SafeSurfing manual removal:
Kill processes:
asbltzun.exe, netsync.exe, regsync.exe, richup.exe, installerv3.exe
Delete registry values:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\regsync
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\richup
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rsync
HKEY_CLASSES_ROOT\LowSol.RichEditor
HKEY_CLASSES_ROOT\LowSol.RichEditor.1
HKEY_CLASSES_ROOT\Var3.RsyncHlpr.1
HKEY_CLASSES_ROOT\VBRun.VBRunDLL
HKEY_CLASSES_ROOT\VBRun.VBRunDLL.1
HKEY_CLASSES_ROOT\CLSID\{16B238D5-80DE-47CE-8F17-B3ECE2C2248D}
HKEY_CLASSES_ROOT\CLSID\{197B8CA4-E215-46DD-8F33-E0544A80E5C4}
HKEY_CLASSES_ROOT\CLSID\{F79A2C4B-8776-4ED7-8B2F-4786A4A3500A}
HKEY_CLASSES_ROOT\Interface\{0A0CB91F-304B-44AD-9460-9C55465163A4}
HKEY_CLASSES_ROOT\Interface\{32A9D21F-F510-44DC-9EA6-0456EDA04668}
HKEY_CLASSES_ROOT\Interface\{4562B6F3-DAF8-464E-87B7-5464575F0D6A}
HKEY_CLASSES_ROOT\Interface\{57CB9B97-9FF9-4C87-88A4-56A867FFC95E}
HKEY_CLASSES_ROOT\Interface\{DA4B919F-B757-4E32-8D79-DEC5C2704C4B}
HKEY_CLASSES_ROOT\Interface\{F1AD96E6-E575-44D9-9BBF-F3FDCF06C454}
HKEY_CLASSES_ROOT\TypeLib\{00DC9FF2-EA77-49C7-8DEF-722FD81CAB59}
HKEY_CLASSES_ROOT\TypeLib\{227D1E33-EAD4-4ACE-BE32-4ACFAAD072DD}
HKEY_CLASSES_ROOT\TypeLib\{33ADD70F-53AB-4F97-B4B6-997881820F6D}
HKEY_LOCAL_MACHINE\SOFTWARE\SafeSurfing
HKEY_LOCAL_MACHINE\SOFTWARE\RichEd
HKEY_LOCAL_MACHINE\SOFTWARE\RSyncMon
HKEY_LOCAL_MACHINE\SOFTWARE\VBRun
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\netsync
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\regsync
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\richedtr
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\richup
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\rsyncmon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\vbrundll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{16B238D5-80DE-47CE-8F17-B3ECE2C2248D}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{197B8CA4-E215-46DD-8F33-E0544A80E5C4}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F79A2C4B-8776-4ED7-8B2F-4786A4A3500A}
HKEY_LOCAL_MACHINE\SYSTEM\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\netsync.exe
HKEY_LOCAL_MACHINE\SYSTEM\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\regsync.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RichEditor
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RSyncMon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VBRunDLL
Delete files:asbltzun.exe, netsync.exe, regsync.exe, richup.exe, installerv3.exe, rsyncmon.dll, redtrsha.dll, richedtr.dll, vbrundll.dll, commcos2.dll
Misc:SafeSurfing may create all listed objects or install only few of them.
Exact file location:
asbltzun.exe,netsync.exe,rsyncmon.dll - C:\Windows or C:\Winnt
other files - C:\Windows\System, C:\Windows\System32 or C:\Winnt\System32