ADW_CYDOOR.AA

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software
3. Still in the left panel, locate and delete the key:
   IAN
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
5. Still in the left panel, locate and delete the key:
   {7F15AF55-79D9-42FF-96E4-5B83473E9FE4}
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{7F15AF55-79D9-42FF-96E4-5B83473E9FE4}
7. Still in the left panel, locate and delete the key:
   1.0
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{7F15AF55-79D9-42FF-96E4-5B83473E9FE4}>1.0
9. Still in the left panel, locate and delete the key:
   FLAGS
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{7F15AF55-79D9-42FF-96E4-5B83473E9FE4}>1.0>0
11. Still in the left panel, locate and delete the key:
    win32
12. Again Still in the left panel, locate and delete the key:
    HELPDIR
13. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
14. Still in the left panel, locate and delete the key:
    {8DE52C3C-A462-4F2F-B0F6-4CA6A6DE1B2A}
15. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{8DE52C3C-A462-4F2F-B0F6-4CA6A6DE1B2A}
16. Still in the left panel, locate and delete the key:
    ProxyStubClsid
17. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
18. Again Still in the left panel, locate and delete the key:
    TypeLib
19. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID
20. Still in the left panel, locate and delete the key:
    {8D7D7058-AF2C-4123-BCF2-4B346EC6B628}
21. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{8D7D7058-AF2C-4123-BCF2-4B346EC6B628}
22. Still in the left panel, locate and delete the key:
    InprocServer32
23. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT
24. Still in the left panel, locate and delete the key:
    olescope.clsdll
25. Again Still in the left panel, locate and delete the key:
    Proxy.ProxyExt.1
26. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Proxy.ProxyExt.1
27. Still in the left panel, locate and delete the key:
    CLSID
28. Again Still in the left panel, locate and delete the key:
    Proxy.ProxyExt
29. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Proxy.ProxyExt
30. Still in the left panel, locate and delete the key:
    CLSID
31. Again Still in the left panel, locate and delete the key:
    CurVer
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
33. Still in the left panel, locate and delete the key:
    {45A9B2C0-0D04-4AE6-B2F6-544B5C5E1EF3}
34. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{45A9B2C0-0D04-4AE6-B2F6-544B5C5E1EF3}
35. Still in the left panel, locate and delete the key:
    ProgID
36. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
37. Again Still in the left panel, locate and delete the key:
    Programmable
38. Again Still in the left panel, locate and delete the key:
    InprocServer32
39. Again Still in the left panel, locate and delete the key:
    TypeLib
40. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>txtfile
41. Still in the left panel, locate and delete the key:
    ShellEx
42. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>txtfile>ShellEx
43. Still in the left panel, locate and delete the key:
    ContextMenuHandlers
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>txtfile>ShellEx>ContextMenuHandlers
45. Still in the left panel, locate and delete the key:
    ProxyExt
46. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>ShellIconOverlayIdentifiers
47. Still in the left panel, locate and delete the key:
    JARFile
48. Again Still in the left panel, locate and delete the key:
    {72BA6BE1-A20E-4E9E-9305-D9FC1561F888}
49. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{72BA6BE1-A20E-4E9E-9305-D9FC1561F888}
50. Still in the left panel, locate and delete the key:
    1.0
51. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{72BA6BE1-A20E-4E9E-9305-D9FC1561F888}>1.0
52. Still in the left panel, locate and delete the key:
    FLAGS
53. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{72BA6BE1-A20E-4E9E-9305-D9FC1561F888}>1.0>0
54. Still in the left panel, locate and delete the key:
    win32
55. Again Still in the left panel, locate and delete the key:
    HELPDIR
56. Again Still in the left panel, locate and delete the key:
    {89C49C15-72D0-4949-9355-9CD109A2DC2C}
57. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{89C49C15-72D0-4949-9355-9CD109A2DC2C}
58. Still in the left panel, locate and delete the key:
    ProxyStubClsid
59. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
60. Again Still in the left panel, locate and delete the key:
    TypeLib
61. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>DDR
62. Still in the left panel, locate and delete the key:
    InstallPath
63. Again Still in the left panel, locate and delete the key:
    SkinIni
64. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>App Paths
65. Still in the left panel, locate and delete the key:
    DDR
66. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Uninstall
67. Still in the left panel, locate and delete the key:
    DivX DVD Ripper
68. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>IAN
3. In the right panel, locate and delete the entry:
   AffID = "1008"
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{8DE52C3C-A462-4F2F-B0F6-4CA6A6DE1B2A}>TypeLib
5. In the right panel, locate and delete the entry:
   Version = "1.0"
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{8D7D7058-AF2C-4123-BCF2-4B346EC6B628}
7. In the right panel, locate and delete the entry:
   ProgID = "olescope.clsdll"
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{8D7D7058-AF2C-4123-BCF2-4B346EC6B628}>InprocServer32
9. In the right panel, locate and delete the entry:
   ThreadingModel = "Apartment"
10. Again In the right panel, locate and delete the entry:
    TypeLib = "{7F15AF55-79D9-42FF-96E4-5B83473E9FE4}"
11. Again In the right panel, locate and delete the entry:
    VERSION = "1.0"
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>olescope.clsdll
13. In the right panel, locate and delete the entry:
    Clsid = "{8D7D7058-AF2C-4123-BCF2-4B346EC6B628}"
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{8DE52C3C-A462-4F2F-B0F6-4CA6A6DE1B2A}
15. In the right panel, locate and delete the entry:
    ProxyStubClsid = "{00020424-0000-0000-C000-000000000046}"
16. Again In the right panel, locate and delete the entry:
    ProxyStubClsid32 = "{00020424-0000-0000-C000-000000000046}"
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Shell Extensions>Approved
18. In the right panel, locate and delete the entry:
    {45A9B2C0-0D04-4AE6-B2F6-544B5C5E1EF3} = "ProxyExtExt Extension"
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{45A9B2C0-0D04-4AE6-B2F6-544B5C5E1EF3}>InprocServer32
20. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
21. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{89C49C15-72D0-4949-9355-9CD109A2DC2C}>TypeLib
22. In the right panel, locate and delete the entry:
    Version = "1.0"
23. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>DivX DVD Ripper
24. In the right panel, locate and delete the entry:
    DisplayName = "DivX DVD Ripper 1.7"
25. Again In the right panel, locate and delete the entry:
    UninstallString = "%Program Files%\DDR\uninst.exe"
26. Again In the right panel, locate and delete the entry:
    DisplayIcon = "%Program Files%\DDR\ddr.exe,0"
27. Again In the right panel, locate and delete the entry:
    DisplayVersion = "1.7"
28. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Ole
29. In the right panel, locate and delete the entry:
    PackageStore = "1374137496"
30. Again In the right panel, locate and delete the entry:
    Clsid = "{4C235856-77D9-4AD6-8617-D9BC426EE188}"
31. Again In the right panel, locate and delete the entry:
    ProtocolId = "0"
32. Again In the right panel, locate and delete the entry:
    StringCollection = "0"
33. Again In the right panel, locate and delete the entry:
    DataCollection = "0"
34. Again In the right panel, locate and delete the entry:
    IncludeWindowsApps = "4"
35. Again In the right panel, locate and delete the entry:
    IncludeMicrosoftApps = "0"
36. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %User Temp%\nsl3.tmp
   • %User Temp%\nsa5.tmp\nsis.ini
   • %User Temp%\nsa5.tmp\nsis.bmp
   • %User Temp%\nsa5.tmp\UserInfo.dll
   • %User Temp%\nsa5.tmp\ioSpecial.ini
   • %User Temp%\nsa5.tmp\modern-wizard.bmp
   • %User Temp%\nsa5.tmp\modern-header.bmp
   • %User Temp%\nsa5.tmp\InstallOptions.dll
   • %System%\wmproxt.dll
   • %System%\olescope.dll
   • %Program Files%\DDR\ddr.exe
   • %Program Files%\DDR\nLame.dll
   • %Program Files%\DDR\auth.dll
   • %Program Files%\DDR\readme_1st.txt
   • %Program Files%\DDR\lang\Polski.txt
   • %Program Files%\DDR\lang\lang_chs.txt
   • %Program Files%\DDR\lang\lang_denmark.txt
   • %Program Files%\DDR\lang\lang_dutch.txt
   • %Program Files%\DDR\lang\lang_eng.txt
   • %Program Files%\DDR\lang\lang_francais.txt
   • %Program Files%\DDR\lang\lang_german.txt
   • %Program Files%\DDR\lang\lang_hungarian.txt
   • %Program Files%\DDR\lang\lang_italian.txt
   • %Program Files%\DDR\lang\lang_jp.txt
   • %Program Files%\DDR\lang\lang_norway.txt
   • %Program Files%\DDR\lang\lang_spanish.txt
   • %Start Menu%\Programs\DDR\DDR.lnk
   • %Desktop%\DDR.lnk
   • %Start Menu%\Programs\DDR\Uninstall.lnk
   • %Program Files%\DDR\uninst.exe
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %User Temp%\nsl3.tmp
   • %User Temp%\nsa5.tmp\nsis.ini
   • %User Temp%\nsa5.tmp\nsis.bmp
   • %User Temp%\nsa5.tmp\UserInfo.dll
   • %User Temp%\nsa5.tmp\ioSpecial.ini
   • %User Temp%\nsa5.tmp\modern-wizard.bmp
   • %User Temp%\nsa5.tmp\modern-header.bmp
   • %User Temp%\nsa5.tmp\InstallOptions.dll
   • %System%\wmproxt.dll
   • %System%\olescope.dll
   • %Program Files%\DDR\ddr.exe
   • %Program Files%\DDR\nLame.dll
   • %Program Files%\DDR\auth.dll
   • %Program Files%\DDR\readme_1st.txt
   • %Program Files%\DDR\lang\Polski.txt
   • %Program Files%\DDR\lang\lang_chs.txt
   • %Program Files%\DDR\lang\lang_denmark.txt
   • %Program Files%\DDR\lang\lang_dutch.txt
   • %Program Files%\DDR\lang\lang_eng.txt
   • %Program Files%\DDR\lang\lang_francais.txt
   • %Program Files%\DDR\lang\lang_german.txt
   • %Program Files%\DDR\lang\lang_hungarian.txt
   • %Program Files%\DDR\lang\lang_italian.txt
   • %Program Files%\DDR\lang\lang_jp.txt
   • %Program Files%\DDR\lang\lang_norway.txt
   • %Program Files%\DDR\lang\lang_spanish.txt
   • %Start Menu%\Programs\DDR\DDR.lnk
   • %Desktop%\DDR.lnk
   • %Start Menu%\Programs\DDR\Uninstall.lnk
   • %Program Files%\DDR\uninst.exe
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\Wilbert
   • %User Profile%\LOCALS~1
   • %User Temp%\nsa5.tmp
   • %Program Files%\DDR
   • %Program Files%\DDR\lang
   • %System Root%\Documents and Settings\Wilbert
   • %Start Menu%\Programs\DDR
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\Wilbert
   • %User Profile%\LOCALS~1
   • %User Temp%\nsa5.tmp
   • %Program Files%\DDR
   • %Program Files%\DDR\lang
   • %System Root%\Documents and Settings\Wilbert
   • %Start Menu%\Programs\DDR