BKDR_AGENT.EAUZ

To restart in Safe Mode:

• For Windows 2000 users

1. Restart your computer.
2. Press F8 when you see the Starting Windows bar at the bottom of the screen.
3. Choose the Safe Mode option from the Windows Advanced Options menu then press Enter.

• For Windows XP users

1. Restart your computer.
2. Press F8 after the Power-On Self Test (POST) routine is done. If the Windows Advanced Options menu does not appear, try restarting then pressing F8 several times when the POST screen appears.
3. Choose the Safe Mode option from the Windows Advanced Options menu then press Enter.

• For Windows Server 2003 users

1. Restart your computer.
2. Press F8 after Windows starts up. If the Windows Advanced Options menu does not appear, try restarting again and pressing F8 several times afterward.
3. On the Windows Advanced Option menu, use the arrow keys to select Safe Mode then press Enter.

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>THQ
3. Still in the left panel, locate and delete the key:
   Frontlines: Fuel of War
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Activision
5. Still in the left panel, locate and delete the key:
   Call of Duty 4
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Sunflowers
7. Still in the left panel, locate and delete the key:
   Anno 1701
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Electronic Arts>EA GAMES
9. Still in the left panel, locate and delete the key:
   Battlefield 1942
10. Again Still in the left panel, locate and delete the key:
    Battlefield 1942 Secret Weapons of WWII
11. Again Still in the left panel, locate and delete the key:
    Battlefield 1942 The Road to Rome
12. Again Still in the left panel, locate and delete the key:
    Battlefield Vietnam
13. Again Still in the left panel, locate and delete the key:
    Battlefield 2 Special Forces
14. Again Still in the left panel, locate and delete the key:
    Battlefield 2142
15. Again Still in the left panel, locate and delete the key:
    Black and White
16. Again Still in the left panel, locate and delete the key:
    Call of Duty
17. Again Still in the left panel, locate and delete the key:
    Call of Duty United Offensive
18. Again Still in the left panel, locate and delete the key:
    Call of Duty 2
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Techland
20. Still in the left panel, locate and delete the key:
    Chrome
21. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Electronic Arts>EA Games
22. Still in the left panel, locate and delete the key:
    Generals
23. Again Still in the left panel, locate and delete the key:
    Command and Conquer Generals Zero Hour
24. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Westwood
25. Still in the left panel, locate and delete the key:
    Red Alert
26. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Westwood
27. Still in the left panel, locate and delete the key:
    Red Alert 2
28. Again Still in the left panel, locate and delete the key:
    Tiberian Sun
29. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Electronic Arts>Electronic Arts
30. Still in the left panel, locate and delete the key:
    Command and Conquer 3
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Electronic Arts>EA Sports
32. Still in the left panel, locate and delete the key:
    FIFA 2002
33. Again Still in the left panel, locate and delete the key:
    FIFA 2003
34. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Electronic Arts>EA Distribution
35. Still in the left panel, locate and delete the key:
    Freedom Force
36. Again Still in the left panel, locate and delete the key:
    Global Operations
37. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Illusion Softworks
38. Still in the left panel, locate and delete the key:
    Hidden & Dangerous 2
39. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>JoWooD>InstalledGames
40. Still in the left panel, locate and delete the key:
    IG2
41. Again Still in the left panel, locate and delete the key:
    James Bond 007 Nightfire
42. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>3d0
43. Still in the left panel, locate and delete the key:
    Status
44. Again Still in the left panel, locate and delete the key:
    Medal of Honor Allied Assault
45. Again Still in the left panel, locate and delete the key:
    Medal of Honor Allied Assault Breakthrough
46. Again Still in the left panel, locate and delete the key:
    Medal of Honor Allied Assault Spearhead
47. Again Still in the left panel, locate and delete the key:
    Nascar Racing 2002
48. Again Still in the left panel, locate and delete the key:
    Nascar Racing 2003
49. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Red Storm Entertainment
50. Still in the left panel, locate and delete the key:
    RAVENSHIELD
51. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Silver Style Entertainment>Soldiers Of Anarchy
52. Still in the left panel, locate and delete the key:
    Settings
53. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Eugen Systems
54. Still in the left panel, locate and delete the key:
    The Gladiators
55. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Electronic Arts>Maxis
56. Still in the left panel, locate and delete the key:
    The Sims
57. Again Still in the left panel, locate and delete the key:
    The Sims Livin' Large
58. Again Still in the left panel, locate and delete the key:
    The Sims House Party
59. Again Still in the left panel, locate and delete the key:
    The Sims 2 Family Fun Stuff
60. Again Still in the left panel, locate and delete the key:
    The Sims 2 Glamour Life Stuff
61. Again Still in the left panel, locate and delete the key:
    The Sims 2 Nightlife
62. Again Still in the left panel, locate and delete the key:
    The Sims 2 Pets
63. Again Still in the left panel, locate and delete the key:
    The Sims 2 Open for Business
64. Again Still in the left panel, locate and delete the key:
    The Sims 2 Seasons
65. Again Still in the left panel, locate and delete the key:
    The Sims 2 University
66. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>TechSmith>SnagIt
67. Still in the left panel, locate and delete the key:
    8
68. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Electronic Arts
69. Still in the left panel, locate and delete the key:
    Battlefield 2
70. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Notepad
71. Still in the left panel, locate and delete the key:
    DefaultFonts
72. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Run
3. In the right panel, locate and delete the entry:
   Explorer = "%User Profile%\Application Data\explorer.exe"
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Notepad>DefaultFonts
5. In the right panel, locate and delete the entry:
   Key = "33735612-B90B-4B0D-A16B-A5B4321EC12D"
6. Close Registry Editor.