PUA.Win32.Koal.AA

To delete registry keys this malware/grayware created:

1. Open Registry Editor. To do this:
   » For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run, type regedit in the text box provided, and then press Enter.
   » For Windows Vista, Windows 7, and Windows Server 2008 users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, and Windows Server 2012 users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel of the Registry Editor window, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>ROOT>Certificates>b26fa75369d6fd879204d8e67fcc105ef35fcd84
3. Still in the left panel, locate and delete the key:
   (null)
4. In the left panel of the Registry Editor window, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>CA>Certificates>bd17d49c65ffb327c31fab7d0b216fe6c6a72366
5. Still in the left panel, locate and delete the key:
   (null)
6. In the left panel of the Registry Editor window, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{ID}
7. Still in the left panel, locate and delete the key:
   {Default} = "KoalCspWrapper Property Page"
8. In the left panel of the Registry Editor window, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{ID}>InprocServer32
9. Still in the left panel, locate and delete the key:
   {Default} = "%System%\KOALCS~1.OCX"
10. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>KoalEAClient.CspWrapper.1
11. Still in the left panel, locate and delete the key:
    {Default} = "KoalCspWrapper Control"
12. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>KoalEAClient.CspWrapper.1>CLSID
13. Still in the left panel, locate and delete the key:
    {Default} = "{ID}"
14. Again Still in the left panel, locate and delete the key:
    {Default} = "KoalCspWrapper Control"
15. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{ID}>ProgID
16. Still in the left panel, locate and delete the key:
    {Default} = "KoalEAClient.CspWrapper.1"
17. Again Still in the left panel, locate and delete the key:
    {Default} = "%System%\KOALCS~1.OCX"
18. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{ID}>ToolboxBitmap32
19. Still in the left panel, locate and delete the key:
    {Default} = "%System%\KOALCS~1.OCX, 1"
20. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{ID}>MiscStatus
21. Still in the left panel, locate and delete the key:
    {Default} = "0"
22. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{ID}>MiscStatus>1
23. Still in the left panel, locate and delete the key:
    {Default} = "131473"
24. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{ID}>Control
25. Still in the left panel, locate and delete the key:
    {Default} = ""
26. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{ID}>TypeLib
27. Still in the left panel, locate and delete the key:
    {Default} = "{ID}"
28. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{ID}>Version
29. Still in the left panel, locate and delete the key:
    {Default} = "1.0"
30. Again Still in the left panel, locate and delete the key:
    ThreadingModel = "Apartment"
31. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Component Categories>{ID}
32. Still in the left panel, locate and delete the key:
    409 = "Controls safely initializable from persistent data!"
33. Again Still in the left panel, locate and delete the key:
    409 = "Controls safely scriptable!"
34. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Settings.1
35. Still in the left panel, locate and delete the key:
    {Default} = "Settings Class"
36. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Settings.1>CLSID
37. Still in the left panel, locate and delete the key:
    {Default} = "{ID}"
38. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Settings
39. Still in the left panel, locate and delete the key:
    {Default} = "Settings Class"
40. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Settings>CLSID
41. Still in the left panel, locate and delete the key:
    {Default} = "{ID}"
42. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Settings>CurVer
43. Still in the left panel, locate and delete the key:
    {Default} = "CAPICOM.Settings.1"
44. Again Still in the left panel, locate and delete the key:
    {Default} = "Settings Class"
45. Again Still in the left panel, locate and delete the key:
    {Default} = "CAPICOM.Settings.1"
46. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{ID}>VersionIndependentProgID
47. Still in the left panel, locate and delete the key:
    {Default} = "CAPICOM.Settings"
48. Again Still in the left panel, locate and delete the key:
    {Default} = "%System%\capicom.dll"
49. Again Still in the left panel, locate and delete the key:
    ThreadingModel = "Both"
50. Again Still in the left panel, locate and delete the key:
    {Default} = "{ID}"
51. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Certificate.1
52. Still in the left panel, locate and delete the key:
    {Default} = "Certificate Class"
53. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Certificate.1>CLSID
54. Still in the left panel, locate and delete the key:
    {Default} = "{ID}"
55. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Certificate.2
56. Still in the left panel, locate and delete the key:
    {Default} = "Certificate Class"
57. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Certificate.2>CLSID
58. Still in the left panel, locate and delete the key:
    {Default} = "{ID}"
59. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Certificate.3
60. Still in the left panel, locate and delete the key:
    {Default} = "Certificate Class"
61. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Certificate.3>CLSID
62. Still in the left panel, locate and delete the key:
    {Default} = "{ID}"
63. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Certificate
64. Still in the left panel, locate and delete the key:
    {Default} = "Certificate Class"
65. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Certificate>CLSID
66. Still in the left panel, locate and delete the key:
    {Default} = "{ID}"
67. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Certificate>CurVer
68. Still in the left panel, locate and delete the key:
    {Default} = "CAPICOM.Certificate.3"
69. Again Still in the left panel, locate and delete the key:
    {Default} = "Certificate Class"
70. Again Still in the left panel, locate and delete the key:
    {Default} = "CAPICOM.Certificate.2"
71. Again Still in the left panel, locate and delete the key:
    {Default} = "CAPICOM.Certificate"
72. Again Still in the left panel, locate and delete the key:
    {Default} = "%System%\capicom.dll"
73. Again Still in the left panel, locate and delete the key:
    ThreadingModel = "Both"
74. Again Still in the left panel, locate and delete the key:
    {Default} = "{ID}"
75. Again Still in the left panel, locate and delete the key:
    {Default} = "Certificate Class"
76. Again Still in the left panel, locate and delete the key:
    {Default} = "CAPICOM.Certificate.3"
77. Again Still in the left panel, locate and delete the key:
    {Default} = "CAPICOM.Certificate"
78. Again Still in the left panel, locate and delete the key:
    {Default} = "%System%\capicom.dll"
79. Again Still in the left panel, locate and delete the key:
    ThreadingModel = "Both"
80. Again Still in the left panel, locate and delete the key:
    {Default} = "{ID}"
81. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Certificates.1
82. Still in the left panel, locate and delete the key:
    {Default} = "Certificates Class"
83. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Certificates.1>CLSID
84. Still in the left panel, locate and delete the key:
    {Default} = "{ID}"
85. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Certificates.2
86. Still in the left panel, locate and delete the key:
    {Default} = "Certificates Class"
87. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Certificates.2>CLSID
88. Still in the left panel, locate and delete the key:
    {Default} = "{ID}"
89. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Certificates.3
90. Still in the left panel, locate and delete the key:
    {Default} = "Certificates Class"
91. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Certificates.3>CLSID
92. Still in the left panel, locate and delete the key:
    {Default} = "{ID}"
93. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Certificates.4
94. Still in the left panel, locate and delete the key:
    {Default} = "Certificates Class"
95. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Certificates.4>CLSID
96. Still in the left panel, locate and delete the key:
    {Default} = "{ID}"
97. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Certificates
98. Still in the left panel, locate and delete the key:
    {Default} = "Certificates Class"
99. In the left panel of the Registry Editor window, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Certificates>CLSID
100. Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
101. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Certificates>CurVer
102. Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.Certificates.4"
103. Again Still in the left panel, locate and delete the key:
     {Default} = "Certificates Class"
104. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.Certificates.2"
105. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.Certificates"
106. Again Still in the left panel, locate and delete the key:
     {Default} = "%System%\capicom.dll"
107. Again Still in the left panel, locate and delete the key:
     ThreadingModel = "Both"
108. Again Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
109. Again Still in the left panel, locate and delete the key:
     {Default} = "Certificates Class"
110. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.Certificates.3"
111. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.Certificates"
112. Again Still in the left panel, locate and delete the key:
     {Default} = "%System%\capicom.dll"
113. Again Still in the left panel, locate and delete the key:
     ThreadingModel = "Both"
114. Again Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
115. Again Still in the left panel, locate and delete the key:
     {Default} = "Certificates Class"
116. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.Certificates.4"
117. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.Certificates"
118. Again Still in the left panel, locate and delete the key:
     {Default} = "%System%\capicom.dll"
119. Again Still in the left panel, locate and delete the key:
     ThreadingModel = "Both"
120. Again Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
121. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Store.1
122. Still in the left panel, locate and delete the key:
     {Default} = "Store Class"
123. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Store.1>CLSID
124. Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
125. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Store.2
126. Still in the left panel, locate and delete the key:
     {Default} = "Store Class"
127. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Store.2>CLSID
128. Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
129. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Store.3
130. Still in the left panel, locate and delete the key:
     {Default} = "Store Class"
131. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Store.3>CLSID
132. Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
133. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Store
134. Still in the left panel, locate and delete the key:
     {Default} = "Store Class"
135. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Store>CLSID
136. Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
137. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Store>CurVer
138. Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.Store.3"
139. Again Still in the left panel, locate and delete the key:
     {Default} = "Store Class"
140. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.Store.2"
141. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.Store"
142. Again Still in the left panel, locate and delete the key:
     {Default} = "%System%\capicom.dll"
143. Again Still in the left panel, locate and delete the key:
     ThreadingModel = "Both"
144. Again Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
145. Again Still in the left panel, locate and delete the key:
     {Default} = "Store Class"
146. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.Store.3"
147. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.Store"
148. Again Still in the left panel, locate and delete the key:
     {Default} = "%System%\capicom.dll"
149. Again Still in the left panel, locate and delete the key:
     ThreadingModel = "Both"
150. Again Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
151. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Chain.1
152. Still in the left panel, locate and delete the key:
     {Default} = "Chain Class"
153. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Chain.1>CLSID
154. Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
155. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Chain.2
156. Still in the left panel, locate and delete the key:
     {Default} = "Chain Class"
157. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Chain.2>CLSID
158. Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
159. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Chain.3
160. Still in the left panel, locate and delete the key:
     {Default} = "Chain Class"
161. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Chain.3>CLSID
162. Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
163. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Chain
164. Still in the left panel, locate and delete the key:
     {Default} = "Chain Class"
165. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Chain>CLSID
166. Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
167. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Chain>CurVer
168. Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.Chain.3"
169. Again Still in the left panel, locate and delete the key:
     {Default} = "Chain Class"
170. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.Chain.2"
171. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.Chain"
172. Again Still in the left panel, locate and delete the key:
     {Default} = "%System%\capicom.dll"
173. Again Still in the left panel, locate and delete the key:
     ThreadingModel = "Both"
174. Again Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
175. Again Still in the left panel, locate and delete the key:
     {Default} = "Chain Class"
176. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.Chain.3"
177. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.Chain"
178. Again Still in the left panel, locate and delete the key:
     {Default} = "%System%\capicom.dll"
179. Again Still in the left panel, locate and delete the key:
     ThreadingModel = "Both"
180. Again Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
181. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Attribute.1
182. Still in the left panel, locate and delete the key:
     {Default} = "Attribute Class"
183. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Attribute.1>CLSID
184. Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
185. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Attribute
186. Still in the left panel, locate and delete the key:
     {Default} = "Attribute Class"
187. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Attribute>CLSID
188. Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
189. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Attribute>CurVer
190. Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.Attribute.1"
191. Again Still in the left panel, locate and delete the key:
     {Default} = "Attribute Class"
192. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.Attribute.1"
193. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.Attribute"
194. Again Still in the left panel, locate and delete the key:
     {Default} = "%System%\capicom.dll"
195. Again Still in the left panel, locate and delete the key:
     ThreadingModel = "Both"
196. Again Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
197. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Signer.1
198. Still in the left panel, locate and delete the key:
     {Default} = "Signer Class"
199. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Signer.1>CLSID
200. Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
201. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Signer.2
202. Still in the left panel, locate and delete the key:
     {Default} = "Signer Class"
203. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Signer.2>CLSID
204. Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
205. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Signer
206. Still in the left panel, locate and delete the key:
     {Default} = "Signer Class"
207. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Signer>CLSID
208. Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
209. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Signer>CurVer
210. Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.Signer.2"
211. Again Still in the left panel, locate and delete the key:
     {Default} = "Signer Class"
212. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.Signer.2"
213. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.Signer"
214. Again Still in the left panel, locate and delete the key:
     {Default} = "%System%\capicom.dll"
215. Again Still in the left panel, locate and delete the key:
     ThreadingModel = "Both"
216. Again Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
217. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.SignedData.1
218. Still in the left panel, locate and delete the key:
     {Default} = "SignedData Class"
219. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.SignedData.1>CLSID
220. Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
221. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.SignedData
222. Still in the left panel, locate and delete the key:
     {Default} = "SignedData Class"
223. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.SignedData>CLSID
224. Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
225. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.SignedData>CurVer
226. Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.SignedData.1"
227. Again Still in the left panel, locate and delete the key:
     {Default} = "SignedData Class"
228. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.SignedData.1"
229. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.SignedData"
230. Again Still in the left panel, locate and delete the key:
     {Default} = "%System%\capicom.dll"
231. Again Still in the left panel, locate and delete the key:
     ThreadingModel = "Both"
232. Again Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
233. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.EnvelopedData.1
234. Still in the left panel, locate and delete the key:
     {Default} = "EnvelopedData Class"
235. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.EnvelopedData.1>CLSID
236. Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
237. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.EnvelopedData
238. Still in the left panel, locate and delete the key:
     {Default} = "EnvelopedData Class"
239. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.EnvelopedData>CLSID
240. Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
241. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.EnvelopedData>CurVer
242. Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.EnvelopedData.1"
243. Again Still in the left panel, locate and delete the key:
     {Default} = "EnvelopedData Class"
244. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.EnvelopedData.1"
245. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.EnvelopedData"
246. Again Still in the left panel, locate and delete the key:
     {Default} = "%System%\capicom.dll"
247. Again Still in the left panel, locate and delete the key:
     ThreadingModel = "Both"
248. Again Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
249. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.EncryptedData.1
250. Still in the left panel, locate and delete the key:
     {Default} = "EncryptedData Class"
251. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.EncryptedData.1>CLSID
252. Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
253. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.EncryptedData
254. Still in the left panel, locate and delete the key:
     {Default} = "EncryptedData Class"
255. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.EncryptedData>CLSID
256. Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
257. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.EncryptedData>CurVer
258. Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.EncryptedData.1"
259. Again Still in the left panel, locate and delete the key:
     {Default} = "EncryptedData Class"
260. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.EncryptedData.1"
261. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.EncryptedData"
262. Again Still in the left panel, locate and delete the key:
     {Default} = "%System%\capicom.dll"
263. Again Still in the left panel, locate and delete the key:
     ThreadingModel = "Both"
264. Again Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
265. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.OID.1
266. Still in the left panel, locate and delete the key:
     {Default} = "OID Class"
267. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.OID.1>CLSID
268. Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
269. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.OID
270. Still in the left panel, locate and delete the key:
     {Default} = "OID Class"
271. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.OID>CLSID
272. Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
273. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.OID>CurVer
274. Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.OID.1"
275. Again Still in the left panel, locate and delete the key:
     {Default} = "OID Class"
276. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.OID.1"
277. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.OID"
278. Again Still in the left panel, locate and delete the key:
     {Default} = "%System%\capicom.dll"
279. Again Still in the left panel, locate and delete the key:
     ThreadingModel = "Both"
280. Again Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
281. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.PrivateKey.1
282. Still in the left panel, locate and delete the key:
     {Default} = "PrivateKey Class"
283. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.PrivateKey.1>CLSID
284. Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
285. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.PrivateKey
286. Still in the left panel, locate and delete the key:
     {Default} = "PrivateKey Class"
287. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.PrivateKey>CLSID
288. Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
289. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.PrivateKey>CurVer
290. Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.PrivateKey.1"
291. Again Still in the left panel, locate and delete the key:
     {Default} = "PrivateKey Class"
292. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.PrivateKey.1"
293. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.PrivateKey"
294. Again Still in the left panel, locate and delete the key:
     {Default} = "%System%\capicom.dll"
295. Again Still in the left panel, locate and delete the key:
     ThreadingModel = "Both"
296. Again Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
297. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.ExtendedProperty.1
298. Still in the left panel, locate and delete the key:
     {Default} = "ExtendedProperty Class"
299. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.ExtendedProperty.1>CLSID
300. Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
301. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.ExtendedProperty
302. Still in the left panel, locate and delete the key:
     {Default} = "ExtendedProperty Class"
303. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.ExtendedProperty>CLSID
304. Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
305. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.ExtendedProperty>CurVer
306. Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.ExtendedProperty.1"
307. Again Still in the left panel, locate and delete the key:
     {Default} = "ExtendedProperty Class"
308. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.ExtendedProperty.1"
309. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.ExtendedProperty"
310. Again Still in the left panel, locate and delete the key:
     {Default} = "%System%\capicom.dll"
311. Again Still in the left panel, locate and delete the key:
     ThreadingModel = "Both"
312. Again Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
313. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.SignedCode.1
314. Still in the left panel, locate and delete the key:
     {Default} = "SignedCode Class"
315. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.SignedCode.1>CLSID
316. Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
317. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.SignedCode
318. Still in the left panel, locate and delete the key:
     {Default} = "SignedCode Class"
319. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.SignedCode>CLSID
320. Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
321. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.SignedCode>CurVer
322. Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.SignedCode.1"
323. Again Still in the left panel, locate and delete the key:
     {Default} = "SignedCode Class"
324. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.SignedCode.1"
325. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.SignedCode"
326. Again Still in the left panel, locate and delete the key:
     {Default} = "%System%\capicom.dll"
327. Again Still in the left panel, locate and delete the key:
     ThreadingModel = "Both"
328. Again Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
329. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.HashedData.1
330. Still in the left panel, locate and delete the key:
     {Default} = "HashedData Class"
331. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.HashedData.1>CLSID
332. Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
333. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.HashedData
334. Still in the left panel, locate and delete the key:
     {Default} = "HashedData Class"
335. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.HashedData>CLSID
336. Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
337. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.HashedData>CurVer
338. Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.HashedData.1"
339. Again Still in the left panel, locate and delete the key:
     {Default} = "HashedData Class"
340. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.HashedData.1"
341. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.HashedData"
342. Again Still in the left panel, locate and delete the key:
     {Default} = "%System%\capicom.dll"
343. Again Still in the left panel, locate and delete the key:
     ThreadingModel = "Both"
344. Again Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
345. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Utilities.1
346. Still in the left panel, locate and delete the key:
     {Default} = "Utilities Class"
347. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Utilities.1>CLSID
348. Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
349. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Utilities
350. Still in the left panel, locate and delete the key:
     {Default} = "Utilities Class"
351. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Utilities>CLSID
352. Still in the left panel, locate and delete the key:
     {Default} = "{ID}"
353. In the left panel of the Registry Editor window, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CAPICOM.Utilities>CurVer
354. Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.Utilities.1"
355. Again Still in the left panel, locate and delete the key:
     {Default} = "Utilities Class"
356. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.Utilities.1"
357. Again Still in the left panel, locate and delete the key:
     {Default} = "CAPICOM.Utilities"
358. Again Still in the left panel, locate and delete the key:
     {Default} = "%System%\capicom.dll"
359. Again Still in the left panel, locate and delete the key:
     ThreadingModel = "Both"
360. Close Registry Editor.

To manually delete a malware/grayware file from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the File name* input box, type the following:
   
   • %System Root%\configtools.dat
   • %System%\KoalCspWrapper.ocx
   • %System Root%\configtools.log
   • %System%\capicom.dll
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: The file name input box title varies depending on the Windows version (e.g. Search for files or folders named or All or part of the file name.).

• For Windows Vista, Windows 7, Windows Server 2008, Windows 8, Windows 8.1, and Windows Server 2012:

1. Open a Windows Explorer window.
   • For Windows Vista, 7, and Server 2008 users, click Start>Computer.
   • For Windows 8, 8.1, and Server 2012 users, right-click on the lower left corner of the screen, then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %System Root%\configtools.dat
   • %System%\KoalCspWrapper.ocx
   • %System Root%\configtools.log
   • %System%\capicom.dll
3. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.