ADW_WINUSEC

To delete the registry key this malware/grayware created:

1. Open Registry Editor.
   » For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run, type regedit in the text box provided, and then press Enter.
   » For Windows Vista, Windows 7, and Windows Server 2008 users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, and Windows Server 2012 users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software
3. Still in the left panel, locate and delete the key:
   troll
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Uninstall
5. Still in the left panel, locate and delete the key:
   {ACA88935-7188-47AD-B220-B50106DC0D9C}_is1
6. Again Still in the left panel, locate and delete the key:
   winservice86
7. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>winservice86
8. Still in the left panel, locate and delete the key:
   Installer
9. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software
10. Still in the left panel, locate and delete the key:
    winservice86
11. In the left panel, double-click the following:
    HKEY_USERS>S-1-5-21-1645522239-1292428093-682003330-1003>Software>winservice86
12. Still in the left panel, locate and delete the key:
    Update
13. Again Still in the left panel, locate and delete the key:
    Crossrider
14. In the left panel, double-click the following:
    HKEY_USERS>S-1-5-21-1645522239-1292428093-682003330-1003>Software
15. Still in the left panel, locate and delete the key:
    Crossrider
16. Again Still in the left panel, locate and delete the key:
    Installer
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>winservice86>IE
18. Still in the left panel, locate and delete the key:
    Profiles
19. Again Still in the left panel, locate and delete the key:
    Manifest
20. Again Still in the left panel, locate and delete the key:
    Code
21. In the left panel, double-click the following:
    HKEY_USERS>S-1-5-21-1645522239-1292428093-682003330-1003>Software>winservice86>Plugins
22. Still in the left panel, locate and delete the key:
    78
23. Again Still in the left panel, locate and delete the key:
    44
24. Again Still in the left panel, locate and delete the key:
    46
25. Again Still in the left panel, locate and delete the key:
    41
26. Again Still in the left panel, locate and delete the key:
    36
27. Again Still in the left panel, locate and delete the key:
    40
28. Again Still in the left panel, locate and delete the key:
    43
29. Again Still in the left panel, locate and delete the key:
    37
30. Again Still in the left panel, locate and delete the key:
    14
31. Again Still in the left panel, locate and delete the key:
    314
32. Again Still in the left panel, locate and delete the key:
    38
33. Again Still in the left panel, locate and delete the key:
    13
34. Again Still in the left panel, locate and delete the key:
    35
35. Again Still in the left panel, locate and delete the key:
    244
36. Again Still in the left panel, locate and delete the key:
    17
37. Again Still in the left panel, locate and delete the key:
    221
38. Again Still in the left panel, locate and delete the key:
    262
39. Again Still in the left panel, locate and delete the key:
    220
40. Again Still in the left panel, locate and delete the key:
    230
41. Again Still in the left panel, locate and delete the key:
    289
42. Again Still in the left panel, locate and delete the key:
    195
43. Again Still in the left panel, locate and delete the key:
    273
44. Again Still in the left panel, locate and delete the key:
    263
45. Again Still in the left panel, locate and delete the key:
    7
46. Again Still in the left panel, locate and delete the key:
    91
47. Again Still in the left panel, locate and delete the key:
    193
48. Again Still in the left panel, locate and delete the key:
    180
49. Again Still in the left panel, locate and delete the key:
    246
50. Again Still in the left panel, locate and delete the key:
    128
51. Again Still in the left panel, locate and delete the key:
    269
52. Again Still in the left panel, locate and delete the key:
    47
53. Again Still in the left panel, locate and delete the key:
    184
54. Again Still in the left panel, locate and delete the key:
    102
55. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Microsoft>Internet Explorer>Main>FeatureControl
56. Still in the left panel, locate and delete the key:
    FEATURE_BROWSER_EMULATION
57. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Microsoft>Internet Explorer>Low Rights>ElevationPolicy
58. Still in the left panel, locate and delete the key:
    {2b9db7a6-ace4-4c99-83b3-b35a02e5970d}
59. In the left panel, double-click the following:
    HKEY_USERS>S-1-5-21-1645522239-1292428093-682003330-1003>Software>Microsoft>Internet Explorer>Low Rights>ElevationPolicy
60. Still in the left panel, locate and delete the key:
    {2b9db7a6-ace4-4c99-83b3-b35a02e5970d}
61. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT
62. Still in the left panel, locate and delete the key:
    583e31c01eeb0132f0d1712b8d7ccf2e0064755.Sandbox.1
63. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>583e31c01eeb0132f0d1712b8d7ccf2e0064755.Sandbox.1
64. Still in the left panel, locate and delete the key:
    CLSID
65. Again Still in the left panel, locate and delete the key:
    583e31c01eeb0132f0d1712b8d7ccf2e0064755.BHO.1
66. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>583e31c01eeb0132f0d1712b8d7ccf2e0064755.BHO.1
67. Still in the left panel, locate and delete the key:
    CLSID
68. Again Still in the left panel, locate and delete the key:
    583e31c01eeb0132f0d1712b8d7ccf2e0064755.Sandbox
69. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>583e31c01eeb0132f0d1712b8d7ccf2e0064755.Sandbox
70. Still in the left panel, locate and delete the key:
    CLSID
71. Again Still in the left panel, locate and delete the key:
    CurVer
72. Again Still in the left panel, locate and delete the key:
    583e31c01eeb0132f0d1712b8d7ccf2e0064755.BHO
73. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>583e31c01eeb0132f0d1712b8d7ccf2e0064755.BHO
74. Still in the left panel, locate and delete the key:
    CLSID
75. Again Still in the left panel, locate and delete the key:
    CurVer
76. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
77. Still in the left panel, locate and delete the key:
    {11111111-1111-1111-1111-110611471155}
78. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{11111111-1111-1111-1111-110611471155}
79. Still in the left panel, locate and delete the key:
    ProgID
80. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
81. Again Still in the left panel, locate and delete the key:
    Programmable
82. Again Still in the left panel, locate and delete the key:
    InprocServer32
83. Again Still in the left panel, locate and delete the key:
    TypeLib
84. Again Still in the left panel, locate and delete the key:
    Implemented Categories
85. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{11111111-1111-1111-1111-110611471155}>Implemented Categories
86. Still in the left panel, locate and delete the key:
    {59fb2056-d625-48d0-a944-1a85b5ab2640}
87. Again Still in the left panel, locate and delete the key:
    {22222222-2222-2222-2222-220622472255}
88. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{22222222-2222-2222-2222-220622472255}
89. Still in the left panel, locate and delete the key:
    ProgID
90. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
91. Again Still in the left panel, locate and delete the key:
    Programmable
92. Again Still in the left panel, locate and delete the key:
    InprocServer32
93. Again Still in the left panel, locate and delete the key:
    TypeLib
94. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
95. Still in the left panel, locate and delete the key:
    {44444444-4444-4444-4444-440644474455}
96. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{44444444-4444-4444-4444-440644474455}
97. Still in the left panel, locate and delete the key:
    1.0
98. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{44444444-4444-4444-4444-440644474455}>1.0
99. Still in the left panel, locate and delete the key:
    FLAGS
100. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{44444444-4444-4444-4444-440644474455}>1.0>0
101. Still in the left panel, locate and delete the key:
     win32
102. Again Still in the left panel, locate and delete the key:
     HELPDIR
103. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
104. Still in the left panel, locate and delete the key:
     {55555555-5555-5555-5555-550655475555}
105. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{55555555-5555-5555-5555-550655475555}
106. Still in the left panel, locate and delete the key:
     ProxyStubClsid
107. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
108. Again Still in the left panel, locate and delete the key:
     TypeLib
109. Again Still in the left panel, locate and delete the key:
     {66666666-6666-6666-6666-660666476655}
110. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{66666666-6666-6666-6666-660666476655}
111. Still in the left panel, locate and delete the key:
     ProxyStubClsid
112. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
113. Again Still in the left panel, locate and delete the key:
     TypeLib
114. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor.
   » For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run, type regedit in the text box provided, and then press Enter.
   » For Windows Vista, Windows 7, and Windows Server 2008 users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, and Windows Server 2012 users, right-click on the lower-left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>{ACA88935-7188-47AD-B220-B50106DC0D9C}_is1
3. In the right panel, locate and delete the entry:
   Inno Setup: Setup Version = "5.5.5 (a)"
4. Again In the right panel, locate and delete the entry:
   Inno Setup: Icon Group = "(Default)"
5. Again In the right panel, locate and delete the entry:
   Inno Setup: User = "Wilbert"
6. Again In the right panel, locate and delete the entry:
   Inno Setup: Language = "english"
7. Again In the right panel, locate and delete the entry:
   DisplayName = "fix version 1.0.0.0"
8. Again In the right panel, locate and delete the entry:
   UninstallString = "%Windows%\unins000.exe "
9. Again In the right panel, locate and delete the entry:
   QuietUninstallString = "%Windows%\unins000.exe /SILENT"
10. Again In the right panel, locate and delete the entry:
    DisplayVersion = "1.0.0.0"
11. Again In the right panel, locate and delete the entry:
    NoModify = "1"
12. Again In the right panel, locate and delete the entry:
    NoRepair = "1"
13. Again In the right panel, locate and delete the entry:
    InstallDate = "20141219"
14. Again In the right panel, locate and delete the entry:
    MajorVersion = "1"
15. Again In the right panel, locate and delete the entry:
    MinorVersion = "0"
16. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>winservice86
17. In the right panel, locate and delete the entry:
    DisplayName = "winservice86"
18. Again In the right panel, locate and delete the entry:
    DisplayIcon = "%Program Files%\winservice86\utils.exe"
19. Again In the right panel, locate and delete the entry:
    DisplayVersion = "1.35.12.18"
20. Again In the right panel, locate and delete the entry:
    Publisher = "Corporate Inc"
21. Again In the right panel, locate and delete the entry:
    CrPublisherId = "17638"
22. Again In the right panel, locate and delete the entry:
    CrAppId = "64755"
23. Again In the right panel, locate and delete the entry:
    UninstallString = "%Program Files%\winservice86\Uninstall.exe /fcp
24. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>winservice86>Installer
25. In the right panel, locate and delete the entry:
    BundledIe = "1"
26. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE
27. In the right panel, locate and delete the entry:
    Tempo = "tempo"
28. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>winservice86
29. In the right panel, locate and delete the entry:
    ActiveAppId = "64755"
30. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>winservice86>Update
31. In the right panel, locate and delete the entry:
    LastCheck = "549452a"
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Crossrider
33. In the right panel, locate and delete the entry:
    Bic = "EC72B640CB044B4B836281C19497A5D3IE"
34. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Crossrider
35. In the right panel, locate and delete the entry:
    Bic = "EC72B640CB044B4B836281C19497A5D3IE"
36. Again In the right panel, locate and delete the entry:
    Verifier = "bd4eb47b72dec11062705161f9c1c8d9"
37. Again In the right panel, locate and delete the entry:
    Verifier = "bd4eb47b72dec11062705161f9c1c8d9"
38. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>winservice86>Installer
39. In the right panel, locate and delete the entry:
    Time = "1418986776"
40. Again In the right panel, locate and delete the entry:
    StatsDomain = "http://stats.{BLOCKED}ticinputserv.com"
41. Again In the right panel, locate and delete the entry:
    ErrorsDomain = "http://errors.{BLOCKED}ticinputserv.com"
42. Again In the right panel, locate and delete the entry:
    CodeDownloadDomain = "http://js.{BLOCKED}ticinputserv.com"
43. Again In the right panel, locate and delete the entry:
    CodeDownloadFbDomain = "http://js.{BLOCKED}democloud.com"
44. Again In the right panel, locate and delete the entry:
    FullVersion = "1.35.12.18"
45. Again In the right panel, locate and delete the entry:
    FullVersionForUrl = "1_35_12_18"
46. Again In the right panel, locate and delete the entry:
    SrcId = "002201"
47. Again In the right panel, locate and delete the entry:
    SubId = "0"
48. Again In the right panel, locate and delete the entry:
    ZData = "0"
49. Again In the right panel, locate and delete the entry:
    DefaultBrowser = "ie"
50. Again In the right panel, locate and delete the entry:
    OsName = "XP32"
51. Again In the right panel, locate and delete the entry:
    Params = "{ source_id : 002201, sub_id : 0, uzid : 0}"
52. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>winservice86>IE>Profiles
53. In the right panel, locate and delete the entry:
    S-1-5-21-1645522239-1292428093-682003330-1003 = "1"
54. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>winservice86>IE
55. In the right panel, locate and delete the entry:
    TotalProfiles = "1"
56. Again In the right panel, locate and delete the entry:
    AdditionalInfo = "{random characters}"
57. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>winservice86>Manifest
58. In the right panel, locate and delete the entry:
    Name = "winservice86"
59. Again In the right panel, locate and delete the entry:
    Manifest = "NA"
60. Again In the right panel, locate and delete the entry:
    Description = "winservice"
61. Again In the right panel, locate and delete the entry:
    PublisherName = "Corporate Inc"
62. Again In the right panel, locate and delete the entry:
    HomePageUrl = "NA"
63. Again In the right panel, locate and delete the entry:
    RunInFrame = "false"
64. Again In the right panel, locate and delete the entry:
    ThanksUrl = "NA"
65. Again In the right panel, locate and delete the entry:
    DisableIe = "true"
66. Again In the right panel, locate and delete the entry:
    EnableSearchIE = "false"
67. Again In the right panel, locate and delete the entry:
    Version = "56"
68. Again In the right panel, locate and delete the entry:
    UpdateInterval = "168"
69. Again In the right panel, locate and delete the entry:
    BgVersion = "1"
70. Again In the right panel, locate and delete the entry:
    AddressbarURL = "NA"
71. Again In the right panel, locate and delete the entry:
    ChangePrevious = "false"
72. Again In the right panel, locate and delete the entry:
    SetNewTab = "false"
73. Again In the right panel, locate and delete the entry:
    PublisherId = "17638"
74. Again In the right panel, locate and delete the entry:
    ModeType = "production"
75. Again In the right panel, locate and delete the entry:
    PluginsManifestVersion = "50"
76. Again In the right panel, locate and delete the entry:
    IsButtonEnabled = "false"
77. Again In the right panel, locate and delete the entry:
    UninstallerOfferUrl = "NA"
78. Again In the right panel, locate and delete the entry:
    UninstallerOfferAction = "NA"
79. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>winservice86>Code
80. In the right panel, locate and delete the entry:
    AppJavaScript = "{random characters}"
81. Again In the right panel, locate and delete the entry:
    BgJavaScript = "{random characters}"
82. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>winservice86>Plugins>94
83. In the right panel, locate and delete the entry:
    Version = "2"
84. Again In the right panel, locate and delete the entry:
    Name = "IEPopup"
85. Again In the right panel, locate and delete the entry:
    JavaScript = "{random characters}"
86. Again In the right panel, locate and delete the entry:
    Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/94.js"
87. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>winservice86>Plugins>78
88. In the right panel, locate and delete the entry:
    Version = "5"
89. Again In the right panel, locate and delete the entry:
    Name = "CrossriderInfo"
90. Again In the right panel, locate and delete the entry:
    JavaScript = "{random characters}"
91. Again In the right panel, locate and delete the entry:
    Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/78.js"
92. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>winservice86>Plugins>64
93. In the right panel, locate and delete the entry:
    Version = "3"
94. Again In the right panel, locate and delete the entry:
    Name = "appApiMessage"
95. Again In the right panel, locate and delete the entry:
    JavaScript = "{random characters}"
96. Again In the right panel, locate and delete the entry:
    Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/64.js"
97. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>winservice86>Plugins>44
98. In the right panel, locate and delete the entry:
    Version = "6"
99. Again In the right panel, locate and delete the entry:
    Name = "IEMisc"
100. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
101. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/44.js"
102. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>46
103. In the right panel, locate and delete the entry:
     Version = "5"
104. Again In the right panel, locate and delete the entry:
     Name = "IETimers"
105. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
106. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/46.js"
107. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>45
108. In the right panel, locate and delete the entry:
     Version = "4"
109. Again In the right panel, locate and delete the entry:
     Name = "IEOnRequest"
110. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
111. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/45.js"
112. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>41
113. In the right panel, locate and delete the entry:
     Version = "7"
114. Again In the right panel, locate and delete the entry:
     Name = "IEInfo"
115. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
116. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/41.js"
117. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>36
118. In the right panel, locate and delete the entry:
     Version = "8"
119. Again In the right panel, locate and delete the entry:
     Name = "IEBackground"
120. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
121. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/36.js"
122. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>40
123. In the right panel, locate and delete the entry:
     Version = "4"
124. Again In the right panel, locate and delete the entry:
     Name = "IEExtension"
125. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
126. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/40.js"
127. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>43
128. In the right panel, locate and delete the entry:
     Version = "5"
129. Again In the right panel, locate and delete the entry:
     Name = "IEMessaging"
130. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
131. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/43.js"
132. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>37
133. In the right panel, locate and delete the entry:
     Version = "6"
134. Again In the right panel, locate and delete the entry:
     Name = "IEBrowserEvents"
135. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
136. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/37.js"
137. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>42
138. In the right panel, locate and delete the entry:
     Version = "a"
139. Again In the right panel, locate and delete the entry:
     Name = "IEInternal"
140. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
141. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/42.js"
142. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>14
143. In the right panel, locate and delete the entry:
     Version = "b"
144. Again In the right panel, locate and delete the entry:
     Name = "CrossriderUtils"
145. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
146. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/14.js"
147. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>314
148. In the right panel, locate and delete the entry:
     Version = "2"
149. Again In the right panel, locate and delete the entry:
     Name = "targeting_edge_pops_m"
150. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
151. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/314.js"
152. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>38
153. In the right panel, locate and delete the entry:
     Version = "4"
154. Again In the right panel, locate and delete the entry:
     Name = "IECallbacks"
155. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
156. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/38.js"
157. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>13
158. In the right panel, locate and delete the entry:
     Version = "7"
159. Again In the right panel, locate and delete the entry:
     Name = "CrossriderAppUtils"
160. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
161. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/13.js"
162. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>35
163. In the right panel, locate and delete the entry:
     Version = "4"
164. Again In the right panel, locate and delete the entry:
     Name = "IEAjax"
165. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
166. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/35.js"
167. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>242
168. In the right panel, locate and delete the entry:
     Version = "4"
169. Again In the right panel, locate and delete the entry:
     Name = "price_gong_m"
170. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
171. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/242.js"
172. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>39
173. In the right panel, locate and delete the entry:
     Version = "5"
174. Again In the right panel, locate and delete the entry:
     Name = "IEDatabase"
175. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
176. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/39.js"
177. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>244
178. In the right panel, locate and delete the entry:
     Version = "5"
179. Again In the right panel, locate and delete the entry:
     Name = "engageya_inner_m"
180. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
181. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/244.js"
182. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>17
183. In the right panel, locate and delete the entry:
     Version = "4"
184. Again In the right panel, locate and delete the entry:
     Name = "jQuery"
185. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
186. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/17.js"
187. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>221
188. In the right panel, locate and delete the entry:
     Version = "4"
189. Again In the right panel, locate and delete the entry:
     Name = "icm_downloads_m"
190. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
191. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/221.js"
192. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>262
193. In the right panel, locate and delete the entry:
     Version = "2"
194. Again In the right panel, locate and delete the entry:
     Name = "pops_5_j_m"
195. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
196. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/262.js"
197. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>223
198. In the right panel, locate and delete the entry:
     Version = "9"
199. Again In the right panel, locate and delete the entry:
     Name = "imonomy_m"
200. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
201. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/223.js"
202. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>220
203. In the right panel, locate and delete the entry:
     Version = "26"
204. Again In the right panel, locate and delete the entry:
     Name = "icm_base_m"
205. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
206. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/220.js"
207. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>230
208. In the right panel, locate and delete the entry:
     Version = "7"
209. Again In the right panel, locate and delete the entry:
     Name = "revizer_ws_dynamic_b2b_2_m"
210. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
211. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/230.js"
212. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>9
213. In the right panel, locate and delete the entry:
     Version = "3"
214. Again In the right panel, locate and delete the entry:
     Name = "search_engine_hook"
215. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
216. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/9.js"
217. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>289
218. In the right panel, locate and delete the entry:
     Version = "4"
219. Again In the right panel, locate and delete the entry:
     Name = "covus_logos_m"
220. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
221. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/289.js"
222. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>195
223. In the right panel, locate and delete the entry:
     Version = "1c"
224. Again In the right panel, locate and delete the entry:
     Name = "icm_convertmedia_m"
225. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
226. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/195.js"
227. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>273
228. In the right panel, locate and delete the entry:
     Version = "6"
229. Again In the right panel, locate and delete the entry:
     Name = "aedgency_back_button_m"
230. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
231. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/273.js"
232. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>263
233. In the right panel, locate and delete the entry:
     Version = "3"
234. Again In the right panel, locate and delete the entry:
     Name = "intext_5_j_m"
235. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
236. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/263.js"
237. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>7
238. In the right panel, locate and delete the entry:
     Version = "2"
239. Again In the right panel, locate and delete the entry:
     Name = "hooks"
240. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
241. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/7.js"
242. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>91
243. In the right panel, locate and delete the entry:
     Version = "6d"
244. Again In the right panel, locate and delete the entry:
     Name = "monetizationLoader.js"
245. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
246. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/91.js"
247. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>193
248. In the right panel, locate and delete the entry:
     Version = "9"
249. Again In the right panel, locate and delete the entry:
     Name = "revizer_p_dynamic_b2b_m"
250. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
251. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/193.js"
252. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>180
253. In the right panel, locate and delete the entry:
     Version = "c"
254. Again In the right panel, locate and delete the entry:
     Name = "bpo_serp_m"
255. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
256. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/180.js"
257. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>200
258. In the right panel, locate and delete the entry:
     Version = "4"
259. Again In the right panel, locate and delete the entry:
     Name = "foxydeal_m"
260. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
261. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/200.js"
262. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>246
263. In the right panel, locate and delete the entry:
     Version = "f"
264. Again In the right panel, locate and delete the entry:
     Name = "setup"
265. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
266. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/246.js"
267. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>128
268. In the right panel, locate and delete the entry:
     Version = "7"
269. Again In the right panel, locate and delete the entry:
     Name = "superfish_pricora_m"
270. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
271. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/128.js"
272. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>93
273. In the right panel, locate and delete the entry:
     Version = "e"
274. Again In the right panel, locate and delete the entry:
     Name = "superfish_no_coupons_m"
275. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
276. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/93.js"
277. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>269
278. In the right panel, locate and delete the entry:
     Version = "1"
279. Again In the right panel, locate and delete the entry:
     Name = "stats_ie"
280. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
281. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/269.js"
282. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>47
283. In the right panel, locate and delete the entry:
     Version = "3"
284. Again In the right panel, locate and delete the entry:
     Name = "resources_background"
285. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
286. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/47.js"
287. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>184
288. In the right panel, locate and delete the entry:
     Version = "a"
289. Again In the right panel, locate and delete the entry:
     Name = "noproblemppc_m"
290. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
291. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/184.js"
292. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>3
293. In the right panel, locate and delete the entry:
     Version = "2"
294. Again In the right panel, locate and delete the entry:
     Name = "ie8_fix_2"
295. Again In the right panel, locate and delete the entry:
     JavaScript = "(function(){var b
296. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/3.js"
297. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>102
298. In the right panel, locate and delete the entry:
     Version = "b"
299. Again In the right panel, locate and delete the entry:
     Name = "dealply_m"
300. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
301. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/102.js"
302. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>4
303. In the right panel, locate and delete the entry:
     Version = "5"
304. Again In the right panel, locate and delete the entry:
     Name = "jquery_1_7_1"
305. Again In the right panel, locate and delete the entry:
     JavaScript = "{random characters}"
306. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/javascripts/jquery-1_7_1_min.js"
307. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins>2
308. In the right panel, locate and delete the entry:
     Version = "2"
309. Again In the right panel, locate and delete the entry:
     Name = "ie8_fix_1"
310. Again In the right panel, locate and delete the entry:
     JavaScript = "(function(){var b
311. Again In the right panel, locate and delete the entry:
     Url = "http://js.{BLOCKED}ticinputserv.com/plugins/mins/2.js"
312. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>winservice86>Plugins
313. In the right panel, locate and delete the entry:
     AppPluginList = "{random characters}"
314. Again In the right panel, locate and delete the entry:
     BgPluginList = "{random characters}"
315. Again In the right panel, locate and delete the entry:
     NewTabPluginList = "42,38,46,17,14,78,13,41,44,39,35,43,40,64,2,4,3"
316. Again In the right panel, locate and delete the entry:
     OnRequestPluginList = "14,42,41,39,38,43,45,64"
317. Again In the right panel, locate and delete the entry:
     BrowserEventPluginList = "14,42,41,44,39,38,43,37,64"
318. Again In the right panel, locate and delete the entry:
     PopupPluginList = "42,38,46,41,44,39,35,43,36,4,14,78,13,64,47,94"
319. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Main>FeatureControl>FEATURE_BROWSER_EMULATION
320. In the right panel, locate and delete the entry:
     winservice86-bg.exe = "1f4"
321. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Low Rights>ElevationPolicy>{2b9db7a6-ace4-4c99-83b3-b35a02e5970d}
322. In the right panel, locate and delete the entry:
     AppName = "winservice86-bg.exe"
323. Again In the right panel, locate and delete the entry:
     AppPath = "%Program Files%\winservice86"
324. Again In the right panel, locate and delete the entry:
     Policy = "1"
325. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Low Rights>ElevationPolicy>{2b9db7a6-ace4-4c99-83b3-b35a02e5970d}
326. In the right panel, locate and delete the entry:
     AppName = "winservice86-bg.exe"
327. Again In the right panel, locate and delete the entry:
     AppPath = "%Program Files%\winservice86"
328. Again In the right panel, locate and delete the entry:
     Policy = "1"
329. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{11111111-1111-1111-1111-110611471155}>InprocServer32
330. In the right panel, locate and delete the entry:
     ThreadingModel = "Apartment"
331. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{22222222-2222-2222-2222-220622472255}>InprocServer32
332. In the right panel, locate and delete the entry:
     ThreadingModel = "Apartment"
333. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Browser Helper Objects>{11111111-1111-1111-1111-110611471155}
334. In the right panel, locate and delete the entry:
     NoExplorer = "1"
335. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{55555555-5555-5555-5555-550655475555}>TypeLib
336. In the right panel, locate and delete the entry:
     Version = "1.0"
337. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{66666666-6666-6666-6666-660666476655}>TypeLib
338. In the right panel, locate and delete the entry:
     Version = "1.0"
339. Close Registry Editor.

To manually delete a malware/grayware file from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the File name* input box, type the following:
   
   • %System Root%\/Wmain/base_conf.ini
   • %System Root%\/Wmain/current_conf.ini
   • %System Root%\/Wmain/new_conf.ini
   • %System Root%\/Wmain/r_new_conf.ini
   • %System Root%\/Wmain/r_winUparams.ini
   • %System Root%\/Wmain/windows_update_1.exe
   • %System Root%\/Wmain/win_update_3.exe
   • %User Temp%\is-I30T1.tmp\windows_update_1.tmp
   • %User Temp%\is-8BB2R.tmp\_isetup\_shfoldr.dll
   • %Windows%\unins000.dat
   • %Windows%\is-JRPHS.tmp
   • %Windows%\is-OM6KC.tmp
   • %Windows%\is-P27L1.tmp
   • %Windows%\is-S2ITH.tmp
   • %User Profile%\pYo7WPu\sQqqy6K.exe
   • %User Profile%\pYo7WPu\Kommun.dll
   • %User Profile%\pYo7WPu\LibDownloadManagement.dll
   • %User Temp%\nsf36.tmp\System.dll
   • %User Temp%\nsf36.tmp\Awjzwh.tmp
   • %User Temp%\nsf36.tmp\FacebookIsGod.dll
   • %User Temp%\nsf36.tmp\Lgsyodsiolsfjq.exe
   • %User Temp%\nsf36.tmp\StdUtils.dll
   • %User Temp%\nsk40.tmp
   • %User Temp%\nsz42.tmp\StdUtils.dll
   • %User Temp%\nsz42.tmp\System.dll
   • %User Temp%\nsz42.tmp\InstallerUtils.dll
   • %User Temp%\nsz42.tmp\InstallerUtils2.dll
   • %User Temp%\nsz42.tmp\UserInfo.dll
   • %User Temp%\nsz42.tmp\nsisos.dll
   • %User Temp%\nsz42.tmp\md5dll.dll
   • %Program Files%\winservice86\utils.exe
   • %User Temp%\nsz42.tmp\463795
   • %User Temp%\nsz42.tmp\494148
   • %Windows%\Tasks\fed58121-5ab7-41e8-aaeb-4a1dd4499d77-1.job
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\manifest.xml
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins.json
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\102.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\128.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\13.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\14.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\17.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\180.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\184.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\193.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\195.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\2.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\200.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\220.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\221.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\223.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\230.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\242.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\244.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\246.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\262.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\263.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\269.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\273.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\289.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\3.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\314.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\35.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\36.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\37.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\38.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\39.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\4.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\40.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\41.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\42.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\43.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\44.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\45.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\46.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\47.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\64.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\7.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\78.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\9.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\91.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\93.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\94.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\userCode\background.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\userCode\extension.js
   • %User Temp%\nsz42.tmp\fed58121-5ab7-41e8-aaeb-4a1dd4499d77-1.dll
   • %User Temp%\nsz42.tmp\ExecDos.dll
   • %Program Files%\winservice86\background.html
   • %Program Files%\winservice86\Uninstall.exe
   • %Program Files%\winservice86\winservice86-bho.dll
   • %Program Files%\winservice86\winservice86-bg.exe
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: The file name input box title varies depending on the Windows version (e.g. Search for files or folders named or All or part of the file name.).

• For Windows Vista, Windows 7, Windows Server 2008, Windows 8, Windows 8.1, and Windows Server 2012:

1. Open a Windows Explorer window.
   • For Windows Vista, 7, and Server 2008 users, click Start>Computer.
   • For Windows 8, 8.1, and Server 2012 users, right-click on the lower left corner of the screen,then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %System Root%\/Wmain/base_conf.ini
   • %System Root%\/Wmain/current_conf.ini
   • %System Root%\/Wmain/new_conf.ini
   • %System Root%\/Wmain/r_new_conf.ini
   • %System Root%\/Wmain/r_winUparams.ini
   • %System Root%\/Wmain/windows_update_1.exe
   • %System Root%\/Wmain/win_update_3.exe
   • %User Temp%\is-I30T1.tmp\windows_update_1.tmp
   • %User Temp%\is-8BB2R.tmp\_isetup\_shfoldr.dll
   • %Windows%\unins000.dat
   • %Windows%\is-JRPHS.tmp
   • %Windows%\is-OM6KC.tmp
   • %Windows%\is-P27L1.tmp
   • %Windows%\is-S2ITH.tmp
   • %User Profile%\pYo7WPu\sQqqy6K.exe
   • %User Profile%\pYo7WPu\Kommun.dll
   • %User Profile%\pYo7WPu\LibDownloadManagement.dll
   • %User Temp%\nsf36.tmp\System.dll
   • %User Temp%\nsf36.tmp\Awjzwh.tmp
   • %User Temp%\nsf36.tmp\FacebookIsGod.dll
   • %User Temp%\nsf36.tmp\Lgsyodsiolsfjq.exe
   • %User Temp%\nsf36.tmp\StdUtils.dll
   • %User Temp%\nsk40.tmp
   • %User Temp%\nsz42.tmp\StdUtils.dll
   • %User Temp%\nsz42.tmp\System.dll
   • %User Temp%\nsz42.tmp\InstallerUtils.dll
   • %User Temp%\nsz42.tmp\InstallerUtils2.dll
   • %User Temp%\nsz42.tmp\UserInfo.dll
   • %User Temp%\nsz42.tmp\nsisos.dll
   • %User Temp%\nsz42.tmp\md5dll.dll
   • %Program Files%\winservice86\utils.exe
   • %User Temp%\nsz42.tmp\463795
   • %User Temp%\nsz42.tmp\494148
   • %Windows%\Tasks\fed58121-5ab7-41e8-aaeb-4a1dd4499d77-1.job
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\manifest.xml
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins.json
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\102.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\128.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\13.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\14.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\17.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\180.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\184.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\193.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\195.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\2.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\200.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\220.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\221.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\223.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\230.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\242.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\244.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\246.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\262.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\263.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\269.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\273.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\289.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\3.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\314.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\35.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\36.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\37.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\38.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\39.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\4.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\40.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\41.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\42.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\43.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\44.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\45.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\46.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\47.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\64.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\7.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\78.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\9.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\91.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\93.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins\94.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\userCode\background.js
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\userCode\extension.js
   • %User Temp%\nsz42.tmp\fed58121-5ab7-41e8-aaeb-4a1dd4499d77-1.dll
   • %User Temp%\nsz42.tmp\ExecDos.dll
   • %Program Files%\winservice86\background.html
   • %Program Files%\winservice86\Uninstall.exe
   • %Program Files%\winservice86\winservice86-bho.dll
   • %Program Files%\winservice86\winservice86-bg.exe
3. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the File name* input box, type:
   
   • %System Root%\/Wmain
   • %User Temp%\is-I30T1.tmp
   • %User Temp%\is-8BB2R.tmp
   • %User Temp%\is-8BB2R.tmp\_isetup
   • %User Profile%\Application Data\pYo7WPu
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\Wilbert
   • %User Profile%\LOCALS~1
   • %User Temp%\nsf36.tmp
   • %User Temp%\nsz42.tmp
   • %Program Files%\winservice86
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\userCode
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %System Root%\/Wmain
   • %User Temp%\is-I30T1.tmp
   • %User Temp%\is-8BB2R.tmp
   • %User Temp%\is-8BB2R.tmp\_isetup
   • %User Profile%\Application Data\pYo7WPu
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\Wilbert
   • %User Profile%\LOCALS~1
   • %User Temp%\nsf36.tmp
   • %User Temp%\nsz42.tmp
   • %Program Files%\winservice86
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\userCode
   *Note: The file name input box title varies depending on the Windows version (e.g. Search for files or folders named or All or part of the file name.).

For Windows Vista, Windows 7, Windows Server 2008, Windows 8, Windows 8.1, and Windows Server 2012:

1. Open a Windows Explorer window.
   • For Windows Vista, 7, and Server 2008 users, click Start>Computer.
   • For Windows 8, 8.1, and Server 2012 users, right-click on the lower left corner of the screen, then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %System Root%\/Wmain
   • %User Temp%\is-I30T1.tmp
   • %User Temp%\is-8BB2R.tmp
   • %User Temp%\is-8BB2R.tmp\_isetup
   • %User Profile%\Application Data\pYo7WPu
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\Wilbert
   • %User Profile%\LOCALS~1
   • %User Temp%\nsf36.tmp
   • %User Temp%\nsz42.tmp
   • %Program Files%\winservice86
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\userCode
3. Once located, select the file then press SHIFT+DELETE to permanently delete the folder.
4. Repeat steps 2-3 for the remaining folders:
   • %System Root%\/Wmain
   • %User Temp%\is-I30T1.tmp
   • %User Temp%\is-8BB2R.tmp
   • %User Temp%\is-8BB2R.tmp\_isetup
   • %User Profile%\Application Data\pYo7WPu
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\Wilbert
   • %User Profile%\LOCALS~1
   • %User Temp%\nsf36.tmp
   • %User Temp%\nsz42.tmp
   • %Program Files%\winservice86
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\plugins
   • %User Temp%\nsz42.tmp\{CD823559-7933-4310-A621-15FCBE29D57C}\userCode
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.