VBS_DELF.PII

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>baidu
3. Still in the left panel, locate and delete the key:
   BaiduToolbar
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>Software>Baidu
5. Still in the left panel, locate and delete the key:
   BaiduToolbar
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall
7. Still in the left panel, locate and delete the key:
   BaiduBarX
8. In the left panel, double-click the following:
   HKEY_CURRENT_USER>software>baidu>BaiduToolbar
9. Still in the left panel, locate and delete the key:
   NoAD
10. In the left panel, double-click the following:
    HKEY_CURRENT_USER>software>baidu>BaiduToolbar>NoAD
11. Still in the left panel, locate and delete the key:
    Page_Allow
12. Again Still in the left panel, locate and delete the key:
    Page_Block
13. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>SearchScopes
14. Still in the left panel, locate and delete the key:
    {B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2}
15. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT
16. Still in the left panel, locate and delete the key:
    BaiduBarX.ToolBand.1
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>BaiduBarX.ToolBand.1
18. Still in the left panel, locate and delete the key:
    CLSID
19. Again Still in the left panel, locate and delete the key:
    BaiduBarX.ToolBand
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>BaiduBarX.ToolBand
21. Still in the left panel, locate and delete the key:
    CLSID
22. Again Still in the left panel, locate and delete the key:
    CurVer
23. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID
24. Still in the left panel, locate and delete the key:
    {B580CF65-E151-49C3-B73F-70B13FCA8E86}
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B580CF65-E151-49C3-B73F-70B13FCA8E86}
26. Still in the left panel, locate and delete the key:
    ProgID
27. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
28. Again Still in the left panel, locate and delete the key:
    InprocServer32
29. Again Still in the left panel, locate and delete the key:
    TypeLib
30. Again Still in the left panel, locate and delete the key:
    BaiduBar.Tool.1
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>BaiduBar.Tool.1
32. Still in the left panel, locate and delete the key:
    CLSID
33. Again Still in the left panel, locate and delete the key:
    BaiduBar.Tool
34. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>BaiduBar.Tool
35. Still in the left panel, locate and delete the key:
    CLSID
36. Again Still in the left panel, locate and delete the key:
    CurVer
37. Again Still in the left panel, locate and delete the key:
    {A7F05EE4-0426-454F-8013-C41E3596E9E9}
38. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{A7F05EE4-0426-454F-8013-C41E3596E9E9}
39. Still in the left panel, locate and delete the key:
    ProgID
40. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
41. Again Still in the left panel, locate and delete the key:
    Programmable
42. Again Still in the left panel, locate and delete the key:
    InprocServer32
43. Again Still in the left panel, locate and delete the key:
    TypeLib
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion
45. Still in the left panel, locate and delete the key:
    Ext
46. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext
47. Still in the left panel, locate and delete the key:
    PreApproved
48. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Ext>PreApproved
49. Still in the left panel, locate and delete the key:
    {A7F05EE4-0426-454F-8013-C41E3596E9E9}
50. Again Still in the left panel, locate and delete the key:
    BaiduBarX.BandIE.1
51. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>BaiduBarX.BandIE.1
52. Still in the left panel, locate and delete the key:
    CLSID
53. Again Still in the left panel, locate and delete the key:
    BaiduBarX.BandIE
54. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>BaiduBarX.BandIE
55. Still in the left panel, locate and delete the key:
    CLSID
56. Again Still in the left panel, locate and delete the key:
    CurVer
57. Again Still in the left panel, locate and delete the key:
    {77FEF28E-EB96-44FF-B511-3185DEA48697}
58. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{77FEF28E-EB96-44FF-B511-3185DEA48697}
59. Still in the left panel, locate and delete the key:
    ProgID
60. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
61. Again Still in the left panel, locate and delete the key:
    InprocServer32
62. Again Still in the left panel, locate and delete the key:
    TypeLib
63. Again Still in the left panel, locate and delete the key:
    BaiduBarEx.BDHomePage.4
64. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>BaiduBarEx.BDHomePage.4
65. Still in the left panel, locate and delete the key:
    CLSID
66. Again Still in the left panel, locate and delete the key:
    BaiduBarEx.BDHomePage.3
67. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>BaiduBarEx.BDHomePage.3
68. Still in the left panel, locate and delete the key:
    CLSID
69. Again Still in the left panel, locate and delete the key:
    BaiduBarEx.BDHomePage.2
70. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>BaiduBarEx.BDHomePage.2
71. Still in the left panel, locate and delete the key:
    CLSID
72. Again Still in the left panel, locate and delete the key:
    BaiduBarEx.BDHomePage.1
73. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>BaiduBarEx.BDHomePage.1
74. Still in the left panel, locate and delete the key:
    CLSID
75. Again Still in the left panel, locate and delete the key:
    BaiduBarEx.BDHomePage
76. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>BaiduBarEx.BDHomePage
77. Still in the left panel, locate and delete the key:
    CLSID
78. Again Still in the left panel, locate and delete the key:
    CurVer
79. Again Still in the left panel, locate and delete the key:
    {E5D5D4A1-17F0-41D7-B1C6-0979F91E6F46}
80. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{E5D5D4A1-17F0-41D7-B1C6-0979F91E6F46}
81. Still in the left panel, locate and delete the key:
    ProgID
82. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
83. Again Still in the left panel, locate and delete the key:
    Programmable
84. Again Still in the left panel, locate and delete the key:
    InprocServer32
85. Again Still in the left panel, locate and delete the key:
    TypeLib
86. Again Still in the left panel, locate and delete the key:
    {E5D5D4A1-17F0-41D7-B1C6-0979F91E6F46}
87. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib
88. Still in the left panel, locate and delete the key:
    {D12F94FA-FC9A-41F7-B808-7FBB419DD7A6}
89. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{D12F94FA-FC9A-41F7-B808-7FBB419DD7A6}
90. Still in the left panel, locate and delete the key:
    1.0
91. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{D12F94FA-FC9A-41F7-B808-7FBB419DD7A6}>1.0
92. Still in the left panel, locate and delete the key:
    FLAGS
93. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{D12F94FA-FC9A-41F7-B808-7FBB419DD7A6}>1.0>0
94. Still in the left panel, locate and delete the key:
    win32
95. Again Still in the left panel, locate and delete the key:
    HELPDIR
96. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface
97. Still in the left panel, locate and delete the key:
    {7EF05EFF-0E62-4040-8D81-73A10D8DE60F}
98. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{7EF05EFF-0E62-4040-8D81-73A10D8DE60F}
99. Still in the left panel, locate and delete the key:
    ProxyStubClsid
100. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
101. Again Still in the left panel, locate and delete the key:
     TypeLib
102. Again Still in the left panel, locate and delete the key:
     {4C2BFEC9-F03C-4F74-932E-5723E603B4AC}
103. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{4C2BFEC9-F03C-4F74-932E-5723E603B4AC}
104. Still in the left panel, locate and delete the key:
     ProxyStubClsid
105. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
106. Again Still in the left panel, locate and delete the key:
     TypeLib
107. Again Still in the left panel, locate and delete the key:
     {D158174C-004B-4A2E-9410-5442C10C60D2}
108. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{D158174C-004B-4A2E-9410-5442C10C60D2}
109. Still in the left panel, locate and delete the key:
     ProxyStubClsid
110. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
111. Again Still in the left panel, locate and delete the key:
     TypeLib
112. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID
113. Still in the left panel, locate and delete the key:
     {7A33CE9E-4F33-4B4E-B263-6AEEAB6C3DC2}
114. Again Still in the left panel, locate and delete the key:
     BarBroker.EXE
115. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer
116. Still in the left panel, locate and delete the key:
     Low Rights
117. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Low Rights
118. Still in the left panel, locate and delete the key:
     ElevationPolicy
119. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Low Rights>ElevationPolicy
120. Still in the left panel, locate and delete the key:
     {7A33CE9E-4F33-4B4E-B263-6AEEAB6C3DC2}
121. Again Still in the left panel, locate and delete the key:
     BarBroker.BDBroker.1
122. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>BarBroker.BDBroker.1
123. Still in the left panel, locate and delete the key:
     CLSID
124. Again Still in the left panel, locate and delete the key:
     BarBroker.BDBroker
125. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>BarBroker.BDBroker
126. Still in the left panel, locate and delete the key:
     CLSID
127. Again Still in the left panel, locate and delete the key:
     CurVer
128. Again Still in the left panel, locate and delete the key:
     {5BECD27B-DCF5-4DEF-B066-486A47245C03}
129. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{5BECD27B-DCF5-4DEF-B066-486A47245C03}
130. Still in the left panel, locate and delete the key:
     ProgID
131. Again Still in the left panel, locate and delete the key:
     VersionIndependentProgID
132. Again Still in the left panel, locate and delete the key:
     LocalServer32
133. Again Still in the left panel, locate and delete the key:
     TypeLib
134. Again Still in the left panel, locate and delete the key:
     {3A8C9D89-3271-45F4-98C0-56B0F5A16172}
135. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{3A8C9D89-3271-45F4-98C0-56B0F5A16172}
136. Still in the left panel, locate and delete the key:
     1.0
137. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{3A8C9D89-3271-45F4-98C0-56B0F5A16172}>1.0
138. Still in the left panel, locate and delete the key:
     FLAGS
139. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TypeLib>{3A8C9D89-3271-45F4-98C0-56B0F5A16172}>1.0>0
140. Still in the left panel, locate and delete the key:
     win32
141. Again Still in the left panel, locate and delete the key:
     HELPDIR
142. Again Still in the left panel, locate and delete the key:
     {2923508C-9425-4A61-B9CE-A98239055916}
143. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{2923508C-9425-4A61-B9CE-A98239055916}
144. Still in the left panel, locate and delete the key:
     ProxyStubClsid
145. Again Still in the left panel, locate and delete the key:
     ProxyStubClsid32
146. Again Still in the left panel, locate and delete the key:
     TypeLib
147. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>baidu>BaiduToolbar
3. In the right panel, locate and delete the entry:
   IEDefaultSearch = 1
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Baidu>BaiduToolbar
5. In the right panel, locate and delete the entry:
   idtmp = "haoaoao_cb"
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>BaiduBarX
7. In the right panel, locate and delete the entry:
   DisplayName = "?????"
8. Again In the right panel, locate and delete the entry:
   DisplayVersion = "2.0.19"
9. Again In the right panel, locate and delete the entry:
   Publisher = "??"
10. Again In the right panel, locate and delete the entry:
    HelpLink = "http://www.{BLOCKED}u.com/search/sobar.html"
11. Again In the right panel, locate and delete the entry:
    URLUpdateInfo = "http://toolbar.{BLOCKED}u.com"
12. Again In the right panel, locate and delete the entry:
    EstimatedSize = 1454
13. Again In the right panel, locate and delete the entry:
    DisplayIcon = ""%Program Files%\Baidu\Toolbar\rc.dll",0"
14. Again In the right panel, locate and delete the entry:
    UninstallString = ""%Program Files%\Baidu\Toolbar\BarBroker.exe" -runasAdmin -SVCUninstall"
15. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>baidu>BaiduToolbar>NoAD>Page_Allow
16. In the right panel, locate and delete the entry:
    30 = "*.hao123.com*"
17. Again In the right panel, locate and delete the entry:
    31 = "*.baidu.com*"
18. Again In the right panel, locate and delete the entry:
    32 = "*.youa.com*"
19. Again In the right panel, locate and delete the entry:
    33 = "*.skycn.com*"
20. Again In the right panel, locate and delete the entry:
    34 = "*.skycn.net*"
21. Again In the right panel, locate and delete the entry:
    35 = "*.baifubao.com*"
22. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>baidu>BaiduToolbar>NoAD>Page_Block
23. In the right panel, locate and delete the entry:
    0 = "*/ad.*"
24. Again In the right panel, locate and delete the entry:
    1 = "http://ad[0-9].*"
25. Again In the right panel, locate and delete the entry:
    2 = "http://{BLOCKED}s."
26. Again In the right panel, locate and delete the entry:
    3 = "*banner.*"
27. Again In the right panel, locate and delete the entry:
    4 = "*/advpic*"
28. Again In the right panel, locate and delete the entry:
    5 = "*doubleclick.*"
29. Again In the right panel, locate and delete the entry:
    6 = "*/ad/*"
30. Again In the right panel, locate and delete the entry:
    7 = "*/banner_img/*"
31. Again In the right panel, locate and delete the entry:
    8 = "*/adbanners*"
32. Again In the right panel, locate and delete the entry:
    9 = "*cnsmin.3721.com/*"
33. Again In the right panel, locate and delete the entry:
    10 = "*/adv/*"
34. Again In the right panel, locate and delete the entry:
    11 = "*/images_ad/*"
35. Again In the right panel, locate and delete the entry:
    12 = "*/ads/*"
36. Again In the right panel, locate and delete the entry:
    13 = "*/advlink/*"
37. Again In the right panel, locate and delete the entry:
    14 = "*/banner*"
38. Again In the right panel, locate and delete the entry:
    15 = "http://ad.*"
39. Again In the right panel, locate and delete the entry:
    16 = "*/adImages/*"
40. Again In the right panel, locate and delete the entry:
    17 = "*.swf[a-z]*"
41. Again In the right panel, locate and delete the entry:
    18 = "*images.sohu.com/cs/button/*"
42. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>SearchScopes>{B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2}
43. In the right panel, locate and delete the entry:
    DisplayName = "????,????"
44. Again In the right panel, locate and delete the entry:
    URL = "http://www.{BLOCKED}u.com/s?wd
45. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>SearchScopes
46. In the right panel, locate and delete the entry:
    DefaultScope = "{B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2}"
47. Again In the right panel, locate and delete the entry:
    ForceShow = 1
48. Again In the right panel, locate and delete the entry:
    FirstRun = 1
49. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Toolbar
50. In the right panel, locate and delete the entry:
    {B580CF65-E151-49C3-B73F-70B13FCA8E86} = "12"
51. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Browser Helper Objects>{77FEF28E-EB96-44FF-B511-3185DEA48697}
52. In the right panel, locate and delete the entry:
    NoExplorer = 1
53. Again In the right panel, locate and delete the entry:
    id = "bdbar"
54. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B580CF65-E151-49C3-B73F-70B13FCA8E86}>InprocServer32
55. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
56. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{A7F05EE4-0426-454F-8013-C41E3596E9E9}>InprocServer32
57. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
58. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{77FEF28E-EB96-44FF-B511-3185DEA48697}>InprocServer32
59. In the right panel, locate and delete the entry:
    ThreadingModel = "both"
60. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{E5D5D4A1-17F0-41D7-B1C6-0979F91E6F46}>InprocServer32
61. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
62. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{7EF05EFF-0E62-4040-8D81-73A10D8DE60F}>TypeLib
63. In the right panel, locate and delete the entry:
    Version = "1.0"
64. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{4C2BFEC9-F03C-4F74-932E-5723E603B4AC}>TypeLib
65. In the right panel, locate and delete the entry:
    Version = "1.0"
66. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{D158174C-004B-4A2E-9410-5442C10C60D2}>TypeLib
67. In the right panel, locate and delete the entry:
    Version = "1.0"
68. Again In the right panel, locate and delete the entry:
    ID = "haoaoao_cb"
69. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>BarBroker.EXE
70. In the right panel, locate and delete the entry:
    AppID = "{7A33CE9E-4F33-4B4E-B263-6AEEAB6C3DC2}"
71. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Internet Explorer>Low Rights>ElevationPolicy>{7A33CE9E-4F33-4B4E-B263-6AEEAB6C3DC2}
72. In the right panel, locate and delete the entry:
    AppName = "BarBroker.exe"
73. Again In the right panel, locate and delete the entry:
    AppPath = "%ProgramFiles%\Baidu\Toolbar"
74. Again In the right panel, locate and delete the entry:
    Policy = 3
75. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{5BECD27B-DCF5-4DEF-B066-486A47245C03}
76. In the right panel, locate and delete the entry:
    AppID = "{7A33CE9E-4F33-4B4E-B263-6AEEAB6C3DC2}"
77. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Interface>{2923508C-9425-4A61-B9CE-A98239055916}>TypeLib
78. In the right panel, locate and delete the entry:
    Version = "1.0"
79. Close Registry Editor.

To delete malware/grayware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %System Root%\DOCUME~1
   • %System Root%\DOCUME~1\ADMINI~1
   • %User Profile%\LOCALS~1
   • %User Temp%\nsx2.tmp
   • %Program Files%\baidubar
   • %System Root%\Documents and Settings
   • %System Root%\Documents and Settings\Administrator
   • %User Temp%\nsf5.tmp
   • %User Profile%\Application Data
   • %User Profile%\Application Data\Baidu
   • %User Profile%\Baidu\Toolbar
   • %User Profile%\Toolbar\Custom Buttons
   • %Program Files%\Baidu
   • %Program Files%\Baidu\Toolbar
   • %Program Files%\Baidu\Toolbar\BaiduBarX_Tmp
   • %Start Menu%\Programs\?????
   • %User Temp%\nsgA.tmp
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat the said steps for all folders listed.

To delete malware/grayware component files:

1. Search for the following files:
   
   • %User Temp%\nsx2.tmp\System.dll
   • %User Temp%\SOFT2009202.exe
   • %User Temp%\Toolbar.exe
   • %User Temp%\Setup.exe
   • %User Temp%\TheWorld_3.0.9.5.exe
   • %Program Files%\baidubar\taobao.ico
   • %Program Files%\baidubar\qidian.ico
   • %Desktop%\ÌÔ±¦Íø.lnk
   • %Desktop%\°²È«ä¯ÀÀÆ÷.lnk
   • %Desktop%\ÆðµãС˵.url
   • %User Temp%\nsx2.tmp\ShellLink.dll
   • %User Profile%\Quick Launch\Launch Internet Explorer Browser.lnk
   • %User Temp%\nsf4.tmp
   • %User Temp%\nsf5.tmp\InetLoad2.dll
   • %User Temp%\data.ini
   • %User Temp%\setup_133daohang2.exe
   • %User Temp%\nsg7.tmp
   • %Program Files%\Baidu\Toolbar\BaiduBarX_Tmp\BaiduBarX.dll
   • %Program Files%\Baidu\Toolbar\rc.dll
   • %Program Files%\Baidu\Toolbar\BarBroker.exe
   • %Start Menu%\Programs\?????\???????.lnk
   • %System%\f873348001.dll
   • %User Temp%\nsr9.tmp
   • %User Temp%\nsgA.tmp\default.bmp
   • %User Temp%\nsgA.tmp\second.bmp
   • %User Temp%\nsgA.tmp\Labelselect_chs.ini
   • %User Temp%\nsgA.tmp\ioSpecial.ini
   • %User Temp%\nsgA.tmp\modern-wizard.bmp
   • %Program Files%\Baidu\Toolbar\BaiduBarX.dll
   
   Note: To do a search for the following files, right-click Start then click Search... or Find..., depending on the version of Windows you are running. For each file to be deleted, type its file name in the Named input box. In the Look In drop-down list, select My Computer, then press Enter.
2. Once located, select the file then press SHIFT+DELETE to permanently delete the file.
3. Repeat the said steps for all files listed.