PE_LOOKED.JOD

To enable Registry Editor, Task Manager, and Folder options:

1. Open Notepad. To do this:
   
   • For Windows 2000, XP, and Server 2003 users:
     Click Start>Run, type Notepad in the text box provided, then press Enter.
   • For Windows Vista and 7 users:
     Click start. Type Notepad , then press Enter.
2. Copy and paste the following script:
   On Error Resume Next Set shl = WScript.CreateObject("WScript.Shell") shl.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools" shl.RegDelete "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools" shl.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr" shl.RegDelete "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr" shl.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions" shl.RegDelete "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions"
3. Save this file as C:\RESTORE.VBS.
4. Click Start>Run again, type C:\RESTORE.VBS in the text box provided, then press Enter.
5. Click Yes at the prompt of the message box to execute the .VBS file.

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Policies
3. Still in the left panel, locate and delete the key:
   System
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>360rpt.exe
5. Still in the left panel, locate and delete the key:
   Debugger
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>360Safe.exe
7. Still in the left panel, locate and delete the key:
   Debugger
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>360tray.exe
9. Still in the left panel, locate and delete the key:
   Debugger
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>adam.exe
11. Still in the left panel, locate and delete the key:
    Debugger
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>AgentSvr.exe
13. Still in the left panel, locate and delete the key:
    Debugger
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>AppSvc32.exe
15. Still in the left panel, locate and delete the key:
    Debugger
16. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>autoruns.exe
17. Still in the left panel, locate and delete the key:
    Debugger
18. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>avgrssvc.exe
19. Still in the left panel, locate and delete the key:
    Debugger
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>AvMonitor.exe
21. Still in the left panel, locate and delete the key:
    Debugger
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>avp.com
23. Still in the left panel, locate and delete the key:
    Debugger
24. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>avp.exe
25. Still in the left panel, locate and delete the key:
    Debugger
26. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>CCenter.exe
27. Still in the left panel, locate and delete the key:
    Debugger
28. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>ccSvcHst.exe
29. Still in the left panel, locate and delete the key:
    Debugger
30. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>FileDsty.exe
31. Still in the left panel, locate and delete the key:
    Debugger
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>FTCleanerShell.exe
33. Still in the left panel, locate and delete the key:
    Debugger
34. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>HijackThis.exe
35. Still in the left panel, locate and delete the key:
    Debugger
36. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>IceSword.exe
37. Still in the left panel, locate and delete the key:
    Debugger
38. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>iparmo.exe
39. Still in the left panel, locate and delete the key:
    Debugger
40. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>Iparmor.exe
41. Still in the left panel, locate and delete the key:
    Debugger
42. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>isPwdSvc.exe
43. Still in the left panel, locate and delete the key:
    Debugger
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>kabaload.exe
45. Still in the left panel, locate and delete the key:
    Debugger
46. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KaScrScn.SCR
47. Still in the left panel, locate and delete the key:
    Debugger
48. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KASMain.exe
49. Still in the left panel, locate and delete the key:
    Debugger
50. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KASTask.exe
51. Still in the left panel, locate and delete the key:
    Debugger
52. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KAV32.exe
53. Still in the left panel, locate and delete the key:
    Debugger
54. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KAVDX.exe
55. Still in the left panel, locate and delete the key:
    Debugger
56. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KAVPFW.exe
57. Still in the left panel, locate and delete the key:
    Debugger
58. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KAVSetup.exe
59. Still in the left panel, locate and delete the key:
    Debugger
60. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KAVStart.exe
61. Still in the left panel, locate and delete the key:
    Debugger
62. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KISLnchr.exe
63. Still in the left panel, locate and delete the key:
    Debugger
64. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KMailMon.exe
65. Still in the left panel, locate and delete the key:
    Debugger
66. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KMFilter.exe
67. Still in the left panel, locate and delete the key:
    Debugger
68. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KPFW32.exe
69. Still in the left panel, locate and delete the key:
    Debugger
70. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KPFW32X.exe
71. Still in the left panel, locate and delete the key:
    Debugger
72. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KPFWSvc.exe
73. Still in the left panel, locate and delete the key:
    Debugger
74. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KRegEx.exe
75. Still in the left panel, locate and delete the key:
    Debugger
76. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>krepair.COM
77. Still in the left panel, locate and delete the key:
    Debugger
78. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KsLoader.exe
79. Still in the left panel, locate and delete the key:
    Debugger
80. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KVCenter.kxp
81. Still in the left panel, locate and delete the key:
    Debugger
82. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KvDetect.exe
83. Still in the left panel, locate and delete the key:
    Debugger
84. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KvfwMcl.exe
85. Still in the left panel, locate and delete the key:
    Debugger
86. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KVMonXP.kxp
87. Still in the left panel, locate and delete the key:
    Debugger
88. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KVMonXP_1.kxp
89. Still in the left panel, locate and delete the key:
    Debugger
90. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>kvol.exe
91. Still in the left panel, locate and delete the key:
    Debugger
92. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>kvolself.exe
93. Still in the left panel, locate and delete the key:
    Debugger
94. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KvReport.kxp
95. Still in the left panel, locate and delete the key:
    Debugger
96. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KVScan.kxp
97. Still in the left panel, locate and delete the key:
    Debugger
98. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KVSrvXP.exe
99. Still in the left panel, locate and delete the key:
    Debugger
100. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KVStub.kxp
101. Still in the left panel, locate and delete the key:
     Debugger
102. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>kvupload.exe
103. Still in the left panel, locate and delete the key:
     Debugger
104. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>kvwsc.exe
105. Still in the left panel, locate and delete the key:
     Debugger
106. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KvXP.kxp
107. Still in the left panel, locate and delete the key:
     Debugger
108. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KvXP_1.kxp
109. Still in the left panel, locate and delete the key:
     Debugger
110. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KWatch.exe
111. Still in the left panel, locate and delete the key:
     Debugger
112. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KWatch9x.exe
113. Still in the left panel, locate and delete the key:
     Debugger
114. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KWatchX.exe
115. Still in the left panel, locate and delete the key:
     Debugger
116. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>loaddll.exe
117. Still in the left panel, locate and delete the key:
     Debugger
118. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>MagicSet.exe
119. Still in the left panel, locate and delete the key:
     Debugger
120. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>mcconsol.exe
121. Still in the left panel, locate and delete the key:
     Debugger
122. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>mmqczj.exe
123. Still in the left panel, locate and delete the key:
     Debugger
124. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>mmsk.exe
125. Still in the left panel, locate and delete the key:
     Debugger
126. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>NAVSetup.exe
127. Still in the left panel, locate and delete the key:
     Debugger
128. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>nod32krn.exe
129. Still in the left panel, locate and delete the key:
     Debugger
130. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>nod32kui.exe
131. Still in the left panel, locate and delete the key:
     Debugger
132. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>PFW.exe
133. Still in the left panel, locate and delete the key:
     Debugger
134. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>PFWLiveUpdate.exe
135. Still in the left panel, locate and delete the key:
     Debugger
136. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>QHSET.exe
137. Still in the left panel, locate and delete the key:
     Debugger
138. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>Ras.exe
139. Still in the left panel, locate and delete the key:
     Debugger
140. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>Rav.exe
141. Still in the left panel, locate and delete the key:
     Debugger
142. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>RavMon.exe
143. Still in the left panel, locate and delete the key:
     Debugger
144. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>RavMonD.exe
145. Still in the left panel, locate and delete the key:
     Debugger
146. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>RavStub.exe
147. Still in the left panel, locate and delete the key:
     Debugger
148. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>RavTask.exe
149. Still in the left panel, locate and delete the key:
     Debugger
150. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>RegClean.exe
151. Still in the left panel, locate and delete the key:
     Debugger
152. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>rfwcfg.exe
153. Still in the left panel, locate and delete the key:
     Debugger
154. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>RfwMain.exe
155. Still in the left panel, locate and delete the key:
     Debugger
156. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>rfwProxy.exe
157. Still in the left panel, locate and delete the key:
     Debugger
158. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>rfwsrv.exe
159. Still in the left panel, locate and delete the key:
     Debugger
160. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>RsAgent.exe
161. Still in the left panel, locate and delete the key:
     Debugger
162. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>Rsaupd.exe
163. Still in the left panel, locate and delete the key:
     Debugger
164. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>runiep.exe
165. Still in the left panel, locate and delete the key:
     Debugger
166. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>safelive.exe
167. Still in the left panel, locate and delete the key:
     Debugger
168. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>scan32.exe
169. Still in the left panel, locate and delete the key:
     Debugger
170. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>shcfg32.exe
171. Still in the left panel, locate and delete the key:
     Debugger
172. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>SmartUp.exe
173. Still in the left panel, locate and delete the key:
     Debugger
174. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>SREng.exe
175. Still in the left panel, locate and delete the key:
     Debugger
176. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>symlcsvc.exe
177. Still in the left panel, locate and delete the key:
     Debugger
178. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>SysSafe.exe
179. Still in the left panel, locate and delete the key:
     Debugger
180. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>TrojanDetector.exe
181. Still in the left panel, locate and delete the key:
     Debugger
182. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>Trojanwall.exe
183. Still in the left panel, locate and delete the key:
     Debugger
184. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>TrojDie.kxp
185. Still in the left panel, locate and delete the key:
     Debugger
186. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>UIHost.exe
187. Still in the left panel, locate and delete the key:
     Debugger
188. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>UmxAgent.exe
189. Still in the left panel, locate and delete the key:
     Debugger
190. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>UmxAttachment.exe
191. Still in the left panel, locate and delete the key:
     Debugger
192. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>UmxCfg.exe
193. Still in the left panel, locate and delete the key:
     Debugger
194. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>UmxFwHlp.exe
195. Still in the left panel, locate and delete the key:
     Debugger
196. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>UmxPol.exe
197. Still in the left panel, locate and delete the key:
     Debugger
198. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>UpLive.EXE.exe
199. Still in the left panel, locate and delete the key:
     Debugger
200. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>WoptiClean.exe
201. Still in the left panel, locate and delete the key:
     Debugger
202. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>zxsweep.exe
203. Still in the left panel, locate and delete the key:
     Debugger
204. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>ghost.exe
205. Still in the left panel, locate and delete the key:
     Debugger
206. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Policies>Microsoft>Windows
207. Still in the left panel, locate and delete the key:
     System
208. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Policies>Microsoft>Windows>System
3. In the right panel, locate and delete the entry:
   DisableCMD = "1"
4. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>Advanced
5. In the right panel, locate and delete the entry:
   ShowSuperHidden = "0"
6. Close Registry Editor.

To restore registry values this malware/grayware modified:

1. Open Registry Editor. To do this:
   
   • On Windows 2000, XP, and Server 2003:
     Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
   • On Windows Vista and 7:
     Click the Start button, type REGEDIT in the Search input field then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Advanced>Folder>Hidden>SHOWALL
3. In the right panel, locate the registry value:
   CheckedValue = "0"
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   CheckedValue = "1"
5. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %User Temp%\E_4\krnln.fnr
   • %User Temp%\temp1.tem
   • %User Temp%\temp2.tem
   • %User Profile%\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9
   • %User Profile%\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9
   • %User Startup%\.lnk
   • %Windows%\HELP2.VBS
   • A:\autorun.inf
   • %System Root%\autorun.inf
   • %User Profile%\{AC76BA86-7AD7-1033-7B44-AA0000000001}\setup.exe
   • %Program Files%\WinPcap\rpcapd.exe
   • %Program Files%\WinPcap\Uninstall.exe
   • %Windows%\IE.exe
   • %Windows%\IE2.exe
   • %Windows%\Installer\{835818DD-220C-4ABD-946E-0D8660B95E29}\ARPPRODUCTICON.exe
   • %System%\icardagt.exe
   • A:\temp2.tem
   • %System Root%\temp2.tem
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %User Temp%\E_4\krnln.fnr
   • %User Temp%\temp1.tem
   • %User Temp%\temp2.tem
   • %User Profile%\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9
   • %User Profile%\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9
   • %User Startup%\.lnk
   • %Windows%\HELP2.VBS
   • A:\autorun.inf
   • %System Root%\autorun.inf
   • %User Profile%\{AC76BA86-7AD7-1033-7B44-AA0000000001}\setup.exe
   • %Program Files%\WinPcap\rpcapd.exe
   • %Program Files%\WinPcap\Uninstall.exe
   • %Windows%\IE.exe
   • %Windows%\IE2.exe
   • %Windows%\Installer\{835818DD-220C-4ABD-946E-0D8660B95E29}\ARPPRODUCTICON.exe
   • %System%\icardagt.exe
   • A:\temp2.tem
   • %System Root%\temp2.tem
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %User Temp%\E_4
   • %User Profile%\CryptnetUrlCache\MetaData
   • %User Profile%\Microsoft\CryptnetUrlCache
   • %User Profile%\CryptnetUrlCache\Content
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %User Temp%\E_4
   • %User Profile%\CryptnetUrlCache\MetaData
   • %User Profile%\Microsoft\CryptnetUrlCache
   • %User Profile%\CryptnetUrlCache\Content