ADW_LOADER

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Uninstall
3. Still in the left panel, locate and delete the key:
   Speed Test 127
4. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer
5. Still in the left panel, locate and delete the key:
   MINIE
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Low Rights>ElevationPolicy
7. Still in the left panel, locate and delete the key:
   {1FB3A6BD-4706-4ef4-8B61-3C7438289236}
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Main>FeatureControl
9. Still in the left panel, locate and delete the key:
   FEATURE_BROWSER_EMULATION
10. Again Still in the left panel, locate and delete the key:
    FEATURE_WEBOC_MOVESIZECHILD
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID
12. Still in the left panel, locate and delete the key:
    {18B9B16E-716F-43DF-A6AD-512C7D2EB983}
13. Again Still in the left panel, locate and delete the key:
    BackgroundHost.EXE
14. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT
15. Still in the left panel, locate and delete the key:
    Speed Test 127.BackgroundHostObject.1
16. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Speed Test 127.BackgroundHostObject.1
17. Still in the left panel, locate and delete the key:
    CLSID
18. Again Still in the left panel, locate and delete the key:
    Speed Test 127.BackgroundHostObject
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Speed Test 127.BackgroundHostObject
20. Still in the left panel, locate and delete the key:
    CLSID
21. Again Still in the left panel, locate and delete the key:
    CurVer
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
23. Still in the left panel, locate and delete the key:
    {75CC1BBE-D96F-45DF-A622-D60BFA8AF49E}
24. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{75CC1BBE-D96F-45DF-A622-D60BFA8AF49E}
25. Still in the left panel, locate and delete the key:
    ProgID
26. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
27. Again Still in the left panel, locate and delete the key:
    Programmable
28. Again Still in the left panel, locate and delete the key:
    LocalServer32
29. Again Still in the left panel, locate and delete the key:
    TypeLib
30. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
31. Still in the left panel, locate and delete the key:
    {B69509B5-4A90-4433-A2DE-BE439F6581F2}
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{B69509B5-4A90-4433-A2DE-BE439F6581F2}
33. Still in the left panel, locate and delete the key:
    1.0
34. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{B69509B5-4A90-4433-A2DE-BE439F6581F2}>1.0
35. Still in the left panel, locate and delete the key:
    FLAGS
36. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{B69509B5-4A90-4433-A2DE-BE439F6581F2}>1.0>0
37. Still in the left panel, locate and delete the key:
    win32
38. Again Still in the left panel, locate and delete the key:
    HELPDIR
39. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
40. Still in the left panel, locate and delete the key:
    {43969E3F-3E7C-4911-A8F1-79C6CA6AC731}
41. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{43969E3F-3E7C-4911-A8F1-79C6CA6AC731}
42. Still in the left panel, locate and delete the key:
    ProxyStubClsid
43. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
44. Again Still in the left panel, locate and delete the key:
    TypeLib
45. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software
46. Still in the left panel, locate and delete the key:
    Speed Test 127
47. Again Still in the left panel, locate and delete the key:
    {562B9316-C08A-444A-9482-62080DD851AE}
48. Again Still in the left panel, locate and delete the key:
    ScriptHost.DLL
49. Again Still in the left panel, locate and delete the key:
    Speed Test 127.ScriptHostObject.1
50. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Speed Test 127.ScriptHostObject.1
51. Still in the left panel, locate and delete the key:
    CLSID
52. Again Still in the left panel, locate and delete the key:
    Speed Test 127.ScriptHostObject
53. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Speed Test 127.ScriptHostObject
54. Still in the left panel, locate and delete the key:
    CLSID
55. Again Still in the left panel, locate and delete the key:
    CurVer
56. Again Still in the left panel, locate and delete the key:
    {11C8C9C0-D918-44C0-8B5E-D297DA42F2C7}
57. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{11C8C9C0-D918-44C0-8B5E-D297DA42F2C7}
58. Still in the left panel, locate and delete the key:
    ProgID
59. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
60. Again Still in the left panel, locate and delete the key:
    Programmable
61. Again Still in the left panel, locate and delete the key:
    InprocServer32
62. Again Still in the left panel, locate and delete the key:
    TypeLib
63. Again Still in the left panel, locate and delete the key:
    Speed Test 127.Tool.1
64. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Speed Test 127.Tool.1
65. Still in the left panel, locate and delete the key:
    CLSID
66. Again Still in the left panel, locate and delete the key:
    Speed Test 127.Tool
67. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Speed Test 127.Tool
68. Still in the left panel, locate and delete the key:
    CLSID
69. Again Still in the left panel, locate and delete the key:
    CurVer
70. Again Still in the left panel, locate and delete the key:
    {FB61B649-3FC8-4754-89A2-501456130AB5}
71. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{FB61B649-3FC8-4754-89A2-501456130AB5}
72. Still in the left panel, locate and delete the key:
    ProgID
73. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
74. Again Still in the left panel, locate and delete the key:
    Programmable
75. Again Still in the left panel, locate and delete the key:
    InprocServer32
76. Again Still in the left panel, locate and delete the key:
    TypeLib
77. Again Still in the left panel, locate and delete the key:
    {F2F1AE7C-149B-46D3-9498-12572C7AFE11}
78. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{F2F1AE7C-149B-46D3-9498-12572C7AFE11}
79. Still in the left panel, locate and delete the key:
    1.0
80. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{F2F1AE7C-149B-46D3-9498-12572C7AFE11}>1.0
81. Still in the left panel, locate and delete the key:
    FLAGS
82. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{F2F1AE7C-149B-46D3-9498-12572C7AFE11}>1.0>0
83. Still in the left panel, locate and delete the key:
    win32
84. Again Still in the left panel, locate and delete the key:
    HELPDIR
85. Again Still in the left panel, locate and delete the key:
    {1348BD1B-C32A-41A7-9BD4-5377AA1AB925}
86. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{1348BD1B-C32A-41A7-9BD4-5377AA1AB925}
87. Still in the left panel, locate and delete the key:
    ProxyStubClsid
88. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
89. Again Still in the left panel, locate and delete the key:
    TypeLib
90. Again Still in the left panel, locate and delete the key:
    Speed Test 127.Navbar.1
91. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Speed Test 127.Navbar.1
92. Still in the left panel, locate and delete the key:
    CLSID
93. Again Still in the left panel, locate and delete the key:
    Speed Test 127.Navbar
94. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Speed Test 127.Navbar
95. Still in the left panel, locate and delete the key:
    CLSID
96. Again Still in the left panel, locate and delete the key:
    CurVer
97. Again Still in the left panel, locate and delete the key:
    {E09EF104-3849-47F4-B005-A120558F3FEF}
98. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{E09EF104-3849-47F4-B005-A120558F3FEF}
99. Still in the left panel, locate and delete the key:
    ProgID
100. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
101. Again Still in the left panel, locate and delete the key:
     Programmable
102. Again Still in the left panel, locate and delete the key:
     InprocServer32
103. Again Still in the left panel, locate and delete the key:
     TypeLib
104. Again Still in the left panel, locate and delete the key:
     {562B9317-C08A-444A-9482-62080DD851AE}
105. Again Still in the left panel, locate and delete the key:
     ButtonSite.DLL
106. Again Still in the left panel, locate and delete the key:
     {53FDCCB0-2404-4274-9002-5A3A1FD40426}
107. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{53FDCCB0-2404-4274-9002-5A3A1FD40426}
108. Still in the left panel, locate and delete the key:
     1.0
109. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{53FDCCB0-2404-4274-9002-5A3A1FD40426}>1.0
110. Still in the left panel, locate and delete the key:
     FLAGS
111. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{53FDCCB0-2404-4274-9002-5A3A1FD40426}>1.0>0
112. Still in the left panel, locate and delete the key:
     win32
113. Again Still in the left panel, locate and delete the key:
     HELPDIR
114. Again Still in the left panel, locate and delete the key:
     {19975B78-1907-4DD6-A437-4C48120F46A4}
115. Again Still in the left panel, locate and delete the key:
     AddonsFramework.DLL
116. Again Still in the left panel, locate and delete the key:
     {3013E03D-89D5-4580-8560-DB198297CC29}
117. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{3013E03D-89D5-4580-8560-DB198297CC29}
118. Still in the left panel, locate and delete the key:
     1.0
119. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{3013E03D-89D5-4580-8560-DB198297CC29}>1.0
120. Still in the left panel, locate and delete the key:
     FLAGS
121. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{3013E03D-89D5-4580-8560-DB198297CC29}>1.0>0
122. Still in the left panel, locate and delete the key:
     win32
123. Again Still in the left panel, locate and delete the key:
     HELPDIR
124. Again Still in the left panel, locate and delete the key:
     {94CADA2E-1D3F-419F-8A3D-06C58EDF53C8}
125. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{94CADA2E-1D3F-419F-8A3D-06C58EDF53C8}
126. Still in the left panel, locate and delete the key:
     ProxyStubClsid
127. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
128. Again Still in the left panel, locate and delete the key:
     TypeLib
129. Again Still in the left panel, locate and delete the key:
     {C1995F88-1C7F-40D7-B0FA-6F107F6308B8}
130. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C1995F88-1C7F-40D7-B0FA-6F107F6308B8}
131. Still in the left panel, locate and delete the key:
     ProxyStubClsid
132. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
133. Again Still in the left panel, locate and delete the key:
     TypeLib
134. Again Still in the left panel, locate and delete the key:
     {9E52EB8B-8DD9-4605-AD36-D352BCD482F2}
135. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{9E52EB8B-8DD9-4605-AD36-D352BCD482F2}
136. Still in the left panel, locate and delete the key:
     ProxyStubClsid
137. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
138. Again Still in the left panel, locate and delete the key:
     TypeLib
139. Again Still in the left panel, locate and delete the key:
     {A1440EC3-F0FA-407A-B811-DE6668C06D29}
140. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A1440EC3-F0FA-407A-B811-DE6668C06D29}
141. Still in the left panel, locate and delete the key:
     ProxyStubClsid
142. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
143. Again Still in the left panel, locate and delete the key:
     TypeLib
144. Again Still in the left panel, locate and delete the key:
     {B9A84AD0-5777-46FD-8B8F-1EBD06750FBC}
145. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B9A84AD0-5777-46FD-8B8F-1EBD06750FBC}
146. Still in the left panel, locate and delete the key:
     ProxyStubClsid
147. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
148. Again Still in the left panel, locate and delete the key:
     TypeLib
149. Again Still in the left panel, locate and delete the key:
     {395AFE6E-8308-48DB-89BE-ED5F4AA3D3EC}
150. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{395AFE6E-8308-48DB-89BE-ED5F4AA3D3EC}
151. Still in the left panel, locate and delete the key:
     ProxyStubClsid
152. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
153. Again Still in the left panel, locate and delete the key:
     TypeLib
154. Again Still in the left panel, locate and delete the key:
     {045F91B3-695F-423A-98C7-8DE3C47AA020}
155. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{045F91B3-695F-423A-98C7-8DE3C47AA020}
156. Still in the left panel, locate and delete the key:
     ProxyStubClsid
157. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
158. Again Still in the left panel, locate and delete the key:
     TypeLib
159. Again Still in the left panel, locate and delete the key:
     {BBBE01ED-0F1E-44DB-88C1-5CC1AEE3B462}
160. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BBBE01ED-0F1E-44DB-88C1-5CC1AEE3B462}
161. Still in the left panel, locate and delete the key:
     ProxyStubClsid
162. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
163. Again Still in the left panel, locate and delete the key:
     TypeLib
164. Again Still in the left panel, locate and delete the key:
     {F9EB11AB-9384-4736-9B33-993940F88895}
165. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{F9EB11AB-9384-4736-9B33-993940F88895}
166. Still in the left panel, locate and delete the key:
     ProxyStubClsid
167. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
168. Again Still in the left panel, locate and delete the key:
     TypeLib
169. Again Still in the left panel, locate and delete the key:
     {43B390F0-6BA2-45CA-ABF2-5DB0CEE9B49D}
170. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{43B390F0-6BA2-45CA-ABF2-5DB0CEE9B49D}
171. Still in the left panel, locate and delete the key:
     ProxyStubClsid
172. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
173. Again Still in the left panel, locate and delete the key:
     TypeLib
174. Again Still in the left panel, locate and delete the key:
     {E4A994B0-5550-4680-A4C6-B9470B888069}
175. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{E4A994B0-5550-4680-A4C6-B9470B888069}
176. Still in the left panel, locate and delete the key:
     ProxyStubClsid
177. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
178. Again Still in the left panel, locate and delete the key:
     TypeLib
179. Again Still in the left panel, locate and delete the key:
     {EE95078D-518C-4FD2-8093-FD1D4E33D3CA}
180. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{EE95078D-518C-4FD2-8093-FD1D4E33D3CA}
181. Still in the left panel, locate and delete the key:
     ProxyStubClsid
182. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
183. Again Still in the left panel, locate and delete the key:
     TypeLib
184. Again Still in the left panel, locate and delete the key:
     {C815E3DA-0823-49B0-9270-D1771D58B317}
185. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C815E3DA-0823-49B0-9270-D1771D58B317}
186. Still in the left panel, locate and delete the key:
     ProxyStubClsid
187. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
188. Again Still in the left panel, locate and delete the key:
     TypeLib
189. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Ext>Settings
190. Still in the left panel, locate and delete the key:
     {11C8C9C0-D918-44C0-8B5E-D297DA42F2C7}
191. Again Still in the left panel, locate and delete the key:
     Approved Extensions
192. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Internet Settings
3. In the right panel, locate and delete the entry:
   CertificateRevocation = "0"
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>Speed Test 127
5. In the right panel, locate and delete the entry:
   UninstallString = "%Program Files%\Speed Test 127\uninst.exe"
6. Again In the right panel, locate and delete the entry:
   Publisher = "Speed Analysis"
7. Again In the right panel, locate and delete the entry:
   DisplayName = "Speed Test 127"
8. Again In the right panel, locate and delete the entry:
   UninstallString = "%Program Files%\Speed Test 127\uninstall.exe"
9. Again In the right panel, locate and delete the entry:
   DisplayVersion = "3.0.0.0"
10. Again In the right panel, locate and delete the entry:
    Publisher = "BestOffers"
11. Again In the right panel, locate and delete the entry:
    URLInfoAbout = "http://www.{BLOCKED}fersapp.com"
12. Again In the right panel, locate and delete the entry:
    DisplayIcon = "%Program Files%\Speed Test 127\uninstall.exe"
13. Again In the right panel, locate and delete the entry:
    InstDir = "%Program Files%\Speed Test 127"
14. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>MINIE
15. In the right panel, locate and delete the entry:
    CommandBarEnabled = "1"
16. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Speed Test 127
17. In the right panel, locate and delete the entry:
    elevationPolicyGuid = "{1FB3A6BD-4706-4ef4-8B61-3C7438289236}"
18. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Low Rights>ElevationPolicy>{1FB3A6BD-4706-4ef4-8B61-3C7438289236}
19. In the right panel, locate and delete the entry:
    Policy = "3"
20. Again In the right panel, locate and delete the entry:
    AppPath = "%Program Files%\Speed Test 127"
21. Again In the right panel, locate and delete the entry:
    AppName = "BackgroundHost.exe"
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Main>FeatureControl>FEATURE_WEBOC_MOVESIZECHILD
23. In the right panel, locate and delete the entry:
    BackgroundHost.exe = "1"
24. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>BackgroundHost.EXE
25. In the right panel, locate and delete the entry:
    AppID = "{18B9B16E-716F-43DF-A6AD-512C7D2EB983}"
26. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{43969E3F-3E7C-4911-A8F1-79C6CA6AC731}>TypeLib
27. In the right panel, locate and delete the entry:
    Version = "1.0"
28. Again In the right panel, locate and delete the entry:
    installId = "F34C6DEB-6B8F-461f-A05D-CE185AF64B89"
29. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>ScriptHost.DLL
30. In the right panel, locate and delete the entry:
    AppID = "{562B9316-C08A-444A-9482-62080DD851AE}"
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Browser Helper Objects>{11C8C9C0-D918-44C0-8B5E-D297DA42F2C7}
32. In the right panel, locate and delete the entry:
    NoExplorer = "1"
33. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{11C8C9C0-D918-44C0-8B5E-D297DA42F2C7}>InprocServer32
34. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
35. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{FB61B649-3FC8-4754-89A2-501456130AB5}>InprocServer32
36. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
37. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{1348BD1B-C32A-41A7-9BD4-5377AA1AB925}>TypeLib
38. In the right panel, locate and delete the entry:
    Version = "1.0"
39. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{E09EF104-3849-47F4-B005-A120558F3FEF}>InprocServer32
40. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
41. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>ButtonSite.DLL
42. In the right panel, locate and delete the entry:
    AppID = "{562B9317-C08A-444A-9482-62080DD851AE}"
43. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>AddonsFramework.DLL
44. In the right panel, locate and delete the entry:
    AppID = "{19975B78-1907-4DD6-A437-4C48120F46A4}"
45. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{94CADA2E-1D3F-419F-8A3D-06C58EDF53C8}>TypeLib
46. In the right panel, locate and delete the entry:
    Version = "1.0"
47. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C1995F88-1C7F-40D7-B0FA-6F107F6308B8}>TypeLib
48. In the right panel, locate and delete the entry:
    Version = "1.0"
49. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{9E52EB8B-8DD9-4605-AD36-D352BCD482F2}>TypeLib
50. In the right panel, locate and delete the entry:
    Version = "1.0"
51. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A1440EC3-F0FA-407A-B811-DE6668C06D29}>TypeLib
52. In the right panel, locate and delete the entry:
    Version = "1.0"
53. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{B9A84AD0-5777-46FD-8B8F-1EBD06750FBC}>TypeLib
54. In the right panel, locate and delete the entry:
    Version = "1.0"
55. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{395AFE6E-8308-48DB-89BE-ED5F4AA3D3EC}>TypeLib
56. In the right panel, locate and delete the entry:
    Version = "1.0"
57. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{045F91B3-695F-423A-98C7-8DE3C47AA020}>TypeLib
58. In the right panel, locate and delete the entry:
    Version = "1.0"
59. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BBBE01ED-0F1E-44DB-88C1-5CC1AEE3B462}>TypeLib
60. In the right panel, locate and delete the entry:
    Version = "1.0"
61. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{F9EB11AB-9384-4736-9B33-993940F88895}>TypeLib
62. In the right panel, locate and delete the entry:
    Version = "1.0"
63. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{43B390F0-6BA2-45CA-ABF2-5DB0CEE9B49D}>TypeLib
64. In the right panel, locate and delete the entry:
    Version = "1.0"
65. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{E4A994B0-5550-4680-A4C6-B9470B888069}>TypeLib
66. In the right panel, locate and delete the entry:
    Version = "1.0"
67. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{EE95078D-518C-4FD2-8093-FD1D4E33D3CA}>TypeLib
68. In the right panel, locate and delete the entry:
    Version = "1.0"
69. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C815E3DA-0823-49B0-9270-D1771D58B317}>TypeLib
70. In the right panel, locate and delete the entry:
    Version = "1.0"
71. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Ext>Settings>{11C8C9C0-D918-44C0-8B5E-D297DA42F2C7}
72. In the right panel, locate and delete the entry:
    Flags = "0"
73. Again In the right panel, locate and delete the entry:
    Version = "*"
74. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Approved Extensions
75. In the right panel, locate and delete the entry:
    {11C8C9C0-D918-44C0-8B5E-D297DA42F2C7} = "{random values}"
76. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %Desktop%\Speed Test.lnk
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %Desktop%\Speed Test.lnk
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %Program Files%\Speed Test 127
   • %User Temp%\speedtest127
   • %Application Data%\Mozilla\Firefox\Profiles\{random}.default\extensions\speedtest4354@BestOffers
   • %Application Data%\Mozilla\Firefox\Profiles{random}.default
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %Program Files%\Speed Test 127
   • %User Temp%\speedtest127
   • %Application Data%\Mozilla\Firefox\Profiles\{random}.default\extensions\speedtest4354@BestOffers
   • %Application Data%\Mozilla\Firefox\Profiles{random}.default