BKDR_TRUVASYS.A

To delete the registry key this malware/grayware created:

1. Open Registry Editor.
   » For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run, type regedit in the text box provided, and then press Enter.
   » For Windows Vista, Windows 7, and Windows Server 2008 users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, and Windows Server 2012 users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software
3. Still in the left panel, locate and delete the key:
   WinRAR SFX
4. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>WinRAR>Setup
5. Still in the left panel, locate and delete the key:
   .rar
6. Again Still in the left panel, locate and delete the key:
   .zip
7. Again Still in the left panel, locate and delete the key:
   .cab
8. Again Still in the left panel, locate and delete the key:
   .arj
9. Again Still in the left panel, locate and delete the key:
   .lzh
10. Again Still in the left panel, locate and delete the key:
    .ace
11. Again Still in the left panel, locate and delete the key:
    .7z
12. Again Still in the left panel, locate and delete the key:
    .tar
13. Again Still in the left panel, locate and delete the key:
    .gz
14. Again Still in the left panel, locate and delete the key:
    .uue
15. Again Still in the left panel, locate and delete the key:
    .bz2
16. Again Still in the left panel, locate and delete the key:
    .jar
17. Again Still in the left panel, locate and delete the key:
    .iso
18. Again Still in the left panel, locate and delete the key:
    .z
19. Again Still in the left panel, locate and delete the key:
    .xz
20. Again Still in the left panel, locate and delete the key:
    .001
21. Again Still in the left panel, locate and delete the key:
    Links
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>App Paths
23. Still in the left panel, locate and delete the key:
    WinRAR.exe
24. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software
25. Still in the left panel, locate and delete the key:
    WinRAR
26. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID
27. Still in the left panel, locate and delete the key:
    {B41DB860-8EE4-11D2-9906-E49FADC173CA}
28. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID>{B41DB860-8EE4-11D2-9906-E49FADC173CA}
29. Still in the left panel, locate and delete the key:
    InProcServer32
30. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>WinRAR>shellex>ContextMenuHandlers
31. Still in the left panel, locate and delete the key:
    {B41DB860-8EE4-11D2-9906-E49FADC173CA}
32. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>WinRAR>shellex>PropertySheetHandlers
33. Still in the left panel, locate and delete the key:
    {B41DB860-8EE4-11D2-9906-E49FADC173CA}
34. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>WinRAR.ZIP>shellex>ContextMenuHandlers
35. Still in the left panel, locate and delete the key:
    {B41DB860-8EE4-11D2-9906-E49FADC173CA}
36. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>WinRAR.ZIP>shellex>PropertySheetHandlers
37. Still in the left panel, locate and delete the key:
    {B41DB860-8EE4-11D2-9906-E49FADC173CA}
38. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>exefile>shellex>PropertySheetHandlers
39. Still in the left panel, locate and delete the key:
    {B41DB860-8EE4-11D2-9906-E49FADC173CA}
40. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>WinRAR>shellex
41. Still in the left panel, locate and delete the key:
    DropHandler
42. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>WinRAR.ZIP>shellex
43. Still in the left panel, locate and delete the key:
    DropHandler
44. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>*>shellex>ContextMenuHandlers
45. Still in the left panel, locate and delete the key:
    WinRAR
46. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>Folder>shellex>ContextMenuHandlers
47. Still in the left panel, locate and delete the key:
    WinRAR
48. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>Folder>shellex>DragDropHandlers
49. Still in the left panel, locate and delete the key:
    WinRAR
50. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>Drive>shellex>DragDropHandlers
51. Still in the left panel, locate and delete the key:
    WinRAR
52. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT
53. Still in the left panel, locate and delete the key:
    .rar
54. Again Still in the left panel, locate and delete the key:
    .r00
55. Again Still in the left panel, locate and delete the key:
    .r01
56. Again Still in the left panel, locate and delete the key:
    .r02
57. Again Still in the left panel, locate and delete the key:
    .r03
58. Again Still in the left panel, locate and delete the key:
    .r04
59. Again Still in the left panel, locate and delete the key:
    .r05
60. Again Still in the left panel, locate and delete the key:
    .r06
61. Again Still in the left panel, locate and delete the key:
    .r07
62. Again Still in the left panel, locate and delete the key:
    .r08
63. Again Still in the left panel, locate and delete the key:
    .r09
64. Again Still in the left panel, locate and delete the key:
    .r10
65. Again Still in the left panel, locate and delete the key:
    .r11
66. Again Still in the left panel, locate and delete the key:
    .r12
67. Again Still in the left panel, locate and delete the key:
    .r13
68. Again Still in the left panel, locate and delete the key:
    .r14
69. Again Still in the left panel, locate and delete the key:
    .r15
70. Again Still in the left panel, locate and delete the key:
    .r16
71. Again Still in the left panel, locate and delete the key:
    .r17
72. Again Still in the left panel, locate and delete the key:
    .r18
73. Again Still in the left panel, locate and delete the key:
    .r19
74. Again Still in the left panel, locate and delete the key:
    .r20
75. Again Still in the left panel, locate and delete the key:
    .r21
76. Again Still in the left panel, locate and delete the key:
    .r22
77. Again Still in the left panel, locate and delete the key:
    .r23
78. Again Still in the left panel, locate and delete the key:
    .r24
79. Again Still in the left panel, locate and delete the key:
    .r25
80. Again Still in the left panel, locate and delete the key:
    .r26
81. Again Still in the left panel, locate and delete the key:
    .r27
82. Again Still in the left panel, locate and delete the key:
    .r28
83. Again Still in the left panel, locate and delete the key:
    .r29
84. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>.rar
85. Still in the left panel, locate and delete the key:
    ShellNew
86. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>.zip
87. Still in the left panel, locate and delete the key:
    ShellNew
88. Again Still in the left panel, locate and delete the key:
    .arj
89. Again Still in the left panel, locate and delete the key:
    .lzh
90. Again Still in the left panel, locate and delete the key:
    .lha
91. Again Still in the left panel, locate and delete the key:
    .lha
92. Again Still in the left panel, locate and delete the key:
    .ace
93. Again Still in the left panel, locate and delete the key:
    .7z
94. Again Still in the left panel, locate and delete the key:
    .tgz
95. Again Still in the left panel, locate and delete the key:
    .uue
96. Again Still in the left panel, locate and delete the key:
    .xxe
97. Again Still in the left panel, locate and delete the key:
    .xxe
98. Again Still in the left panel, locate and delete the key:
    .uu
99. Again Still in the left panel, locate and delete the key:
    .uu
100. Again Still in the left panel, locate and delete the key:
     .bz2
101. Again Still in the left panel, locate and delete the key:
     .tbz2
102. Again Still in the left panel, locate and delete the key:
     .tbz2
103. Again Still in the left panel, locate and delete the key:
     .bz
104. Again Still in the left panel, locate and delete the key:
     .bz
105. Again Still in the left panel, locate and delete the key:
     .tbz
106. Again Still in the left panel, locate and delete the key:
     .tbz
107. Again Still in the left panel, locate and delete the key:
     .jar
108. Again Still in the left panel, locate and delete the key:
     .iso
109. Again Still in the left panel, locate and delete the key:
     .taz
110. Again Still in the left panel, locate and delete the key:
     .taz
111. Again Still in the left panel, locate and delete the key:
     .xz
112. Again Still in the left panel, locate and delete the key:
     .txz
113. Again Still in the left panel, locate and delete the key:
     .txz
114. Again Still in the left panel, locate and delete the key:
     .001
115. In the left panel, double-click the following:
     HKEY_CLASSES_ROOT>WinRAR>shell>open
116. Still in the left panel, locate and delete the key:
     command
117. In the left panel, double-click the following:
     HKEY_CLASSES_ROOT>WinRAR
118. Still in the left panel, locate and delete the key:
     DefaultIcon
119. In the left panel, double-click the following:
     HKEY_CLASSES_ROOT>WinRAR.ZIP>shell>open
120. Still in the left panel, locate and delete the key:
     command
121. In the left panel, double-click the following:
     HKEY_CLASSES_ROOT>WinRAR.ZIP
122. Still in the left panel, locate and delete the key:
     DefaultIcon
123. Again Still in the left panel, locate and delete the key:
     .rev
124. Again Still in the left panel, locate and delete the key:
     WinRAR.REV
125. In the left panel, double-click the following:
     HKEY_CLASSES_ROOT>WinRAR.REV>shell>open
126. Still in the left panel, locate and delete the key:
     command
127. In the left panel, double-click the following:
     HKEY_CLASSES_ROOT>WinRAR.REV
128. Still in the left panel, locate and delete the key:
     DefaultIcon
129. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Uninstall
130. Still in the left panel, locate and delete the key:
     WinRAR archiver
131. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor.
   » For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run, type regedit in the text box provided, and then press Enter.
   » For Windows Vista, Windows 7, and Windows Server 2008 users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, and Windows Server 2012 users, right-click on the lower-left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>WinRAR SFX
3. In the right panel, locate and delete the entry:
   C%%Program Files%WinRAR = "%Program Files%\WinRAR"
4. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>WinRAR>Setup>.rar
5. In the right panel, locate and delete the entry:
   Set = "1"
6. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>WinRAR>Setup>.zip
7. In the right panel, locate and delete the entry:
   Set = "1"
8. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>WinRAR>Setup>.cab
9. In the right panel, locate and delete the entry:
   Set = "1"
10. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.arj
11. In the right panel, locate and delete the entry:
    Set = "1"
12. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.lzh
13. In the right panel, locate and delete the entry:
    Set = "1"
14. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.ace
15. In the right panel, locate and delete the entry:
    Set = "1"
16. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.7z
17. In the right panel, locate and delete the entry:
    Set = "1"
18. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.tar
19. In the right panel, locate and delete the entry:
    Set = "1"
20. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.gz
21. In the right panel, locate and delete the entry:
    Set = "1"
22. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.uue
23. In the right panel, locate and delete the entry:
    Set = "1"
24. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.bz2
25. In the right panel, locate and delete the entry:
    Set = "1"
26. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.jar
27. In the right panel, locate and delete the entry:
    Set = "1"
28. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.iso
29. In the right panel, locate and delete the entry:
    Set = "1"
30. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.z
31. In the right panel, locate and delete the entry:
    Set = "1"
32. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.xz
33. In the right panel, locate and delete the entry:
    Set = "1"
34. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.001
35. In the right panel, locate and delete the entry:
    Set = "1"
36. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>Links
37. In the right panel, locate and delete the entry:
    Desktop = "0"
38. Again In the right panel, locate and delete the entry:
    StartMenu = "0"
39. Again In the right panel, locate and delete the entry:
    Programs = "1"
40. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup
41. In the right panel, locate and delete the entry:
    ShellExt = "1"
42. Again In the right panel, locate and delete the entry:
    CascadedMenu = "0"
43. Again In the right panel, locate and delete the entry:
    MenuIcons = "1"
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>WinRAR
45. In the right panel, locate and delete the entry:
    exe32 = "%Program Files%\WinRAR\WinRAR.exe"
46. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>App Paths>WinRAR.exe
47. In the right panel, locate and delete the entry:
    Path = "%Program Files%\WinRAR"
48. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B41DB860-8EE4-11D2-9906-E49FADC173CA}>InProcServer32
49. In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
50. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Shell Extensions>Approved
51. In the right panel, locate and delete the entry:
    {B41DB860-8EE4-11D2-9906-E49FADC173CA} = "WinRAR shell extension"
52. Again In the right panel, locate and delete the entry:
    Exist = "0"
53. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.rar>ShellNew
54. In the right panel, locate and delete the entry:
    FileName = "%Program Files%\WinRAR\rarnew.dat"
55. Again In the right panel, locate and delete the entry:
    Exist = "1"
56. Again In the right panel, locate and delete the entry:
    Type = "CompressedFolder"
57. Again In the right panel, locate and delete the entry:
    Content = "application/x-zip-compressed"
58. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.zip>ShellNew
59. In the right panel, locate and delete the entry:
    FileName = "%Program Files%\WinRAR\zipnew.dat"
60. Again In the right panel, locate and delete the entry:
    Exist = "1"
61. Again In the right panel, locate and delete the entry:
    Type = "CLSID\{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"
62. Again In the right panel, locate and delete the entry:
    Exist = "0"
63. Again In the right panel, locate and delete the entry:
    Exist = "0"
64. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.lha
65. In the right panel, locate and delete the entry:
    Exist = "0"
66. Again In the right panel, locate and delete the entry:
    Exist = "0"
67. Again In the right panel, locate and delete the entry:
    Exist = "0"
68. Again In the right panel, locate and delete the entry:
    Exist = "1"
69. Again In the right panel, locate and delete the entry:
    Content = "application/x-tar"
70. Again In the right panel, locate and delete the entry:
    Exist = "1"
71. Again In the right panel, locate and delete the entry:
    Content = "application/x-gzip"
72. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.tgz
73. In the right panel, locate and delete the entry:
    Exist = "1"
74. Again In the right panel, locate and delete the entry:
    Content = "application/x-compressed"
75. Again In the right panel, locate and delete the entry:
    Exist = "0"
76. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.xxe
77. In the right panel, locate and delete the entry:
    Exist = "0"
78. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.uu
79. In the right panel, locate and delete the entry:
    Exist = "0"
80. Again In the right panel, locate and delete the entry:
    Exist = "0"
81. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.tbz2
82. In the right panel, locate and delete the entry:
    Exist = "0"
83. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.bz
84. In the right panel, locate and delete the entry:
    Exist = "0"
85. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.tbz
86. In the right panel, locate and delete the entry:
    Exist = "0"
87. Again In the right panel, locate and delete the entry:
    Exist = "0"
88. Again In the right panel, locate and delete the entry:
    Exist = "0"
89. Again In the right panel, locate and delete the entry:
    Exist = "1"
90. Again In the right panel, locate and delete the entry:
    Content = "application/x-compress"
91. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.taz
92. In the right panel, locate and delete the entry:
    Exist = "0"
93. Again In the right panel, locate and delete the entry:
    Exist = "0"
94. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.txz
95. In the right panel, locate and delete the entry:
    Exist = "0"
96. Again In the right panel, locate and delete the entry:
    Exist = "0"
97. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>WinRAR archiver
98. In the right panel, locate and delete the entry:
    DisplayName = "WinRAR 5.30 beta 5 (32-bit)"
99. Again In the right panel, locate and delete the entry:
    DisplayVersion = "5.30.5"
100. Again In the right panel, locate and delete the entry:
     VersionMajor = "5"
101. Again In the right panel, locate and delete the entry:
     VersionMinor = "1e"
102. Again In the right panel, locate and delete the entry:
     UninstallString = "%Program Files%\WinRAR\uninstall.exe"
103. Again In the right panel, locate and delete the entry:
     DisplayIcon = "%Program Files%\WinRAR\WinRAR.exe"
104. Again In the right panel, locate and delete the entry:
     InstallLocation = "%Program Files%\WinRAR"
105. Again In the right panel, locate and delete the entry:
     NoModify = "1"
106. Again In the right panel, locate and delete the entry:
     NoRepair = "1"
107. Again In the right panel, locate and delete the entry:
     Language = "0"
108. Again In the right panel, locate and delete the entry:
     Publisher = "win.rar GmbH"
109. Close Registry Editor.

To manually delete a malware/grayware file from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the File name* input box, type the following:
   
   • %Temp%\winrar.exe
   • %System%\resdllx.dll
   • %System%\libeay32.dll
   • %System%\ssleay32.dll
   • %User Temp%\Microsoft\IKE\fprot32.exe
   • %System%\dcomx32.exe
   • %System%\winxsys.exe
   • __tmp_rar_sfx_access_check_232765
   • Descript.ion
   • License.txt
   • Rar.txt
   • ReadMe.txt
   • WhatsNew.txt
   • Order.htm
   • RarFiles.lst
   • Uninstall.lst
   • Rar.exe
   • Uninstall.exe
   • UnRAR.exe
   • WinRAR.exe
   • 7zxa.dll
   • RarExt.dll
   • RarExt64.dll
   • UNACEV2.DLL
   • WinRAR.chm
   • Default.SFX
   • WinCon.SFX
   • Zip.SFX
   • %Program Files%\WinRAR\rarnew.dat
   • %Program Files%\WinRAR\zipnew.dat
   • %Start Menu%\Programs\WinRAR\WinRAR.lnk
   • %Start Menu%\Programs\WinRAR\WinRAR help.lnk
   • %Start Menu%\Programs\WinRAR\Console RAR manual.lnk
   • %Start Menu%\Programs\WinRAR\What is new in the latest version.lnk
   • %User Temp%\resplgdll32\vId.bin
   • %User Temp%\resplgdll32\fprot32.exe
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: The file name input box title varies depending on the Windows version (e.g. Search for files or folders named or All or part of the file name.).

• For Windows Vista, Windows 7, Windows Server 2008, Windows 8, Windows 8.1, and Windows Server 2012:

1. Open a Windows Explorer window.
   • For Windows Vista, 7, and Server 2008 users, click Start>Computer.
   • For Windows 8, 8.1, and Server 2012 users, right-click on the lower left corner of the screen,then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %Temp%\winrar.exe
   • %System%\resdllx.dll
   • %System%\libeay32.dll
   • %System%\ssleay32.dll
   • %User Temp%\Microsoft\IKE\fprot32.exe
   • %System%\dcomx32.exe
   • %System%\winxsys.exe
   • __tmp_rar_sfx_access_check_232765
   • Descript.ion
   • License.txt
   • Rar.txt
   • ReadMe.txt
   • WhatsNew.txt
   • Order.htm
   • RarFiles.lst
   • Uninstall.lst
   • Rar.exe
   • Uninstall.exe
   • UnRAR.exe
   • WinRAR.exe
   • 7zxa.dll
   • RarExt.dll
   • RarExt64.dll
   • UNACEV2.DLL
   • WinRAR.chm
   • Default.SFX
   • WinCon.SFX
   • Zip.SFX
   • %Program Files%\WinRAR\rarnew.dat
   • %Program Files%\WinRAR\zipnew.dat
   • %Start Menu%\Programs\WinRAR\WinRAR.lnk
   • %Start Menu%\Programs\WinRAR\WinRAR help.lnk
   • %Start Menu%\Programs\WinRAR\Console RAR manual.lnk
   • %Start Menu%\Programs\WinRAR\What is new in the latest version.lnk
   • %User Temp%\resplgdll32\vId.bin
   • %User Temp%\resplgdll32\fprot32.exe
3. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the File name* input box, type:
   
   • %User Temp%\Microsoft
   • %User Temp%\Microsoft\IKE
   • %Program Files%\WinRAR
   • %Start Menu%\Programs\WinRAR
   • %User Temp%\resplgdll32
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %User Temp%\Microsoft
   • %User Temp%\Microsoft\IKE
   • %Program Files%\WinRAR
   • %Start Menu%\Programs\WinRAR
   • %User Temp%\resplgdll32
   *Note: The file name input box title varies depending on the Windows version (e.g. Search for files or folders named or All or part of the file name.).

For Windows Vista, Windows 7, Windows Server 2008, Windows 8, Windows 8.1, and Windows Server 2012:

1. Open a Windows Explorer window.
   • For Windows Vista, 7, and Server 2008 users, click Start>Computer.
   • For Windows 8, 8.1, and Server 2012 users, right-click on the lower left corner of the screen, then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %User Temp%\Microsoft
   • %User Temp%\Microsoft\IKE
   • %Program Files%\WinRAR
   • %Start Menu%\Programs\WinRAR
   • %User Temp%\resplgdll32
3. Once located, select the file then press SHIFT+DELETE to permanently delete the folder.
4. Repeat steps 2-3 for the remaining folders:
   • %User Temp%\Microsoft
   • %User Temp%\Microsoft\IKE
   • %Program Files%\WinRAR
   • %Start Menu%\Programs\WinRAR
   • %User Temp%\resplgdll32
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.