BKDR_BL.3F1D5D6C

To restart in Safe Mode:

• For Windows 2000 users

1. Restart your computer.
2. Press F8 when you see the Starting Windows bar at the bottom of the screen.
3. Choose the Safe Mode option from the Windows Advanced Options menu then press Enter.

• For Windows XP users

1. Restart your computer.
2. Press F8 after the Power-On Self Test (POST) routine is done. If the Windows Advanced Options menu does not appear, try restarting then pressing F8 several times when the POST screen appears.
3. Choose the Safe Mode option from the Windows Advanced Options menu then press Enter.

• For Windows Server 2003 users

1. Restart your computer.
2. Press F8 after Windows starts up. If the Windows Advanced Options menu does not appear, try restarting again and pressing F8 several times afterward.
3. On the Windows Advanced Option menu, use the arrow keys to select Safe Mode then press Enter.

• For Windows Vista and Windows 7 users

1. Restart your computer.
2. Press F8 after the Power-On Self Test (POST) routine is done. If the Advanced Boot Options menu does not appear, try restarting and then pressing F8 several times after the POST screen is displayed.
3. On the Advanced Boot Options menu, use the arrow keys to select the Safe Mode option, and then press Enter.

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software
3. Still in the left panel, locate and delete the key:
   WinRAR SFX
4. Again Still in the left panel, locate and delete the key:
   b81ad8ae9d0103ee44c3b8a3e445b627
5. In the left panel, double-click the following:
   HKEY_CURRENT_USER>SOFTWARE
6. Still in the left panel, locate and delete the key:
   SafeIP
7. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID
8. Still in the left panel, locate and delete the key:
   SafeIPS.exe
9. In the left panel, double-click the following:
   HKEY_CLASSES_ROOT>Wow6432Node>AppID
10. Still in the left panel, locate and delete the key:
    SafeIPS.exe
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Uninstall
12. Still in the left panel, locate and delete the key:
    SAFEIP_is1
13. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT
14. Still in the left panel, locate and delete the key:
    TransparentLabel.Control.1
15. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TransparentLabel.Control.1
16. Still in the left panel, locate and delete the key:
    CLSID
17. Again Still in the left panel, locate and delete the key:
    Insertable
18. Again Still in the left panel, locate and delete the key:
    TransparentLabel.Control
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TransparentLabel.Control
20. Still in the left panel, locate and delete the key:
    CLSID
21. Again Still in the left panel, locate and delete the key:
    CurVer
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
23. Still in the left panel, locate and delete the key:
    {7CEF2F64-717E-4BE6-A817-8B7E2BEDF86F}
24. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{7CEF2F64-717E-4BE6-A817-8B7E2BEDF86F}
25. Still in the left panel, locate and delete the key:
    ProgID
26. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
27. Again Still in the left panel, locate and delete the key:
    Programmable
28. Again Still in the left panel, locate and delete the key:
    InprocServer32
29. Again Still in the left panel, locate and delete the key:
    Control
30. Again Still in the left panel, locate and delete the key:
    Insertable
31. Again Still in the left panel, locate and delete the key:
    ToolboxBitmap32
32. Again Still in the left panel, locate and delete the key:
    MiscStatus
33. Again Still in the left panel, locate and delete the key:
    TypeLib
34. Again Still in the left panel, locate and delete the key:
    Version
35. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
36. Still in the left panel, locate and delete the key:
    {B33DCDA7-6818-4AF7-8470-98867FC74277}
37. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{B33DCDA7-6818-4AF7-8470-98867FC74277}
38. Still in the left panel, locate and delete the key:
    1.0
39. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{B33DCDA7-6818-4AF7-8470-98867FC74277}>1.0
40. Still in the left panel, locate and delete the key:
    FLAGS
41. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{B33DCDA7-6818-4AF7-8470-98867FC74277}>1.0>0
42. Still in the left panel, locate and delete the key:
    win32
43. Again Still in the left panel, locate and delete the key:
    HELPDIR
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
45. Still in the left panel, locate and delete the key:
    {BC4411BC-3AB1-488B-8CAE-0FA6CC8E9CC8}
46. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BC4411BC-3AB1-488B-8CAE-0FA6CC8E9CC8}
47. Still in the left panel, locate and delete the key:
    ProxyStubClsid
48. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
49. Again Still in the left panel, locate and delete the key:
    TypeLib
50. Again Still in the left panel, locate and delete the key:
    {D0D03945-E60C-4DF1-A45E-EED11F95A624}
51. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{D0D03945-E60C-4DF1-A45E-EED11F95A624}
52. Still in the left panel, locate and delete the key:
    ProxyStubClsid
53. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
54. Again Still in the left panel, locate and delete the key:
    TypeLib
55. Again Still in the left panel, locate and delete the key:
    {9DC8FA51-B596-4f77-802C-5B295919C205}
56. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>Control>SafeBoot>Network
57. Still in the left panel, locate and delete the key:
    SafeIPS
58. Again Still in the left panel, locate and delete the key:
    PCProxy.DataController.1
59. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>PCProxy.DataController.1
60. Still in the left panel, locate and delete the key:
    CLSID
61. Again Still in the left panel, locate and delete the key:
    PCProxy.DataController
62. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>PCProxy.DataController
63. Still in the left panel, locate and delete the key:
    CLSID
64. Again Still in the left panel, locate and delete the key:
    CurVer
65. Again Still in the left panel, locate and delete the key:
    {6EEBC7FF-67DA-4B90-9251-C2C5696E4B48}
66. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{6EEBC7FF-67DA-4B90-9251-C2C5696E4B48}
67. Still in the left panel, locate and delete the key:
    ProgID
68. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
69. Again Still in the left panel, locate and delete the key:
    Programmable
70. Again Still in the left panel, locate and delete the key:
    LocalServer32
71. Again Still in the left panel, locate and delete the key:
    TypeLib
72. Again Still in the left panel, locate and delete the key:
    PCProxy.DataTable.1
73. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>PCProxy.DataTable.1
74. Still in the left panel, locate and delete the key:
    CLSID
75. Again Still in the left panel, locate and delete the key:
    PCProxy.DataTable
76. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>PCProxy.DataTable
77. Still in the left panel, locate and delete the key:
    CLSID
78. Again Still in the left panel, locate and delete the key:
    CurVer
79. Again Still in the left panel, locate and delete the key:
    {3E28F712-0D6C-4EE3-AC8C-8F060F5D7C33}
80. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{3E28F712-0D6C-4EE3-AC8C-8F060F5D7C33}
81. Still in the left panel, locate and delete the key:
    ProgID
82. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
83. Again Still in the left panel, locate and delete the key:
    Programmable
84. Again Still in the left panel, locate and delete the key:
    LocalServer32
85. Again Still in the left panel, locate and delete the key:
    TypeLib
86. Again Still in the left panel, locate and delete the key:
    PCProxy.DataTableHolder.1
87. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>PCProxy.DataTableHolder.1
88. Still in the left panel, locate and delete the key:
    CLSID
89. Again Still in the left panel, locate and delete the key:
    PCProxy.DataTableHolder
90. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>PCProxy.DataTableHolder
91. Still in the left panel, locate and delete the key:
    CLSID
92. Again Still in the left panel, locate and delete the key:
    CurVer
93. Again Still in the left panel, locate and delete the key:
    {DD67706E-819E-4EBD-BF8D-6D6147CC7A49}
94. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{DD67706E-819E-4EBD-BF8D-6D6147CC7A49}
95. Still in the left panel, locate and delete the key:
    ProgID
96. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
97. Again Still in the left panel, locate and delete the key:
    Programmable
98. Again Still in the left panel, locate and delete the key:
    LocalServer32
99. Again Still in the left panel, locate and delete the key:
    TypeLib
100. Again Still in the left panel, locate and delete the key:
     PCProxy.LSPLogic.1
101. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>PCProxy.LSPLogic.1
102. Still in the left panel, locate and delete the key:
     CLSID
103. Again Still in the left panel, locate and delete the key:
     PCProxy.LSPLogic
104. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>PCProxy.LSPLogic
105. Still in the left panel, locate and delete the key:
     CLSID
106. Again Still in the left panel, locate and delete the key:
     CurVer
107. Again Still in the left panel, locate and delete the key:
     {B1A429DB-FB06-4645-B7C0-0CC405EAD3CD}
108. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B1A429DB-FB06-4645-B7C0-0CC405EAD3CD}
109. Still in the left panel, locate and delete the key:
     ProgID
110. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
111. Again Still in the left panel, locate and delete the key:
     Programmable
112. Again Still in the left panel, locate and delete the key:
     LocalServer32
113. Again Still in the left panel, locate and delete the key:
     TypeLib
114. Again Still in the left panel, locate and delete the key:
     PCProxy.DataTableFields.1
115. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>PCProxy.DataTableFields.1
116. Still in the left panel, locate and delete the key:
     CLSID
117. Again Still in the left panel, locate and delete the key:
     PCProxy.DataTableFields
118. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>PCProxy.DataTableFields
119. Still in the left panel, locate and delete the key:
     CLSID
120. Again Still in the left panel, locate and delete the key:
     CurVer
121. Again Still in the left panel, locate and delete the key:
     {533403E2-6E21-4615-9E28-43F4E97E977B}
122. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{533403E2-6E21-4615-9E28-43F4E97E977B}
123. Still in the left panel, locate and delete the key:
     ProgID
124. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
125. Again Still in the left panel, locate and delete the key:
     Programmable
126. Again Still in the left panel, locate and delete the key:
     LocalServer32
127. Again Still in the left panel, locate and delete the key:
     TypeLib
128. Again Still in the left panel, locate and delete the key:
     PCProxy.DataContainer.1
129. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>PCProxy.DataContainer.1
130. Still in the left panel, locate and delete the key:
     CLSID
131. Again Still in the left panel, locate and delete the key:
     PCProxy.DataContainer
132. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>PCProxy.DataContainer
133. Still in the left panel, locate and delete the key:
     CLSID
134. Again Still in the left panel, locate and delete the key:
     CurVer
135. Again Still in the left panel, locate and delete the key:
     {6CE321DA-DC11-45C6-A0FC-4E8A7D978ABC}
136. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{6CE321DA-DC11-45C6-A0FC-4E8A7D978ABC}
137. Still in the left panel, locate and delete the key:
     ProgID
138. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
139. Again Still in the left panel, locate and delete the key:
     Programmable
140. Again Still in the left panel, locate and delete the key:
     LocalServer32
141. Again Still in the left panel, locate and delete the key:
     TypeLib
142. Again Still in the left panel, locate and delete the key:
     PCProxy.ProxyChecks.1
143. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>PCProxy.ProxyChecks.1
144. Still in the left panel, locate and delete the key:
     CLSID
145. Again Still in the left panel, locate and delete the key:
     PCProxy.ProxyChecks
146. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>PCProxy.ProxyChecks
147. Still in the left panel, locate and delete the key:
     CLSID
148. Again Still in the left panel, locate and delete the key:
     CurVer
149. Again Still in the left panel, locate and delete the key:
     {74137531-80F7-406F-9543-7D11385FA8C8}
150. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{74137531-80F7-406F-9543-7D11385FA8C8}
151. Still in the left panel, locate and delete the key:
     ProgID
152. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
153. Again Still in the left panel, locate and delete the key:
     Programmable
154. Again Still in the left panel, locate and delete the key:
     LocalServer32
155. Again Still in the left panel, locate and delete the key:
     TypeLib
156. Again Still in the left panel, locate and delete the key:
     PCProxy.DataStatistics.1
157. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>PCProxy.DataStatistics.1
158. Still in the left panel, locate and delete the key:
     CLSID
159. Again Still in the left panel, locate and delete the key:
     PCProxy.DataStatistics
160. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>PCProxy.DataStatistics
161. Still in the left panel, locate and delete the key:
     CLSID
162. Again Still in the left panel, locate and delete the key:
     CurVer
163. Again Still in the left panel, locate and delete the key:
     {832599B2-55BF-4437-8F3E-030CF5AEB262}
164. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{832599B2-55BF-4437-8F3E-030CF5AEB262}
165. Still in the left panel, locate and delete the key:
     ProgID
166. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
167. Again Still in the left panel, locate and delete the key:
     Programmable
168. Again Still in the left panel, locate and delete the key:
     LocalServer32
169. Again Still in the left panel, locate and delete the key:
     TypeLib
170. Again Still in the left panel, locate and delete the key:
     PCProxy.ReadOnlyManager.1
171. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>PCProxy.ReadOnlyManager.1
172. Still in the left panel, locate and delete the key:
     CLSID
173. Again Still in the left panel, locate and delete the key:
     PCProxy.ReadOnlyManager
174. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>PCProxy.ReadOnlyManager
175. Still in the left panel, locate and delete the key:
     CLSID
176. Again Still in the left panel, locate and delete the key:
     CurVer
177. Again Still in the left panel, locate and delete the key:
     {F62A4AF9-58B4-4FEC-89CC-D717A547D8E8}
178. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{F62A4AF9-58B4-4FEC-89CC-D717A547D8E8}
179. Still in the left panel, locate and delete the key:
     ProgID
180. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
181. Again Still in the left panel, locate and delete the key:
     Programmable
182. Again Still in the left panel, locate and delete the key:
     LocalServer32
183. Again Still in the left panel, locate and delete the key:
     TypeLib
184. Again Still in the left panel, locate and delete the key:
     {ED721A76-8160-4DA0-A18E-7FD7C4574774}
185. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{ED721A76-8160-4DA0-A18E-7FD7C4574774}
186. Still in the left panel, locate and delete the key:
     1.0
187. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{ED721A76-8160-4DA0-A18E-7FD7C4574774}>1.0
188. Still in the left panel, locate and delete the key:
     FLAGS
189. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{ED721A76-8160-4DA0-A18E-7FD7C4574774}>1.0>0
190. Still in the left panel, locate and delete the key:
     win32
191. Again Still in the left panel, locate and delete the key:
     HELPDIR
192. Again Still in the left panel, locate and delete the key:
     {23C5311E-016D-4999-BCB1-499898429D6C}
193. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{23C5311E-016D-4999-BCB1-499898429D6C}
194. Still in the left panel, locate and delete the key:
     ProxyStubClsid
195. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
196. Again Still in the left panel, locate and delete the key:
     TypeLib
197. Again Still in the left panel, locate and delete the key:
     {4E9EB4D5-C929-4005-AC62-1856B1DA5A24}
198. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{4E9EB4D5-C929-4005-AC62-1856B1DA5A24}
199. Still in the left panel, locate and delete the key:
     ProxyStubClsid
200. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
201. Again Still in the left panel, locate and delete the key:
     TypeLib
202. Again Still in the left panel, locate and delete the key:
     {2D9DB233-DC4B-4677-946C-5FA5ABCF506B}
203. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{2D9DB233-DC4B-4677-946C-5FA5ABCF506B}
204. Still in the left panel, locate and delete the key:
     ProxyStubClsid
205. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
206. Again Still in the left panel, locate and delete the key:
     TypeLib
207. Again Still in the left panel, locate and delete the key:
     {2C4B6DB8-6413-403B-A038-16A352CFE8B9}
208. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{2C4B6DB8-6413-403B-A038-16A352CFE8B9}
209. Still in the left panel, locate and delete the key:
     ProxyStubClsid
210. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
211. Again Still in the left panel, locate and delete the key:
     TypeLib
212. Again Still in the left panel, locate and delete the key:
     {C97AF157-6A27-4F57-9D47-E2D3E4761B77}
213. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C97AF157-6A27-4F57-9D47-E2D3E4761B77}
214. Still in the left panel, locate and delete the key:
     ProxyStubClsid
215. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
216. Again Still in the left panel, locate and delete the key:
     TypeLib
217. Again Still in the left panel, locate and delete the key:
     {22511E2E-7970-414E-BC7C-28D16C4AF54D}
218. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{22511E2E-7970-414E-BC7C-28D16C4AF54D}
219. Still in the left panel, locate and delete the key:
     ProxyStubClsid
220. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
221. Again Still in the left panel, locate and delete the key:
     TypeLib
222. Again Still in the left panel, locate and delete the key:
     {5180FE16-2E09-497B-9C8B-5A6F029ECECB}
223. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{5180FE16-2E09-497B-9C8B-5A6F029ECECB}
224. Still in the left panel, locate and delete the key:
     ProxyStubClsid
225. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
226. Again Still in the left panel, locate and delete the key:
     TypeLib
227. Again Still in the left panel, locate and delete the key:
     {ED0D2C81-7DB5-4599-B7C0-1033418B5672}
228. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{ED0D2C81-7DB5-4599-B7C0-1033418B5672}
229. Still in the left panel, locate and delete the key:
     ProxyStubClsid
230. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
231. Again Still in the left panel, locate and delete the key:
     TypeLib
232. Again Still in the left panel, locate and delete the key:
     {46803190-228D-470E-90FE-F5E0CEA9C4F2}
233. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{46803190-228D-470E-90FE-F5E0CEA9C4F2}
234. Still in the left panel, locate and delete the key:
     ProxyStubClsid
235. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
236. Again Still in the left panel, locate and delete the key:
     TypeLib
237. Again Still in the left panel, locate and delete the key:
     {A4F6E1B3-469E-46EF-A936-FBA9D5EFD2B9}
238. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A4F6E1B3-469E-46EF-A936-FBA9D5EFD2B9}
239. Still in the left panel, locate and delete the key:
     ProxyStubClsid
240. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
241. Again Still in the left panel, locate and delete the key:
     TypeLib
242. Again Still in the left panel, locate and delete the key:
     {0FCE4F01-64EC-42F1-83E1-1E08D38605D2}
243. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{0FCE4F01-64EC-42F1-83E1-1E08D38605D2}
244. Still in the left panel, locate and delete the key:
     ProxyStubClsid
245. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
246. Again Still in the left panel, locate and delete the key:
     TypeLib
247. Again Still in the left panel, locate and delete the key:
     {1A2A195A-A0F9-4006-AF02-3F05EEFDE792}
248. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{1A2A195A-A0F9-4006-AF02-3F05EEFDE792}
249. Still in the left panel, locate and delete the key:
     ProxyStubClsid
250. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
251. Again Still in the left panel, locate and delete the key:
     TypeLib
252. Again Still in the left panel, locate and delete the key:
     {3AE76A17-C344-4A83-81CE-65EFEE41E42D}
253. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{3AE76A17-C344-4A83-81CE-65EFEE41E42D}
254. Still in the left panel, locate and delete the key:
     ProxyStubClsid
255. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
256. Again Still in the left panel, locate and delete the key:
     TypeLib
257. Again Still in the left panel, locate and delete the key:
     {C1F5E799-B218-4C32-B189-3C389BA140BB}
258. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C1F5E799-B218-4C32-B189-3C389BA140BB}
259. Still in the left panel, locate and delete the key:
     ProxyStubClsid
260. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
261. Again Still in the left panel, locate and delete the key:
     TypeLib
262. Again Still in the left panel, locate and delete the key:
     {8FAF962C-3EDE-405E-B1D0-62B8235C6044}
263. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{8FAF962C-3EDE-405E-B1D0-62B8235C6044}
264. Still in the left panel, locate and delete the key:
     ProxyStubClsid
265. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
266. Again Still in the left panel, locate and delete the key:
     TypeLib
267. Again Still in the left panel, locate and delete the key:
     {F60C9408-3110-4C98-A139-ABE1EE1111DD}
268. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{F60C9408-3110-4C98-A139-ABE1EE1111DD}
269. Still in the left panel, locate and delete the key:
     ProxyStubClsid
270. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
271. Again Still in the left panel, locate and delete the key:
     TypeLib
272. Again Still in the left panel, locate and delete the key:
     {4C0A69B0-CE97-42B7-86FC-08280C99C74D}
273. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{4C0A69B0-CE97-42B7-86FC-08280C99C74D}
274. Still in the left panel, locate and delete the key:
     ProxyStubClsid
275. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
276. Again Still in the left panel, locate and delete the key:
     TypeLib
277. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Run
3. In the right panel, locate and delete the entry:
   b81ad8ae9d0103ee44c3b8a3e445b627 = "%User Temp%\iexplorer.exe .."
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Run
5. In the right panel, locate and delete the entry:
   b81ad8ae9d0103ee44c3b8a3e445b627 = "%User Temp%\iexplorer.exe .."
6. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>WinRAR SFX
7. In the right panel, locate and delete the entry:
   C%%Windows = "%Windows%"
8. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>b81ad8ae9d0103ee44c3b8a3e445b627
9. In the right panel, locate and delete the entry:
   US = "@"
10. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Environment
11. In the right panel, locate and delete the entry:
    SEE_MASK_NOZONECHECKS = "1"
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>SAFEIP_is1
13. In the right panel, locate and delete the entry:
    Inno Setup: Setup Version = "5.5.3 (u)"
14. Again In the right panel, locate and delete the entry:
    Inno Setup: App Path = "%Program Files%\SafeIP"
15. Again In the right panel, locate and delete the entry:
    InstallLocation = "%Program Files%\SafeIP"
16. Again In the right panel, locate and delete the entry:
    Inno Setup: Icon Group = "SafeIP"
17. Again In the right panel, locate and delete the entry:
    Inno Setup: User = "Wilbert"
18. Again In the right panel, locate and delete the entry:
    Inno Setup: Selected Tasks = "desktopshortcut,quicklaunchicon"
19. Again In the right panel, locate and delete the entry:
    Inno Setup: Language = "en"
20. Again In the right panel, locate and delete the entry:
    DisplayName = "SafeIP"
21. Again In the right panel, locate and delete the entry:
    DisplayIcon = "%Program Files%\SafeIP\SafeIP.exe"
22. Again In the right panel, locate and delete the entry:
    UninstallString = "%Program Files%\SafeIP\unins000.exe "
23. Again In the right panel, locate and delete the entry:
    QuietUninstallString = "%Program Files%\SafeIP\unins000.exe /SILENT"
24. Again In the right panel, locate and delete the entry:
    Publisher = "SafeIP"
25. Again In the right panel, locate and delete the entry:
    URLInfoAbout = "http://www.{BLOCKED}feip.com"
26. Again In the right panel, locate and delete the entry:
    NoModify = "1"
27. Again In the right panel, locate and delete the entry:
    NoRepair = "1"
28. Again In the right panel, locate and delete the entry:
    InstallDate = "20140219"
29. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SYSTEM>ControlSet001>Services>SharedAccess>Parameters>FirewallPolicy>StandardProfile>AuthorizedApplications>List
30. In the right panel, locate and delete the entry:
    %User Temp%\iexplorer.exe = "%User Temp%\iexplorer.exe:*:Enabled:iexplorer.exe"
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{7CEF2F64-717E-4BE6-A817-8B7E2BEDF86F}>InprocServer32
32. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
33. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{BC4411BC-3AB1-488B-8CAE-0FA6CC8E9CC8}>TypeLib
34. In the right panel, locate and delete the entry:
    Version = "1.0"
35. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{D0D03945-E60C-4DF1-A45E-EED11F95A624}>TypeLib
36. In the right panel, locate and delete the entry:
    Version = "1.0"
37. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>SafeIP
38. In the right panel, locate and delete the entry:
    Balloon = "1"
39. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>SafeIPS.exe
40. In the right panel, locate and delete the entry:
    AppID = "{9DC8FA51-B596-4f77-802C-5B295919C205}"
41. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>{9DC8FA51-B596-4f77-802C-5B295919C205}
42. In the right panel, locate and delete the entry:
    InstallingUser = "YwB3AHMAMAA4AGUAeAAwADMAXAB3AGkAbABiAGUAcgB0AAAA"
43. Again In the right panel, locate and delete the entry:
    LocalService = "SafeIPS"
44. Again In the right panel, locate and delete the entry:
    ServiceParameters = "-Service"
45. Again In the right panel, locate and delete the entry:
    KomodiaParameters1 = "0"
46. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{6EEBC7FF-67DA-4B90-9251-C2C5696E4B48}
47. In the right panel, locate and delete the entry:
    AppID = "{9DC8FA51-B596-4f77-802C-5B295919C205}"
48. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{3E28F712-0D6C-4EE3-AC8C-8F060F5D7C33}
49. In the right panel, locate and delete the entry:
    AppID = "{9DC8FA51-B596-4f77-802C-5B295919C205}"
50. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{DD67706E-819E-4EBD-BF8D-6D6147CC7A49}
51. In the right panel, locate and delete the entry:
    AppID = "{9DC8FA51-B596-4f77-802C-5B295919C205}"
52. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B1A429DB-FB06-4645-B7C0-0CC405EAD3CD}
53. In the right panel, locate and delete the entry:
    AppID = "{9DC8FA51-B596-4f77-802C-5B295919C205}"
54. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{533403E2-6E21-4615-9E28-43F4E97E977B}
55. In the right panel, locate and delete the entry:
    AppID = "{9DC8FA51-B596-4f77-802C-5B295919C205}"
56. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{6CE321DA-DC11-45C6-A0FC-4E8A7D978ABC}
57. In the right panel, locate and delete the entry:
    AppID = "{9DC8FA51-B596-4f77-802C-5B295919C205}"
58. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{74137531-80F7-406F-9543-7D11385FA8C8}
59. In the right panel, locate and delete the entry:
    AppID = "{9DC8FA51-B596-4f77-802C-5B295919C205}"
60. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{832599B2-55BF-4437-8F3E-030CF5AEB262}
61. In the right panel, locate and delete the entry:
    AppID = "{9DC8FA51-B596-4f77-802C-5B295919C205}"
62. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{F62A4AF9-58B4-4FEC-89CC-D717A547D8E8}
63. In the right panel, locate and delete the entry:
    AppID = "{9DC8FA51-B596-4f77-802C-5B295919C205}"
64. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{23C5311E-016D-4999-BCB1-499898429D6C}>TypeLib
65. In the right panel, locate and delete the entry:
    Version = "1.0"
66. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{4E9EB4D5-C929-4005-AC62-1856B1DA5A24}>TypeLib
67. In the right panel, locate and delete the entry:
    Version = "1.0"
68. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{2D9DB233-DC4B-4677-946C-5FA5ABCF506B}>TypeLib
69. In the right panel, locate and delete the entry:
    Version = "1.0"
70. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{2C4B6DB8-6413-403B-A038-16A352CFE8B9}>TypeLib
71. In the right panel, locate and delete the entry:
    Version = "1.0"
72. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C97AF157-6A27-4F57-9D47-E2D3E4761B77}>TypeLib
73. In the right panel, locate and delete the entry:
    Version = "1.0"
74. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{22511E2E-7970-414E-BC7C-28D16C4AF54D}>TypeLib
75. In the right panel, locate and delete the entry:
    Version = "1.0"
76. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{5180FE16-2E09-497B-9C8B-5A6F029ECECB}>TypeLib
77. In the right panel, locate and delete the entry:
    Version = "1.0"
78. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{ED0D2C81-7DB5-4599-B7C0-1033418B5672}>TypeLib
79. In the right panel, locate and delete the entry:
    Version = "1.0"
80. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{46803190-228D-470E-90FE-F5E0CEA9C4F2}>TypeLib
81. In the right panel, locate and delete the entry:
    Version = "1.0"
82. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{A4F6E1B3-469E-46EF-A936-FBA9D5EFD2B9}>TypeLib
83. In the right panel, locate and delete the entry:
    Version = "1.0"
84. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{0FCE4F01-64EC-42F1-83E1-1E08D38605D2}>TypeLib
85. In the right panel, locate and delete the entry:
    Version = "1.0"
86. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{1A2A195A-A0F9-4006-AF02-3F05EEFDE792}>TypeLib
87. In the right panel, locate and delete the entry:
    Version = "1.0"
88. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{3AE76A17-C344-4A83-81CE-65EFEE41E42D}>TypeLib
89. In the right panel, locate and delete the entry:
    Version = "1.0"
90. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{C1F5E799-B218-4C32-B189-3C389BA140BB}>TypeLib
91. In the right panel, locate and delete the entry:
    Version = "1.0"
92. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{8FAF962C-3EDE-405E-B1D0-62B8235C6044}>TypeLib
93. In the right panel, locate and delete the entry:
    Version = "1.0"
94. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{F60C9408-3110-4C98-A139-ABE1EE1111DD}>TypeLib
95. In the right panel, locate and delete the entry:
    Version = "1.0"
96. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{4C0A69B0-CE97-42B7-86FC-08280C99C74D}>TypeLib
97. In the right panel, locate and delete the entry:
    Version = "1.0"
98. Close Registry Editor.

To restore registry values this malware/grayware modified:

1. Open Registry Editor. To do this:
   
   • On Windows 2000, XP, and Server 2003:
     Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
   • On Windows Vista and 7:
     Click the Start button, type REGEDIT in the Search input field then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>RFC1156Agent>CurrentVersion>Parameters
3. In the right panel, locate the registry value:
   TrapPollTimeMilliSecs = "3a98"
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   TrapPollTimeMilliSecs = "3a98"
5. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • __tmp_rar_sfx_access_check_89656
   • setup.exe
   • SafeIP.exe
   • %User Temp%\is-5LABN.tmp\SafeIP.tmp
   • %User Temp%\is-V7U2S.tmp\_isetup\_shfoldr.dll
   • %Program Files%\SafeIP\unins000.dat
   • %Program Files%\SafeIP\is-45KKK.tmp
   • %Program Files%\SafeIP\flags\is-60AEJ.tmp
   • %Program Files%\SafeIP\flags\is-NDOMM.tmp
   • %Program Files%\SafeIP\flags\is-37DUC.tmp
   • %Program Files%\SafeIP\flags\is-6V610.tmp
   • %Program Files%\SafeIP\flags\is-JFBRD.tmp
   • %Program Files%\SafeIP\flags\is-1KK1L.tmp
   • %Program Files%\SafeIP\flags\is-7USC5.tmp
   • %Program Files%\SafeIP\flags\is-3LAP0.tmp
   • %Program Files%\SafeIP\flags\is-RLIIC.tmp
   • %Program Files%\SafeIP\flags\is-480FK.tmp
   • %Program Files%\SafeIP\flags\is-B0GP1.tmp
   • %Program Files%\SafeIP\flags\is-E7VSC.tmp
   • %Program Files%\SafeIP\flags\is-RA7IB.tmp
   • %Program Files%\SafeIP\flags\is-2J2QC.tmp
   • %Program Files%\SafeIP\flags\is-NLR5O.tmp
   • %Program Files%\SafeIP\flags\is-RVDET.tmp
   • %Program Files%\SafeIP\flags\is-4IBE0.tmp
   • %Program Files%\SafeIP\flags\is-MPLVK.tmp
   • %Program Files%\SafeIP\flags\is-57Q71.tmp
   • %Program Files%\SafeIP\flags\is-0L4OB.tmp
   • %Program Files%\SafeIP\flags\is-FDCC3.tmp
   • %Program Files%\SafeIP\flags\is-PNP15.tmp
   • %Program Files%\SafeIP\flags\is-CS15L.tmp
   • %Program Files%\SafeIP\flags\is-25U4D.tmp
   • %Program Files%\SafeIP\flags\is-PES7D.tmp
   • %Program Files%\SafeIP\flags\is-O1T4M.tmp
   • %Program Files%\SafeIP\flags\is-0MTUB.tmp
   • %Program Files%\SafeIP\flags\is-HSN2R.tmp
   • %Program Files%\SafeIP\flags\is-2L6EL.tmp
   • %Program Files%\SafeIP\flags\is-NMJJV.tmp
   • %Program Files%\SafeIP\flags\is-LIV1R.tmp
   • %Program Files%\SafeIP\is-36G7E.tmp
   • %Program Files%\SafeIP\is-SD64K.tmp
   • %Program Files%\SafeIP\is-PGRSQ.tmp
   • %Program Files%\SafeIP\is-OSPKU.tmp
   • %Program Files%\SafeIP\is-UVB9T.tmp
   • %Program Files%\SafeIP\is-8IS01.tmp
   • %Program Files%\SafeIP\is-ABHGS.tmp
   • %Program Files%\SafeIP\is-K4FGC.tmp
   • %Program Files%\SafeIP\is-R8961.tmp
   • %Program Files%\SafeIP\is-DV4BL.tmp
   • %Program Files%\SafeIP\is-V5Q60.tmp
   • %Program Files%\SafeIP\is-7JL0S.tmp
   • %Program Files%\SafeIP\is-6M7RI.tmp
   • %Program Files%\SafeIP\is-FID67.tmp
   • %Program Files%\SafeIP\is-VOJLR.tmp
   • %Program Files%\SafeIP\is-DON77.tmp
   • %Program Files%\SafeIP\is-VA0E7.tmp
   • %Program Files%\SafeIP\is-SCC2G.tmp
   • %User Temp%\is-V7U2S.tmp\is-BD1U8.tmp
   • %Desktop%\SafeIP.lnk
   • %User Profile%\Quick Launch\SafeIP.lnk
   • %Start Menu%\Programs\SafeIP\SafeIP.lnk
   • %Start Menu%\Programs\SafeIP\SafeIP Website.lnk
   • %Start Menu%\Programs\SafeIP\User Guide.lnk
   • %Start Menu%\Programs\SafeIP\Uninstall SafeIP.lnk
   • %User Temp%\iexplorer.exe.tmp
   • %User Temp%\SpOrder.dll
   • %User Temp%\iexplorer.exe
   • %User Startup%\b81ad8ae9d0103ee44c3b8a3e445b627.exe
   • %System%\SafeIPs.dll
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • __tmp_rar_sfx_access_check_89656
   • setup.exe
   • SafeIP.exe
   • %User Temp%\is-5LABN.tmp\SafeIP.tmp
   • %User Temp%\is-V7U2S.tmp\_isetup\_shfoldr.dll
   • %Program Files%\SafeIP\unins000.dat
   • %Program Files%\SafeIP\is-45KKK.tmp
   • %Program Files%\SafeIP\flags\is-60AEJ.tmp
   • %Program Files%\SafeIP\flags\is-NDOMM.tmp
   • %Program Files%\SafeIP\flags\is-37DUC.tmp
   • %Program Files%\SafeIP\flags\is-6V610.tmp
   • %Program Files%\SafeIP\flags\is-JFBRD.tmp
   • %Program Files%\SafeIP\flags\is-1KK1L.tmp
   • %Program Files%\SafeIP\flags\is-7USC5.tmp
   • %Program Files%\SafeIP\flags\is-3LAP0.tmp
   • %Program Files%\SafeIP\flags\is-RLIIC.tmp
   • %Program Files%\SafeIP\flags\is-480FK.tmp
   • %Program Files%\SafeIP\flags\is-B0GP1.tmp
   • %Program Files%\SafeIP\flags\is-E7VSC.tmp
   • %Program Files%\SafeIP\flags\is-RA7IB.tmp
   • %Program Files%\SafeIP\flags\is-2J2QC.tmp
   • %Program Files%\SafeIP\flags\is-NLR5O.tmp
   • %Program Files%\SafeIP\flags\is-RVDET.tmp
   • %Program Files%\SafeIP\flags\is-4IBE0.tmp
   • %Program Files%\SafeIP\flags\is-MPLVK.tmp
   • %Program Files%\SafeIP\flags\is-57Q71.tmp
   • %Program Files%\SafeIP\flags\is-0L4OB.tmp
   • %Program Files%\SafeIP\flags\is-FDCC3.tmp
   • %Program Files%\SafeIP\flags\is-PNP15.tmp
   • %Program Files%\SafeIP\flags\is-CS15L.tmp
   • %Program Files%\SafeIP\flags\is-25U4D.tmp
   • %Program Files%\SafeIP\flags\is-PES7D.tmp
   • %Program Files%\SafeIP\flags\is-O1T4M.tmp
   • %Program Files%\SafeIP\flags\is-0MTUB.tmp
   • %Program Files%\SafeIP\flags\is-HSN2R.tmp
   • %Program Files%\SafeIP\flags\is-2L6EL.tmp
   • %Program Files%\SafeIP\flags\is-NMJJV.tmp
   • %Program Files%\SafeIP\flags\is-LIV1R.tmp
   • %Program Files%\SafeIP\is-36G7E.tmp
   • %Program Files%\SafeIP\is-SD64K.tmp
   • %Program Files%\SafeIP\is-PGRSQ.tmp
   • %Program Files%\SafeIP\is-OSPKU.tmp
   • %Program Files%\SafeIP\is-UVB9T.tmp
   • %Program Files%\SafeIP\is-8IS01.tmp
   • %Program Files%\SafeIP\is-ABHGS.tmp
   • %Program Files%\SafeIP\is-K4FGC.tmp
   • %Program Files%\SafeIP\is-R8961.tmp
   • %Program Files%\SafeIP\is-DV4BL.tmp
   • %Program Files%\SafeIP\is-V5Q60.tmp
   • %Program Files%\SafeIP\is-7JL0S.tmp
   • %Program Files%\SafeIP\is-6M7RI.tmp
   • %Program Files%\SafeIP\is-FID67.tmp
   • %Program Files%\SafeIP\is-VOJLR.tmp
   • %Program Files%\SafeIP\is-DON77.tmp
   • %Program Files%\SafeIP\is-VA0E7.tmp
   • %Program Files%\SafeIP\is-SCC2G.tmp
   • %User Temp%\is-V7U2S.tmp\is-BD1U8.tmp
   • %Desktop%\SafeIP.lnk
   • %User Profile%\Quick Launch\SafeIP.lnk
   • %Start Menu%\Programs\SafeIP\SafeIP.lnk
   • %Start Menu%\Programs\SafeIP\SafeIP Website.lnk
   • %Start Menu%\Programs\SafeIP\User Guide.lnk
   • %Start Menu%\Programs\SafeIP\Uninstall SafeIP.lnk
   • %User Temp%\iexplorer.exe.tmp
   • %User Temp%\SpOrder.dll
   • %User Temp%\iexplorer.exe
   • %User Startup%\b81ad8ae9d0103ee44c3b8a3e445b627.exe
   • %System%\SafeIPs.dll
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %User Temp%\is-5LABN.tmp
   • %User Temp%\is-V7U2S.tmp
   • %User Temp%\is-V7U2S.tmp\_isetup
   • %Program Files%\SafeIP
   • %Program Files%\SafeIP\flags
   • %Start Menu%\Programs\SafeIP
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %User Temp%\is-5LABN.tmp
   • %User Temp%\is-V7U2S.tmp
   • %User Temp%\is-V7U2S.tmp\_isetup
   • %Program Files%\SafeIP
   • %Program Files%\SafeIP\flags
   • %Start Menu%\Programs\SafeIP