete the entry:
    Path = "%Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918"
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>MediaPlayerV1alpha6918
13. In the right panel, locate and delete the entry:
    DisplayName = "Media Player"
14. Again In the right panel, locate and delete the entry:
    DisplayVersion = "1.1"
15. Again In the right panel, locate and delete the entry:
    Publisher = "Media Player"
16. Again In the right panel, locate and delete the entry:
    DisplayIcon = "%Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\uninstall.exe"
17. Again In the right panel, locate and delete the entry:
    UninstallString = "%Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\uninstall.exe"
18. Again In the right panel, locate and delete the entry:
    NoModify = "1"
19. Again In the right panel, locate and delete the entry:
    NoRepair = "1"
20. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Approved Extensions
21. In the right panel, locate and delete the entry:
    {6808e709-1416-4376-9808-aec865dfdd5b} = "{random values}"
22. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Group Policy Objects>{3926D1C4-C121-4F12-8669-1B53D27F3C4F}Machine>Software>Policies>Google>Chrome>ExtensionInstallForcelist
23. In the right panel, locate and delete the entry:
    1 = "{random characters}"
24. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Browser Helper Objects>{6808e709-1416-4376-9808-aec865dfdd5b}
25. In the right panel, locate and delete the entry:
    NoExplorer = "1"
26. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{6808e709-1416-4376-9808-aec865dfdd5b}>InprocServer32
27. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
28. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{3C1ABA66-65EB-4135-A628-0A620468B07F}>TypeLib
29. In the right panel, locate and delete the entry:
    Version = "1.1"
30. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %User Temp%\nsk5.tmp\aminsis.dll
   • %User Temp%\aminsis.txt
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\ie\MediaPlayerV1alpha6918.dll
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\ch\MediaPlayerV1alpha6918.crx
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\ff\chrome.manifest
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\ff\install.rdf
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\ff\chrome\content\ffMediaPlayerV1alpha6918.js
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\ff\chrome\content\ffMediaPlayerV1alpha6918ffaction.js
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\ff\chrome\content\overlay.xul
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\ff\chrome\content\icons\Thumbs.db
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\ff\chrome\content\icons\default\MediaPlayerV1alpha6918_32.png
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\uninstall.exe
   • %System%\GroupPolicy\Machine\Registry.pol
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %User Temp%\nsk5.tmp\aminsis.dll
   • %User Temp%\aminsis.txt
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\ie\MediaPlayerV1alpha6918.dll
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\ch\MediaPlayerV1alpha6918.crx
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\ff\chrome.manifest
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\ff\install.rdf
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\ff\chrome\content\ffMediaPlayerV1alpha6918.js
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\ff\chrome\content\ffMediaPlayerV1alpha6918ffaction.js
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\ff\chrome\content\overlay.xul
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\ff\chrome\content\icons\Thumbs.db
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\ff\chrome\content\icons\default\MediaPlayerV1alpha6918_32.png
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\uninstall.exe
   • %System%\GroupPolicy\Machine\Registry.pol
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\Wilbert
   • %User Profile%\LOCALS~1
   • %User Temp%\nsk5.tmp
   • %Program Files%\MediaPlayerV1
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\ie
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\ch
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\ff
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\ff\chrome
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\ff\chrome\content
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\ff\chrome\content\icons
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\ff\chrome\content\icons\default
   • %System%\GroupPolicy
   • %System%\GroupPolicy\Machine
   • %System%\GroupPolicy\User
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\Wilbert
   • %User Profile%\LOCALS~1
   • %User Temp%\nsk5.tmp
   • %Program Files%\MediaPlayerV1
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\ie
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\ch
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\ff
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\ff\chrome
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\ff\chrome\content
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\ff\chrome\content\icons
   • %Program Files%\MediaPlayerV1\MediaPlayerV1alpha6918\ff\chrome\content\icons\default
   • %System%\GroupPolicy
   • %System%\GroupPolicy\Machine
   • %System%\GroupPolicy\User