TROJ_DLOADR.BGI

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software
3. Still in the left panel, locate and delete the key:
   Crossrider
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Ext>PreApproved
5. Still in the left panel, locate and delete the key:
   {11111111-1111-1111-1111-110011041135}
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Wow6432Node>Microsoft>Windows>CurrentVersion>Ext>PreApproved
7. Still in the left panel, locate and delete the key:
   {11111111-1111-1111-1111-110011041135}
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Microsoft>Internet Explorer>Low Rights>ElevationPolicy
9. Still in the left panel, locate and delete the key:
   {9a5bfd40-08bc-012f-81b7-073cf1b8f7c6}
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Uninstall
11. Still in the left panel, locate and delete the key:
    Codec-V
12. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Codec-V
13. Still in the left panel, locate and delete the key:
    Installer
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Google>Chrome>Extensions
15. Still in the left panel, locate and delete the key:
    jpnbdefcbnoefmmcpelplabbkfmfhlho
16. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Wow6432Node>Google>Chrome>Extensions
17. Still in the left panel, locate and delete the key:
    jpnbdefcbnoefmmcpelplabbkfmfhlho
18. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT
19. Still in the left panel, locate and delete the key:
    CrossriderApp0000435.Sandbox.1
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CrossriderApp0000435.Sandbox.1
21. Still in the left panel, locate and delete the key:
    CLSID
22. Again Still in the left panel, locate and delete the key:
    CrossriderApp0000435.BHO.1
23. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CrossriderApp0000435.BHO.1
24. Still in the left panel, locate and delete the key:
    CLSID
25. Again Still in the left panel, locate and delete the key:
    CrossriderApp0000435.Sandbox
26. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CrossriderApp0000435.Sandbox
27. Still in the left panel, locate and delete the key:
    CLSID
28. Again Still in the left panel, locate and delete the key:
    CurVer
29. Again Still in the left panel, locate and delete the key:
    CrossriderApp0000435.BHO
30. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CrossriderApp0000435.BHO
31. Still in the left panel, locate and delete the key:
    CLSID
32. Again Still in the left panel, locate and delete the key:
    CurVer
33. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
34. Still in the left panel, locate and delete the key:
    {11111111-1111-1111-1111-110011041135}
35. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{11111111-1111-1111-1111-110011041135}
36. Still in the left panel, locate and delete the key:
    ProgID
37. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
38. Again Still in the left panel, locate and delete the key:
    Programmable
39. Again Still in the left panel, locate and delete the key:
    InprocServer32
40. Again Still in the left panel, locate and delete the key:
    TypeLib
41. Again Still in the left panel, locate and delete the key:
    {22222222-2222-2222-2222-220022042235}
42. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{22222222-2222-2222-2222-220022042235}
43. Still in the left panel, locate and delete the key:
    ProgID
44. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
45. Again Still in the left panel, locate and delete the key:
    Programmable
46. Again Still in the left panel, locate and delete the key:
    InprocServer32
47. Again Still in the left panel, locate and delete the key:
    TypeLib
48. Again Still in the left panel, locate and delete the key:
    CrossriderApp0000435.FBApi.1
49. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CrossriderApp0000435.FBApi.1
50. Still in the left panel, locate and delete the key:
    CLSID
51. Again Still in the left panel, locate and delete the key:
    CrossriderApp0000435.FBApi
52. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CrossriderApp0000435.FBApi
53. Still in the left panel, locate and delete the key:
    CLSID
54. Again Still in the left panel, locate and delete the key:
    CurVer
55. Again Still in the left panel, locate and delete the key:
    {33333333-3333-3333-3333-330033043335}
56. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{33333333-3333-3333-3333-330033043335}
57. Still in the left panel, locate and delete the key:
    ProgID
58. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
59. Again Still in the left panel, locate and delete the key:
    Programmable
60. Again Still in the left panel, locate and delete the key:
    InprocServer32
61. Again Still in the left panel, locate and delete the key:
    TypeLib
62. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
63. Still in the left panel, locate and delete the key:
    {44444444-4444-4444-4444-440044044435}
64. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{44444444-4444-4444-4444-440044044435}
65. Still in the left panel, locate and delete the key:
    1.0
66. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{44444444-4444-4444-4444-440044044435}>1.0
67. Still in the left panel, locate and delete the key:
    FLAGS
68. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{44444444-4444-4444-4444-440044044435}>1.0>0
69. Still in the left panel, locate and delete the key:
    win32
70. Again Still in the left panel, locate and delete the key:
    HELPDIR
71. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
72. Still in the left panel, locate and delete the key:
    {55555555-5555-5555-5555-550055045535}
73. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{55555555-5555-5555-5555-550055045535}
74. Still in the left panel, locate and delete the key:
    ProxyStubClsid
75. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
76. Again Still in the left panel, locate and delete the key:
    TypeLib
77. Again Still in the left panel, locate and delete the key:
    {66666666-6666-6666-6666-660066046635}
78. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{66666666-6666-6666-6666-660066046635}
79. Still in the left panel, locate and delete the key:
    ProxyStubClsid
80. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
81. Again Still in the left panel, locate and delete the key:
    TypeLib
82. Again Still in the left panel, locate and delete the key:
    {77777777-7777-7777-7777-770077047735}
83. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{77777777-7777-7777-7777-770077047735}
84. Still in the left panel, locate and delete the key:
    ProxyStubClsid
85. Again Still in the left panel, locate and delete the key:
    ProxyStubClsid32
86. Again Still in the left panel, locate and delete the key:
    TypeLib
87. Again Still in the left panel, locate and delete the key:
    Log
88. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Crossrider
89. Still in the left panel, locate and delete the key:
    Testing
90. Again Still in the left panel, locate and delete the key:
    Manifest
91. Again Still in the left panel, locate and delete the key:
    Plugins
92. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Codec-V>Plugins
93. Still in the left panel, locate and delete the key:
    13
94. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Crossrider
3. In the right panel, locate and delete the entry:
   Bic = "94CB6609C16C4BFB8AE9E1CF3B86F40EIE"
4. Again In the right panel, locate and delete the entry:
   Verifier = "3ea58d80de3bc3c0ebc20b223f4a3671"
5. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Low Rights>ElevationPolicy>{9a5bfd40-08bc-012f-81b7-073cf1b8f7c6}
6. In the right panel, locate and delete the entry:
   AppName = "Codec-V.exe"
7. Again In the right panel, locate and delete the entry:
   AppPath = "%Program Files%\Codec-V"
8. Again In the right panel, locate and delete the entry:
   Policy = "3"
9. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>Codec-V
10. In the right panel, locate and delete the entry:
    DisplayName = "Codec-V"
11. Again In the right panel, locate and delete the entry:
    DisplayIcon = "%Program Files%\Codec-V\Uninstall.exe"
12. Again In the right panel, locate and delete the entry:
    DisplayVersion = "1.15.149.149"
13. Again In the right panel, locate and delete the entry:
    Publisher = "Premiumplay"
14. Again In the right panel, locate and delete the entry:
    CrPublisherId = "209"
15. Again In the right panel, locate and delete the entry:
    UninstallString = "%Program Files%\Codec-V\Uninstall.exe"
16. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Codec-V>Installer
17. In the right panel, locate and delete the entry:
    srcid = "0"
18. Again In the right panel, locate and delete the entry:
    subid = "0"
19. Again In the right panel, locate and delete the entry:
    zdata = "0"
20. Again In the right panel, locate and delete the entry:
    PlatformVersion = "1"
21. Again In the right panel, locate and delete the entry:
    ScriptVersion = "15"
22. Again In the right panel, locate and delete the entry:
    FullVersion = "1_15_149_149"
23. Again In the right panel, locate and delete the entry:
    Folder = "%Program Files%\Codec-V"
24. Again In the right panel, locate and delete the entry:
    BundledFirefox = "1"
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Google>Chrome>Extensions>jpnbdefcbnoefmmcpelplabbkfmfhlho
26. In the right panel, locate and delete the entry:
    path = "%Application Data%\Codec-V\Chrome\Codec-V.crx"
27. Again In the right panel, locate and delete the entry:
    version = "1.17.48"
28. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Wow6432Node>Google>Chrome>Extensions>jpnbdefcbnoefmmcpelplabbkfmfhlho
29. In the right panel, locate and delete the entry:
    path = "%Application Data%\Codec-V\Chrome\Codec-V.crx"
30. Again In the right panel, locate and delete the entry:
    version = "1.17.48"
31. Again In the right panel, locate and delete the entry:
    BundledChrome = "1"
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{11111111-1111-1111-1111-110011041135}>InprocServer32
33. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
34. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{22222222-2222-2222-2222-220022042235}>InprocServer32
35. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
36. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Browser Helper Objects>{11111111-1111-1111-1111-110011041135}
37. In the right panel, locate and delete the entry:
    NoExplorer = "1"
38. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{33333333-3333-3333-3333-330033043335}>InprocServer32
39. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
40. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{55555555-5555-5555-5555-550055045535}>TypeLib
41. In the right panel, locate and delete the entry:
    Version = "1.0"
42. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{66666666-6666-6666-6666-660066046635}>TypeLib
43. In the right panel, locate and delete the entry:
    Version = "1.0"
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{77777777-7777-7777-7777-770077047735}>TypeLib
45. In the right panel, locate and delete the entry:
    Version = "1.0"
46. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Codec-V>Log
47. In the right panel, locate and delete the entry:
    LogFilesFolder = "%User Profile%\My Documents"
48. Again In the right panel, locate and delete the entry:
    WriteHelperLogFile = "0"
49. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Codec-V
50. In the right panel, locate and delete the entry:
    HelperRunningVersion = "149"
51. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Crossrider>Testing
52. In the right panel, locate and delete the entry:
    IsTesting = "0"
53. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Codec-V>Manifest
54. In the right panel, locate and delete the entry:
    Version = "0"
55. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Codec-V>Plugins
56. In the right panel, locate and delete the entry:
    PluginsManifestVersion = "0"
57. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Codec-V>Plugins>10
58. In the right panel, locate and delete the entry:
    Version = "2"
59. Again In the right panel, locate and delete the entry:
    Name = "app_435_specific"
60. Again In the right panel, locate and delete the entry:
    JavaScript = "{random characters}"
61. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Codec-V>Plugins>13
62. In the right panel, locate and delete the entry:
    Version = "1"
63. Again In the right panel, locate and delete the entry:
    Name = "CrossriderAppUtils"
64. Close Registry Editor.

To restore the registry value this malware/grayware/spyware modified:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>CA>Certificates>189271E573FED295A8C130EAF357A20C4A9F115E
3. In the right panel, locate the registry value:
   Blob = "{random values}"
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   Blob = "{random values}"
5. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4EFCED9C6BDD0C985CA3C7D253063C5BE6FC620C
6. In the right panel, locate the registry value:
   Blob = "{random values}"
7. Right-click on the value name and choose Modify. Change the value data of this entry to:
   Blob = "{random values}"
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4EF2E6670AC9B5091FE06BE0E5483EAAD6BA32D9
9. In the right panel, locate the registry value:
   Blob = "{random values}"
10. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4C95A9902ABE0777CED18D6ACCC3372D2748381E
12. In the right panel, locate the registry value:
    Blob = "{random values}"
13. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4BA7B9DDD68788E12FF852E1A024204BF286A8F6
15. In the right panel, locate the registry value:
    Blob = "{random values}"
16. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4B421F7515F6AE8A6ECEF97F6982A400A4D9224E
18. In the right panel, locate the registry value:
    Blob = "{random values}"
19. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>47AFB915CDA26D82467B97FA42914468726138DD
21. In the right panel, locate the registry value:
    Blob = "{random values}"
22. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
23. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4463C531D7CCC1006794612BB656D3BF8257846F
24. In the right panel, locate the registry value:
    Blob = "{random values}"
25. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
26. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>43F9B110D5BAFD48225231B0D0082B372FEF9A54
27. In the right panel, locate the registry value:
    Blob = "{random values}"
28. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
29. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>43DDB1FFF3B49B73831407F6BC8B975023D07C50
30. In the right panel, locate the registry value:
    Blob = "{random values}"
31. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>40E78C1D523D1CD9954FAC1A1AB3BD3CBAA15BFC
33. In the right panel, locate the registry value:
    Blob = "{random values}"
34. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
35. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>4072BA31FEC351438480F62E6CB95508461EAB2F
36. In the right panel, locate the registry value:
    Blob = "{random values}"
37. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
38. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>3F85F2BB4A62B0B58BE1614ABB0D4631B4BEF8BA
39. In the right panel, locate the registry value:
    Blob = "{random values}"
40. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
41. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>394FF6850B06BE52E51856CC10E180E882B385CC
42. In the right panel, locate the registry value:
    Blob = "{random values}"
43. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>36863563FD5128C7BEA6F005CFE9B43668086CCE
45. In the right panel, locate the registry value:
    Blob = "{random values}"
46. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
47. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6
48. In the right panel, locate the registry value:
    Blob = "{random values}"
49. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
50. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>2F173F7DE99667AFA57AF80AA2D1B12FAC830338
51. In the right panel, locate the registry value:
    Blob = "{random values}"
52. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
53. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>284F55C41A1A7A3F8328D4C262FB376ED6096F24
54. In the right panel, locate the registry value:
    Blob = "{random values}"
55. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
56. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>273EE12457FDC4F90C55E82B56167F62F532E547
57. In the right panel, locate the registry value:
    Blob = "{random values}"
58. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
59. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>24BA6D6C8A5B5837A48DB5FAE919EA675C94D217
60. In the right panel, locate the registry value:
    Blob = "{random values}"
61. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
62. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>24A40A1F573643A67F0A4B0749F6A22BF28ABB6B
63. In the right panel, locate the registry value:
    Blob = "{random values}"
64. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
65. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>23E594945195F2414803B4D564D2A3A3F5D88B8C
66. In the right panel, locate the registry value:
    Blob = "{random values}"
67. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
68. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>216B2A29E62A00CE820146D8244141B92511B279
69. In the right panel, locate the registry value:
    Blob = "{random values}"
70. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
71. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>209900B63D955728140CD13622D8C687A4EB0085
72. In the right panel, locate the registry value:
    Blob = "{random values}"
73. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
74. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>1F55E8839BAC30728BE7108EDE7B0BB0D3298224
75. In the right panel, locate the registry value:
    Blob = "{random values}"
76. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
77. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>1331F48A5DA8E01DAACA1BB0C17044ACFEF755BB
78. In the right panel, locate the registry value:
    Blob = "{random values}"
79. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
80. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>0B77BEBBCB7AA24705DECC0FBD6A02FC7ABD9B52
81. In the right panel, locate the registry value:
    Blob = "{random values}"
82. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
83. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>049811056AFE9FD0F5BE01685AACE6A5D1C4454C
84. In the right panel, locate the registry value:
    Blob = "{random values}"
85. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
86. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>0483ED3399AC3608058722EDBC5E4600E3BEF9D7
87. In the right panel, locate the registry value:
    Blob = "{random values}"
88. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
89. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>00EA522C8A9C06AA3ECCE0B4FA6CDC21D92E8099
90. In the right panel, locate the registry value:
    Blob = "{random values}"
91. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
92. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>SystemCertificates>AuthRoot>Certificates>0048F8D37B153F6EA2798C323EF4F318A5624A9E
93. In the right panel, locate the registry value:
    Blob = "{random values}"
94. Right-click on the value name and choose Modify. Change the value data of this entry to:
    Blob = "{random values}"
95. Close Registry Editor.

To delete malware/grayware component files:

1. Search for the following files:
   
   • %User Temp%\nse2.tmp
   • %User Temp%\nsu3.tmp\StdUtils.dll
   • %User Temp%\nsu3.tmp\System.dll
   • %User Temp%\nsu3.tmp\nsislog.dll
   • %User Temp%\Codec-VInstaller_1339450254.log
   • %User Temp%\nsu3.tmp\Dialer.dll
   • %User Temp%\nsu3.tmp\nsisos.dll
   • %User Temp%\nsu3.tmp\md5dll.dll
   • %User Temp%\nsu3.tmp\UserInfo.dll
   • %User Temp%\nsu3.tmp\inetc.dll
   • %User Temp%\nsu3.tmp\435_tmp
   • %User Temp%\nsu3.tmp\Processes.dll
   • %Program Files%\Codec-V\Codec-V.exe
   • %Program Files%\Codec-V\Codec-VGui.exe
   • %Program Files%\Codec-V\Codec-V.dll
   • %Program Files%\Codec-V\Codec-V.ico
   • %Program Files%\Codec-V\Uninstall.exe
   • %User Temp%\nsu3.tmp\ExecDos.dll
   • %User Temp%\nsu3.tmp\Codec-V.xpi
   • %Application Data%\Codec-V\Chrome\Codec-V.crx
   • %User Temp%\nsu3.tmp\RemoveFromList.vbs
   • %User Temp%\nsp4.tmp
   • %User Temp%\nsu3.tmp\CleanChromePrefs.vbs
   • %User Temp%\nsa5.tmp
   • %User Profile%\MetaData\135BD6A358680A7BF1CCEC7C0172393D
   • %User Profile%\Content\135BD6A358680A7BF1CCEC7C0172393D
   • %User Profile%\MetaData\2BF68F4714092295550497DD56F57004
   • %User Profile%\Content\2BF68F4714092295550497DD56F57004
   • %User Profile%\MetaData\94308059B57B3142E455B38A6EB92015
   • %User Profile%\Content\94308059B57B3142E455B38A6EB92015
   • %User Temp%\Cab6.tmp
   • %User Temp%\Tar7.tmp
   
   Note: To do a search for the following files, right-click Start then click Search... or Find..., depending on the version of Windows you are running. For each file to be deleted, type its file name in the Named input box. In the Look In drop-down list, select My Computer, then press Enter.
2. Once located, select the file then press SHIFT+DELETE to permanently delete the file.
3. Repeat the said steps for all files listed.

To delete malware/grayware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\Wilbert
   • %User Profile%\LOCALS~1
   • %User Temp%\nsu3.tmp
   • %Program Files%\Codec-V
   • %System Root%\Documents and Settings\Wilbert
   • %Application Data%\Codec-V
   • %Application Data%\Codec-V\Chrome
   • %User Profile%\CryptnetUrlCache\MetaData
   • %User Profile%\Microsoft\CryptnetUrlCache
   • %User Profile%\CryptnetUrlCache\Content
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat the said steps for all folders listed.