for this one you had to delete the keys and .exes that were called 'regcpm32' and 'scvhost' or something like that. both in windows/system and hidden with teddy bear icons (not to do with the teddy bear hoax though). one cant be deleted unless in safe mode though cos its runs otherwise and that stops you from getting to it.