TROJ_AGENT.AUTN

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer
3. Still in the left panel, locate and delete the key:
   Browser Helper Objects
4. In the left panel, double-click the following:
   HKEY_CLASSES_ROOT
5. Still in the left panel, locate and delete the key:
   MSApp.BhoApp.1
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>MSApp.BhoApp.1
7. Still in the left panel, locate and delete the key:
   CLSID
8. Again Still in the left panel, locate and delete the key:
   MSApp.BhoApp
9. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>MSApp.BhoApp
10. Still in the left panel, locate and delete the key:
    CLSID
11. Again Still in the left panel, locate and delete the key:
    CurVer
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
13. Still in the left panel, locate and delete the key:
    {161B953B-95F9-4af3-B071-D5FF5EA132EF}
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{161B953B-95F9-4af3-B071-D5FF5EA132EF}
15. Still in the left panel, locate and delete the key:
    ProgID
16. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
17. Again Still in the left panel, locate and delete the key:
    Programmable
18. Again Still in the left panel, locate and delete the key:
    InprocServer32
19. Again Still in the left panel, locate and delete the key:
    TypeLib
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
21. Still in the left panel, locate and delete the key:
    {2D51E439-3AE8-4BF7-8FB2-45F768554DEC}
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{2D51E439-3AE8-4BF7-8FB2-45F768554DEC}
23. Still in the left panel, locate and delete the key:
    1.0
24. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{2D51E439-3AE8-4BF7-8FB2-45F768554DEC}>1.0
25. Still in the left panel, locate and delete the key:
    FLAGS
26. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{2D51E439-3AE8-4BF7-8FB2-45F768554DEC}>1.0>0
27. Still in the left panel, locate and delete the key:
    win32
28. Again Still in the left panel, locate and delete the key:
    HELPDIR
29. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
30. Still in the left panel, locate and delete the key:
    {ECEE577A-5B6F-4BDC-9210-DB603D6BEF78}
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{ECEE577A-5B6F-4BDC-9210-DB603D6BEF78}
32. Still in the left panel, locate and delete the key:
    ProxyStubClsid
33. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
34. Again Still in the left panel, locate and delete the key:
    TypeLib
35. Again Still in the left panel, locate and delete the key:
    {30989926-2D37-4561-B76F-65D0F89A3560}
36. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{30989926-2D37-4561-B76F-65D0F89A3560}
37. Still in the left panel, locate and delete the key:
    ProxyStubClsid
38. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
39. Again Still in the left panel, locate and delete the key:
    TypeLib
40. Again Still in the left panel, locate and delete the key:
    Mdd.MddApp.1
41. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Mdd.MddApp.1
42. Still in the left panel, locate and delete the key:
    CLSID
43. Again Still in the left panel, locate and delete the key:
    Mmdd.MddApp
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Mmdd.MddApp
45. Still in the left panel, locate and delete the key:
    CLSID
46. Again Still in the left panel, locate and delete the key:
    CurVer
47. Again Still in the left panel, locate and delete the key:
    {1A4F919F-4334-4abf-BF47-0836A8B5A54B}
48. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{1A4F919F-4334-4abf-BF47-0836A8B5A54B}
49. Still in the left panel, locate and delete the key:
    ProgID
50. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
51. Again Still in the left panel, locate and delete the key:
    Programmable
52. Again Still in the left panel, locate and delete the key:
    InprocServer32
53. Again Still in the left panel, locate and delete the key:
    TypeLib
54. Again Still in the left panel, locate and delete the key:
    {F6FBADC6-F435-4B4B-9153-8DFF61BCF996}
55. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{F6FBADC6-F435-4B4B-9153-8DFF61BCF996}
56. Still in the left panel, locate and delete the key:
    1.0
57. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{F6FBADC6-F435-4B4B-9153-8DFF61BCF996}>1.0
58. Still in the left panel, locate and delete the key:
    FLAGS
59. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{F6FBADC6-F435-4B4B-9153-8DFF61BCF996}>1.0>0
60. Still in the left panel, locate and delete the key:
    win32
61. Again Still in the left panel, locate and delete the key:
    HELPDIR
62. Again Still in the left panel, locate and delete the key:
    {244F3263-6C3C-469C-AECE-FF46D84A0A3B}
63. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{244F3263-6C3C-469C-AECE-FF46D84A0A3B}
64. Still in the left panel, locate and delete the key:
    ProxyStubClsid
65. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
66. Again Still in the left panel, locate and delete the key:
    TypeLib
67. Again Still in the left panel, locate and delete the key:
    {572AB3DC-60AC-4FCB-B0F6-8B010ECFE90A}
68. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{572AB3DC-60AC-4FCB-B0F6-8B010ECFE90A}
69. Still in the left panel, locate and delete the key:
    ProxyStubClsid
70. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
71. Again Still in the left panel, locate and delete the key:
    TypeLib
72. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{161B953B-95F9-4af3-B071-D5FF5EA132EF}>InprocServer32
3. In the right panel, locate and delete the entry:
   ThreadingModel = "Apartment"
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{ECEE577A-5B6F-4BDC-9210-DB603D6BEF78}>TypeLib
5. In the right panel, locate and delete the entry:
   Version = "1.0"
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{30989926-2D37-4561-B76F-65D0F89A3560}>TypeLib
7. In the right panel, locate and delete the entry:
   Version = "1.0"
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{1A4F919F-4334-4abf-BF47-0836A8B5A54B}>InprocServer32
9. In the right panel, locate and delete the entry:
   ThreadingModel = "Apartment"
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{244F3263-6C3C-469C-AECE-FF46D84A0A3B}>TypeLib
11. In the right panel, locate and delete the entry:
    Version = "1.0"
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{572AB3DC-60AC-4FCB-B0F6-8B010ECFE90A}>TypeLib
13. In the right panel, locate and delete the entry:
    Version = "1.0"
14. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %System%\hl.dat
   • %System%\scerpt.dll
   • %System%\mshpc.dll
   • %System%\mp7arc.dat
   • %System%\mrcmgr.exe
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %System%\hl.dat
   • %System%\scerpt.dll
   • %System%\mshpc.dll
   • %System%\mp7arc.dat
   • %System%\mrcmgr.exe
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.