PUA.Win32.SILRAR.A

To terminate the malware/grayware/spyware process:

1. Scan your computer with your Trend Micro product and take note of the name of the malware/grayware/spyware detected.
2. Open Windows Task Manager. To do this, press CTRL+SHIFT+ESC.
3. View the list of all running programs. To do this:
   • For Windows 7 and Server 2008 (R2) users, click the Processes tab.
   • For Windows 8, 8.1, 10, and Server 2012 (R2) users, click the Details tab.
4. In the list of running programs, locate a malware/grayware/spyware file detected earlier.
5. Select the detected files, then press either the End Task or the End Process button, depending on the version of Windows you are using.
6. Do the same for the remaining detected malware/grayware/spyware files in the list of running programs.
7. To check if the malware/grayware/spyware process has been terminated, close Task Manager, and then open it again.
8. Close Task Manager.

To delete the registry key this malware/grayware created:

1. Open Registry Editor.
   » For Windows 7 and Windows Server 2008 (R2) users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2) users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software
3. Still in the left panel, locate and delete the key:
   WinRAR SFX
4. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>WinRAR>Setup
5. Still in the left panel, locate and delete the key:
   .rar
6. Again Still in the left panel, locate and delete the key:
   .zip
7. Again Still in the left panel, locate and delete the key:
   .cab
8. Again Still in the left panel, locate and delete the key:
   .arj
9. Again Still in the left panel, locate and delete the key:
   .lz
10. Again Still in the left panel, locate and delete the key:
    .lzh
11. Again Still in the left panel, locate and delete the key:
    .7z
12. Again Still in the left panel, locate and delete the key:
    .tar
13. Again Still in the left panel, locate and delete the key:
    .gz
14. Again Still in the left panel, locate and delete the key:
    .uue
15. Again Still in the left panel, locate and delete the key:
    .bz2
16. Again Still in the left panel, locate and delete the key:
    .jar
17. Again Still in the left panel, locate and delete the key:
    .iso
18. Again Still in the left panel, locate and delete the key:
    .z
19. Again Still in the left panel, locate and delete the key:
    .xz
20. Again Still in the left panel, locate and delete the key:
    .zipx
21. Again Still in the left panel, locate and delete the key:
    .001
22. Again Still in the left panel, locate and delete the key:
    Links
23. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>App Paths
24. Still in the left panel, locate and delete the key:
    WinRAR.exe
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software
26. Still in the left panel, locate and delete the key:
    WinRAR
27. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID
28. Still in the left panel, locate and delete the key:
    {B41DB860-8EE4-11D2-9906-E49FADC173CA}
29. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID>{B41DB860-8EE4-11D2-9906-E49FADC173CA}
30. Still in the left panel, locate and delete the key:
    InProcServer32
31. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>WinRAR>shellex>ContextMenuHandlers
32. Still in the left panel, locate and delete the key:
    {B41DB860-8EE4-11D2-9906-E49FADC173CA}
33. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>WinRAR>shellex>PropertySheetHandlers
34. Still in the left panel, locate and delete the key:
    {B41DB860-8EE4-11D2-9906-E49FADC173CA}
35. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>WinRAR.ZIP>shellex>ContextMenuHandlers
36. Still in the left panel, locate and delete the key:
    {B41DB860-8EE4-11D2-9906-E49FADC173CA}
37. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>WinRAR.ZIP>shellex>PropertySheetHandlers
38. Still in the left panel, locate and delete the key:
    {B41DB860-8EE4-11D2-9906-E49FADC173CA}
39. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>exefile>shellex>PropertySheetHandlers
40. Still in the left panel, locate and delete the key:
    {B41DB860-8EE4-11D2-9906-E49FADC173CA}
41. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>WinRAR>shellex
42. Still in the left panel, locate and delete the key:
    DropHandler
43. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>WinRAR.ZIP>shellex
44. Still in the left panel, locate and delete the key:
    DropHandler
45. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>*>shellex>ContextMenuHandlers
46. Still in the left panel, locate and delete the key:
    WinRAR32
47. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>Folder>shellex>ContextMenuHandlers
48. Still in the left panel, locate and delete the key:
    WinRAR32
49. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>Folder>shellex>DragDropHandlers
50. Still in the left panel, locate and delete the key:
    WinRAR32
51. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>Drive>shellex>DragDropHandlers
52. Still in the left panel, locate and delete the key:
    WinRAR32
53. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>lnkfile>shellex>ContextMenuHandlers
54. Still in the left panel, locate and delete the key:
    WinRAR32
55. Again Still in the left panel, locate and delete the key:
    {B41DB860-64E4-11D2-9906-E49FADC173CA}
56. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID>{B41DB860-64E4-11D2-9906-E49FADC173CA}
57. Still in the left panel, locate and delete the key:
    InProcServer32
58. Again Still in the left panel, locate and delete the key:
    {B41DB860-64E4-11D2-9906-E49FADC173CA}
59. Again Still in the left panel, locate and delete the key:
    {B41DB860-64E4-11D2-9906-E49FADC173CA}
60. Again Still in the left panel, locate and delete the key:
    {B41DB860-64E4-11D2-9906-E49FADC173CA}
61. Again Still in the left panel, locate and delete the key:
    {B41DB860-64E4-11D2-9906-E49FADC173CA}
62. Again Still in the left panel, locate and delete the key:
    {B41DB860-64E4-11D2-9906-E49FADC173CA}
63. Again Still in the left panel, locate and delete the key:
    WinRAR
64. Again Still in the left panel, locate and delete the key:
    WinRAR
65. Again Still in the left panel, locate and delete the key:
    WinRAR
66. Again Still in the left panel, locate and delete the key:
    WinRAR
67. Again Still in the left panel, locate and delete the key:
    WinRAR
68. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>WinRAR
69. Still in the left panel, locate and delete the key:
    Capabilities
70. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>WinRAR>Capabilities
71. Still in the left panel, locate and delete the key:
    FileAssociations
72. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT
73. Still in the left panel, locate and delete the key:
    .rar
74. Again Still in the left panel, locate and delete the key:
    .r00
75. Again Still in the left panel, locate and delete the key:
    .r01
76. Again Still in the left panel, locate and delete the key:
    .r02
77. Again Still in the left panel, locate and delete the key:
    .r03
78. Again Still in the left panel, locate and delete the key:
    .r04
79. Again Still in the left panel, locate and delete the key:
    .r05
80. Again Still in the left panel, locate and delete the key:
    .r06
81. Again Still in the left panel, locate and delete the key:
    .r07
82. Again Still in the left panel, locate and delete the key:
    .r08
83. Again Still in the left panel, locate and delete the key:
    .r09
84. Again Still in the left panel, locate and delete the key:
    .r10
85. Again Still in the left panel, locate and delete the key:
    .r11
86. Again Still in the left panel, locate and delete the key:
    .r12
87. Again Still in the left panel, locate and delete the key:
    .r13
88. Again Still in the left panel, locate and delete the key:
    .r14
89. Again Still in the left panel, locate and delete the key:
    .r15
90. Again Still in the left panel, locate and delete the key:
    .r16
91. Again Still in the left panel, locate and delete the key:
    .r17
92. Again Still in the left panel, locate and delete the key:
    .r18
93. Again Still in the left panel, locate and delete the key:
    .r19
94. Again Still in the left panel, locate and delete the key:
    .r20
95. Again Still in the left panel, locate and delete the key:
    .r21
96. Again Still in the left panel, locate and delete the key:
    .r22
97. Again Still in the left panel, locate and delete the key:
    .r23
98. Again Still in the left panel, locate and delete the key:
    .r24
99. Again Still in the left panel, locate and delete the key:
    .r25
100. Again Still in the left panel, locate and delete the key:
     .r26
101. Again Still in the left panel, locate and delete the key:
     .r27
102. Again Still in the left panel, locate and delete the key:
     .r28
103. Again Still in the left panel, locate and delete the key:
     .r29
104. In the left panel, double-click the following:
     HKEY_CLASSES_ROOT>.rar
105. Still in the left panel, locate and delete the key:
     ShellNew
106. In the left panel, double-click the following:
     HKEY_CLASSES_ROOT>.zip
107. Still in the left panel, locate and delete the key:
     ShellNew
108. Again Still in the left panel, locate and delete the key:
     .arj
109. Again Still in the left panel, locate and delete the key:
     .lz
110. Again Still in the left panel, locate and delete the key:
     .tlz
111. Again Still in the left panel, locate and delete the key:
     .tlz
112. Again Still in the left panel, locate and delete the key:
     .lzh
113. Again Still in the left panel, locate and delete the key:
     .lha
114. Again Still in the left panel, locate and delete the key:
     .lha
115. Again Still in the left panel, locate and delete the key:
     .7z
116. Again Still in the left panel, locate and delete the key:
     .tgz
117. Again Still in the left panel, locate and delete the key:
     .uue
118. Again Still in the left panel, locate and delete the key:
     .xxe
119. Again Still in the left panel, locate and delete the key:
     .xxe
120. Again Still in the left panel, locate and delete the key:
     .uu
121. Again Still in the left panel, locate and delete the key:
     .uu
122. Again Still in the left panel, locate and delete the key:
     .bz2
123. Again Still in the left panel, locate and delete the key:
     .tbz2
124. Again Still in the left panel, locate and delete the key:
     .tbz2
125. Again Still in the left panel, locate and delete the key:
     .bz
126. Again Still in the left panel, locate and delete the key:
     .bz
127. Again Still in the left panel, locate and delete the key:
     .tbz
128. Again Still in the left panel, locate and delete the key:
     .tbz
129. Again Still in the left panel, locate and delete the key:
     .taz
130. Again Still in the left panel, locate and delete the key:
     .taz
131. Again Still in the left panel, locate and delete the key:
     .xz
132. Again Still in the left panel, locate and delete the key:
     .txz
133. Again Still in the left panel, locate and delete the key:
     .txz
134. Again Still in the left panel, locate and delete the key:
     .zipx
135. Again Still in the left panel, locate and delete the key:
     .001
136. In the left panel, double-click the following:
     HKEY_CLASSES_ROOT>WinRAR>shell>open
137. Still in the left panel, locate and delete the key:
     command
138. In the left panel, double-click the following:
     HKEY_CLASSES_ROOT>WinRAR
139. Still in the left panel, locate and delete the key:
     DefaultIcon
140. In the left panel, double-click the following:
     HKEY_CLASSES_ROOT>WinRAR.ZIP>shell>open
141. Still in the left panel, locate and delete the key:
     command
142. In the left panel, double-click the following:
     HKEY_CLASSES_ROOT>WinRAR.ZIP
143. Still in the left panel, locate and delete the key:
     DefaultIcon
144. Again Still in the left panel, locate and delete the key:
     .rev
145. Again Still in the left panel, locate and delete the key:
     WinRAR.REV
146. In the left panel, double-click the following:
     HKEY_CLASSES_ROOT>WinRAR.REV>shell>open
147. Still in the left panel, locate and delete the key:
     command
148. In the left panel, double-click the following:
     HKEY_CLASSES_ROOT>WinRAR.REV
149. Still in the left panel, locate and delete the key:
     DefaultIcon
150. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Uninstall
151. Still in the left panel, locate and delete the key:
     WinRAR archiver
152. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor.
   » For Windows 7 and Windows Server 2008 (R2) users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2) users, right-click on the lower-left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>WinRAR SFX
3. In the right panel, locate and delete the entry:
   C%%Program Files (x86)%WinRAR = "%Program Files%\WinRAR"
4. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>WinRAR>Setup>.rar
5. In the right panel, locate and delete the entry:
   Set = "1"
6. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>WinRAR>Setup>.zip
7. In the right panel, locate and delete the entry:
   Set = "1"
8. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>WinRAR>Setup>.cab
9. In the right panel, locate and delete the entry:
   Set = "1"
10. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.arj
11. In the right panel, locate and delete the entry:
    Set = "1"
12. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.lz
13. In the right panel, locate and delete the entry:
    Set = "1"
14. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.lzh
15. In the right panel, locate and delete the entry:
    Set = "1"
16. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.7z
17. In the right panel, locate and delete the entry:
    Set = "1"
18. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.tar
19. In the right panel, locate and delete the entry:
    Set = "1"
20. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.gz
21. In the right panel, locate and delete the entry:
    Set = "1"
22. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.uue
23. In the right panel, locate and delete the entry:
    Set = "1"
24. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.bz2
25. In the right panel, locate and delete the entry:
    Set = "1"
26. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.jar
27. In the right panel, locate and delete the entry:
    Set = "0"
28. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.iso
29. In the right panel, locate and delete the entry:
    Set = "0"
30. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.z
31. In the right panel, locate and delete the entry:
    Set = "1"
32. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.xz
33. In the right panel, locate and delete the entry:
    Set = "1"
34. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.zipx
35. In the right panel, locate and delete the entry:
    Set = "1"
36. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>.001
37. In the right panel, locate and delete the entry:
    Set = "1"
38. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup>Links
39. In the right panel, locate and delete the entry:
    Desktop = "0"
40. Again In the right panel, locate and delete the entry:
    StartMenu = "0"
41. Again In the right panel, locate and delete the entry:
    Programs = "1"
42. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup
43. In the right panel, locate and delete the entry:
    ShellExt = "1"
44. Again In the right panel, locate and delete the entry:
    CascadedMenu = "0"
45. Again In the right panel, locate and delete the entry:
    MenuIcons = "1"
46. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>App Paths>WinRAR.exe
47. In the right panel, locate and delete the entry:
    (Default) = "%Program Files%\WinRAR\WinRAR.exe"
48. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Wow6432Node>WinRAR
49. In the right panel, locate and delete the entry:
    exe32 = "%Program Files%\WinRAR\WinRAR.exe"
50. Again In the right panel, locate and delete the entry:
    Path = "%Program Files%\WinRAR"
51. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{B41DB860-8EE4-11D2-9906-E49FADC173CA}
52. In the right panel, locate and delete the entry:
    (Default) = "WinRAR"
53. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{B41DB860-8EE4-11D2-9906-E49FADC173CA}>InProcServer32
54. In the right panel, locate and delete the entry:
    (Default) = "%Program Files%\WinRAR\rarext.dll"
55. Again In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
56. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>WinRAR>shellex>ContextMenuHandlers>{B41DB860-8EE4-11D2-9906-E49FADC173CA}
57. In the right panel, locate and delete the entry:
    (Default) = ""
58. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>WinRAR>shellex>PropertySheetHandlers>{B41DB860-8EE4-11D2-9906-E49FADC173CA}
59. In the right panel, locate and delete the entry:
    (Default) = ""
60. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>WinRAR.ZIP>shellex>ContextMenuHandlers>{B41DB860-8EE4-11D2-9906-E49FADC173CA}
61. In the right panel, locate and delete the entry:
    (Default) = ""
62. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>WinRAR.ZIP>shellex>PropertySheetHandlers>{B41DB860-8EE4-11D2-9906-E49FADC173CA}
63. In the right panel, locate and delete the entry:
    (Default) = ""
64. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>exefile>shellex>PropertySheetHandlers>{B41DB860-8EE4-11D2-9906-E49FADC173CA}
65. In the right panel, locate and delete the entry:
    (Default) = ""
66. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>WinRAR>shellex>DropHandler
67. In the right panel, locate and delete the entry:
    (Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
68. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>WinRAR.ZIP>shellex>DropHandler
69. In the right panel, locate and delete the entry:
    (Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
70. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>*>shellex>ContextMenuHandlers>WinRAR32
71. In the right panel, locate and delete the entry:
    (Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
72. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Folder>ShellEx>ContextMenuHandlers>WinRAR32
73. In the right panel, locate and delete the entry:
    (Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
74. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Folder>ShellEx>DragDropHandlers>WinRAR32
75. In the right panel, locate and delete the entry:
    (Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
76. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Drive>shellex>DragDropHandlers>WinRAR32
77. In the right panel, locate and delete the entry:
    (Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
78. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>lnkfile>shellex>ContextMenuHandlers>WinRAR32
79. In the right panel, locate and delete the entry:
    (Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
80. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Wow6432Node>Microsoft>Windows>CurrentVersion>Shell Extensions>Approved
81. In the right panel, locate and delete the entry:
    {B41DB860-8EE4-11D2-9906-E49FADC173CA} = "WinRAR shell extension"
82. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B41DB860-64E4-11D2-9906-E49FADC173CA}
83. In the right panel, locate and delete the entry:
    (Default) = "WinRAR"
84. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B41DB860-64E4-11D2-9906-E49FADC173CA}>InProcServer32
85. In the right panel, locate and delete the entry:
    (Default) = "%Program Files%\WinRAR\rarext64.dll"
86. Again In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
87. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>WinRAR>shellex>ContextMenuHandlers>{B41DB860-64E4-11D2-9906-E49FADC173CA}
88. In the right panel, locate and delete the entry:
    (Default) = ""
89. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>WinRAR>shellex>PropertySheetHandlers>{B41DB860-64E4-11D2-9906-E49FADC173CA}
90. In the right panel, locate and delete the entry:
    (Default) = ""
91. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>WinRAR.ZIP>shellex>ContextMenuHandlers>{B41DB860-64E4-11D2-9906-E49FADC173CA}
92. In the right panel, locate and delete the entry:
    (Default) = ""
93. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>WinRAR.ZIP>shellex>PropertySheetHandlers>{B41DB860-64E4-11D2-9906-E49FADC173CA}
94. In the right panel, locate and delete the entry:
    (Default) = ""
95. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>exefile>shellex>PropertySheetHandlers>{B41DB860-64E4-11D2-9906-E49FADC173CA}
96. In the right panel, locate and delete the entry:
    (Default) = ""
97. Again In the right panel, locate and delete the entry:
    (Default) = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"
98. Again In the right panel, locate and delete the entry:
    (Default) = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"
99. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>*>shellex>ContextMenuHandlers>WinRAR
100. In the right panel, locate and delete the entry:
     (Default) = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"
101. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Folder>ShellEx>ContextMenuHandlers>WinRAR
102. In the right panel, locate and delete the entry:
     (Default) = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"
103. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Folder>ShellEx>DragDropHandlers>WinRAR
104. In the right panel, locate and delete the entry:
     (Default) = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"
105. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Drive>shellex>DragDropHandlers>WinRAR
106. In the right panel, locate and delete the entry:
     (Default) = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"
107. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>lnkfile>shellex>ContextMenuHandlers>WinRAR
108. In the right panel, locate and delete the entry:
     (Default) = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"
109. Again In the right panel, locate and delete the entry:
     {B41DB860-64E4-11D2-9906-E49FADC173CA} = "WinRAR shell extension"
110. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>RegisteredApplications
111. In the right panel, locate and delete the entry:
     WinRAR = "Software\WinRAR\Capabilities"
112. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Wow6432Node>WinRAR>Capabilities
113. In the right panel, locate and delete the entry:
     ApplicationDescription = "WinRAR"
114. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Wow6432Node>WinRAR>Capabilities>FileAssociations
115. In the right panel, locate and delete the entry:
     .rar = "WinRAR"
116. Again In the right panel, locate and delete the entry:
     .zip = "WinRAR.ZIP"
117. Again In the right panel, locate and delete the entry:
     .cab = "WinRAR"
118. Again In the right panel, locate and delete the entry:
     .arj = "WinRAR"
119. Again In the right panel, locate and delete the entry:
     .lz = "WinRAR"
120. Again In the right panel, locate and delete the entry:
     .tlz = "WinRAR"
121. Again In the right panel, locate and delete the entry:
     .lzh = "WinRAR"
122. Again In the right panel, locate and delete the entry:
     .lha = "WinRAR"
123. Again In the right panel, locate and delete the entry:
     .7z = "WinRAR"
124. Again In the right panel, locate and delete the entry:
     .tar = "WinRAR"
125. Again In the right panel, locate and delete the entry:
     .gz = "WinRAR"
126. Again In the right panel, locate and delete the entry:
     .tgz = "WinRAR"
127. Again In the right panel, locate and delete the entry:
     .uue = "WinRAR"
128. Again In the right panel, locate and delete the entry:
     .xxe = "WinRAR"
129. Again In the right panel, locate and delete the entry:
     .uu = "WinRAR"
130. Again In the right panel, locate and delete the entry:
     .bz2 = "WinRAR"
131. Again In the right panel, locate and delete the entry:
     .tbz2 = "WinRAR"
132. Again In the right panel, locate and delete the entry:
     .bz = "WinRAR"
133. Again In the right panel, locate and delete the entry:
     .tbz = "WinRAR"
134. Again In the right panel, locate and delete the entry:
     .jar = "WinRAR"
135. Again In the right panel, locate and delete the entry:
     .iso = "WinRAR"
136. Again In the right panel, locate and delete the entry:
     .z = "WinRAR"
137. Again In the right panel, locate and delete the entry:
     .taz = "WinRAR"
138. Again In the right panel, locate and delete the entry:
     .xz = "WinRAR"
139. Again In the right panel, locate and delete the entry:
     .txz = "WinRAR"
140. Again In the right panel, locate and delete the entry:
     .zipx = "WinRAR"
141. Again In the right panel, locate and delete the entry:
     .001 = "WinRAR"
142. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Wow6432Node>Microsoft>Windows>CurrentVersion>explorer
143. In the right panel, locate and delete the entry:
     GlobalAssocChangedCounter = "12"
144. Again In the right panel, locate and delete the entry:
     Exist = "0"
145. Again In the right panel, locate and delete the entry:
     Type = ""
146. Again In the right panel, locate and delete the entry:
     ShellNew = ""
147. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.rar
148. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
149. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.r00
150. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
151. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.r01
152. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
153. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.r02
154. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
155. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.r03
156. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
157. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.r04
158. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
159. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.r05
160. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
161. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.r06
162. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
163. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.r07
164. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
165. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.r08
166. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
167. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.r09
168. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
169. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.r10
170. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
171. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.r11
172. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
173. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.r12
174. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
175. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.r13
176. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
177. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.r14
178. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
179. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.r15
180. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
181. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.r16
182. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
183. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.r17
184. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
185. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.r18
186. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
187. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.r19
188. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
189. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.r20
190. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
191. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.r21
192. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
193. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.r22
194. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
195. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.r23
196. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
197. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.r24
198. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
199. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.r25
200. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
201. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.r26
202. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
203. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.r27
204. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
205. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.r28
206. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
207. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.r29
208. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
209. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.rar>ShellNew
210. In the right panel, locate and delete the entry:
     FileName = "%Program Files%\WinRAR\rarnew.dat"
211. Again In the right panel, locate and delete the entry:
     Exist = "1"
212. Again In the right panel, locate and delete the entry:
     Type = "CompressedFolder"
213. Again In the right panel, locate and delete the entry:
     ShellNew = ""
214. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.zip>ShellNew
215. In the right panel, locate and delete the entry:
     FileName = "%Program Files%\WinRAR\zipnew.dat"
216. Again In the right panel, locate and delete the entry:
     Exist = "1"
217. Again In the right panel, locate and delete the entry:
     Type = "CABFolder"
218. Again In the right panel, locate and delete the entry:
     ShellNew = ""
219. Again In the right panel, locate and delete the entry:
     Exist = "0"
220. Again In the right panel, locate and delete the entry:
     Type = ""
221. Again In the right panel, locate and delete the entry:
     ShellNew = ""
222. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.arj
223. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
224. Again In the right panel, locate and delete the entry:
     Exist = "0"
225. Again In the right panel, locate and delete the entry:
     Type = ""
226. Again In the right panel, locate and delete the entry:
     ShellNew = ""
227. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.lz
228. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
229. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>WinRAR>Setup>.tlz
230. In the right panel, locate and delete the entry:
     Exist = "0"
231. Again In the right panel, locate and delete the entry:
     Type = ""
232. Again In the right panel, locate and delete the entry:
     ShellNew = ""
233. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.tlz
234. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
235. Again In the right panel, locate and delete the entry:
     Exist = "0"
236. Again In the right panel, locate and delete the entry:
     Type = ""
237. Again In the right panel, locate and delete the entry:
     ShellNew = ""
238. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.lzh
239. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
240. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>WinRAR>Setup>.lha
241. In the right panel, locate and delete the entry:
     Exist = "0"
242. Again In the right panel, locate and delete the entry:
     Type = ""
243. Again In the right panel, locate and delete the entry:
     ShellNew = ""
244. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.lha
245. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
246. Again In the right panel, locate and delete the entry:
     Exist = "0"
247. Again In the right panel, locate and delete the entry:
     Type = ""
248. Again In the right panel, locate and delete the entry:
     ShellNew = ""
249. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.7z
250. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
251. Again In the right panel, locate and delete the entry:
     Exist = "1"
252. Again In the right panel, locate and delete the entry:
     Type = ""
253. Again In the right panel, locate and delete the entry:
     ShellNew = ""
254. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.tar
255. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
256. Again In the right panel, locate and delete the entry:
     Exist = "1"
257. Again In the right panel, locate and delete the entry:
     Type = ""
258. Again In the right panel, locate and delete the entry:
     ShellNew = ""
259. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.gz
260. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
261. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>WinRAR>Setup>.tgz
262. In the right panel, locate and delete the entry:
     Exist = "1"
263. Again In the right panel, locate and delete the entry:
     Type = ""
264. Again In the right panel, locate and delete the entry:
     ShellNew = ""
265. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.tgz
266. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
267. Again In the right panel, locate and delete the entry:
     Exist = "0"
268. Again In the right panel, locate and delete the entry:
     Type = ""
269. Again In the right panel, locate and delete the entry:
     ShellNew = ""
270. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.uue
271. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
272. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>WinRAR>Setup>.xxe
273. In the right panel, locate and delete the entry:
     Exist = "0"
274. Again In the right panel, locate and delete the entry:
     Type = ""
275. Again In the right panel, locate and delete the entry:
     ShellNew = ""
276. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.xxe
277. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
278. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>WinRAR>Setup>.uu
279. In the right panel, locate and delete the entry:
     Exist = "0"
280. Again In the right panel, locate and delete the entry:
     Type = ""
281. Again In the right panel, locate and delete the entry:
     ShellNew = ""
282. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.uu
283. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
284. Again In the right panel, locate and delete the entry:
     Exist = "0"
285. Again In the right panel, locate and delete the entry:
     Type = ""
286. Again In the right panel, locate and delete the entry:
     ShellNew = ""
287. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.bz2
288. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
289. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>WinRAR>Setup>.tbz2
290. In the right panel, locate and delete the entry:
     Exist = "0"
291. Again In the right panel, locate and delete the entry:
     Type = ""
292. Again In the right panel, locate and delete the entry:
     ShellNew = ""
293. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.tbz2
294. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
295. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>WinRAR>Setup>.bz
296. In the right panel, locate and delete the entry:
     Exist = "0"
297. Again In the right panel, locate and delete the entry:
     Type = ""
298. Again In the right panel, locate and delete the entry:
     ShellNew = ""
299. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.bz
300. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
301. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>WinRAR>Setup>.tbz
302. In the right panel, locate and delete the entry:
     Exist = "0"
303. Again In the right panel, locate and delete the entry:
     Type = ""
304. Again In the right panel, locate and delete the entry:
     ShellNew = ""
305. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.tbz
306. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
307. Again In the right panel, locate and delete the entry:
     Exist = "1"
308. Again In the right panel, locate and delete the entry:
     Type = ""
309. Again In the right panel, locate and delete the entry:
     ShellNew = ""
310. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.z
311. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
312. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>WinRAR>Setup>.taz
313. In the right panel, locate and delete the entry:
     Exist = "0"
314. Again In the right panel, locate and delete the entry:
     Type = ""
315. Again In the right panel, locate and delete the entry:
     ShellNew = ""
316. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.taz
317. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
318. Again In the right panel, locate and delete the entry:
     Exist = "0"
319. Again In the right panel, locate and delete the entry:
     Type = ""
320. Again In the right panel, locate and delete the entry:
     ShellNew = ""
321. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.xz
322. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
323. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>WinRAR>Setup>.txz
324. In the right panel, locate and delete the entry:
     Exist = "0"
325. Again In the right panel, locate and delete the entry:
     Type = ""
326. Again In the right panel, locate and delete the entry:
     ShellNew = ""
327. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.txz
328. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
329. Again In the right panel, locate and delete the entry:
     Exist = "0"
330. Again In the right panel, locate and delete the entry:
     Type = ""
331. Again In the right panel, locate and delete the entry:
     ShellNew = ""
332. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.zipx
333. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
334. Again In the right panel, locate and delete the entry:
     Exist = "0"
335. Again In the right panel, locate and delete the entry:
     Type = ""
336. Again In the right panel, locate and delete the entry:
     ShellNew = ""
337. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.001
338. In the right panel, locate and delete the entry:
     (Default) = "WinRAR"
339. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>WinRAR
340. In the right panel, locate and delete the entry:
     (Default) = "WinRAR \xd8\xa3\xd8\xb1\xd8\xb4\xd9\x8a\xd9\x81"
341. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>WinRAR>shell>open>command
342. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\WinRAR\WinRAR.exe %1"
343. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>WinRAR>DefaultIcon
344. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\WinRAR\WinRAR.exe,0"
345. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>WinRAR.ZIP
346. In the right panel, locate and delete the entry:
     (Default) = "WinRAR ZIP \xd8\xa3\xd8\xb1\xd8\xb4\xd9\x8a\xd9\x81"
347. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>WinRAR.ZIP>shell>open>command
348. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\WinRAR\WinRAR.exe %1"
349. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>WinRAR.ZIP>DefaultIcon
350. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\WinRAR\WinRAR.exe,0"
351. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.rev
352. In the right panel, locate and delete the entry:
     (Default) = "WinRAR.REV"
353. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>WinRAR.REV
354. In the right panel, locate and delete the entry:
     (Default) = "{random characters}"
355. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>WinRAR.REV>shell>open>command
356. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\WinRAR\WinRAR.exe %1"
357. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>WinRAR.REV>DefaultIcon
358. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\WinRAR\WinRAR.exe,1"
359. Again In the right panel, locate and delete the entry:
     GlobalAssocChangedCounter = "13"
360. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Wow6432Node>Microsoft>Windows>CurrentVersion>Uninstall>WinRAR archiver
361. In the right panel, locate and delete the entry:
     DisplayName = "WinRAR 5.71 (32-\xd8\xa8\xd8\xaa)"
362. Again In the right panel, locate and delete the entry:
     DisplayVersion = "5.71.0"
363. Again In the right panel, locate and delete the entry:
     VersionMajor = "5"
364. Again In the right panel, locate and delete the entry:
     VersionMinor = "71"
365. Again In the right panel, locate and delete the entry:
     UninstallString = "%Program Files%\WinRAR\uninstall.exe"
366. Again In the right panel, locate and delete the entry:
     DisplayIcon = "%Program Files%\WinRAR\WinRAR.exe"
367. Again In the right panel, locate and delete the entry:
     InstallLocation = "%Program Files%\WinRAR"
368. Again In the right panel, locate and delete the entry:
     NoModify = "1"
369. Again In the right panel, locate and delete the entry:
     NoRepair = "1"
370. Again In the right panel, locate and delete the entry:
     Language = "0"
371. Again In the right panel, locate and delete the entry:
     Publisher = "win.rar GmbH"
372. Close Registry Editor.

To restore registry values this malware/grayware modified:

1. Open Registry Editor. To do this:
   
   • On Windows 7 and Server 2008 (R2):
     Click the Start button, type REGEDIT in the Search input field then press Enter.
   • On Windows 8, 8.1, 10, and Server 2012 (R2):
     Right-click on the lower left corner of the screen and click Run, type REGEDIT in the Run input field, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.zip
3. In the right panel, locate the registry value:
   (Default) = "WinRAR.ZIP"
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   (Default) = "CompressedFolder"
5. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>.cab
6. In the right panel, locate the registry value:
   (Default) = "WinRAR"
7. Right-click on the value name and choose Modify. Change the value data of this entry to:
   (Default) = "CLSID\{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"
8. Close Registry Editor.

To manually delete a malware/grayware file from an affected system:

•For Windows 7, Windows Server 2008 (R2), Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2):

1. Open a Windows Explorer window.
   • For Windows 7 and Server 2008 (R2) users, click Start>Computer.
   • For Windows 8, 8.1, 10, and Server 2012 (R2) users, right-click on the lower-left corner of the screen,then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %Program Files%\WinRAR\winrar.lng
   • %Program Files%\WinRAR\WinCon.SFX
   • %Program Files%\WinRAR\RarExt.dll
   • %Program Files%\WinRAR\Default.SFX
   • %Program Files%\WinRAR\rarext.lng
   • %Program Files%\WinRAR\Rar.exe
   • %Start Menu%\Programs\WinRAR\WinRAR.lnk
   • %Program Files%\WinRAR\UnRAR.exe
   • %Program Files%\WinRAR\ReadMe.txt
   • %Program Files%\WinRAR\Zip.SFX
   • %Start Menu%\Programs\WinRAR\xd8\xaa\xd8\xb9\xd9\x84\xd9\x8a\xd9\x85\xd8\xa7\xd8\xaa WinRAR.lnk
   • %Program Files%\WinRAR\RarExt64.dll
   • %Program Files%\WinRAR\Rar.txt
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\WinRAR\xd8\xaf\xd9\x84\xd9\x8a\xd9\x84 \xd9\x84\xd9\x88\xd8\xad\xd8\xa9 RAR \xd8\xa7\xd9\x84\xd8\xb7\xd8\xb1\xd9\x81\xd9\x8a\xd8\xa9.lnk
   • %Program Files%\WinRAR\rar.lng
   • %Program Files%\WinRAR\zipnew.dat
   • %Program Files%\WinRAR\Order.htm
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk
   • %Start Menu%\Programs\WinRAR\xd8\xaf\xd9\x84\xd9\x8a\xd9\x84 \xd9\x84\xd9\x88\xd8\xad\xd8\xa9 RAR \xd8\xa7\xd9\x84\xd8\xb7\xd8\xb1\xd9\x81\xd9\x8a\xd8\xa9.lnk
   • %Program Files%\WinRAR\Uninstall.lst
   • %Start Menu%\Programs\WinRAR\xd9\x85\xd8\xa7 \xd9\x87\xd9\x88 \xd8\xa7\xd9\x84\xd8\xac\xd8\xaf\xd9\x8a\xd8\xaf \xd9\x81\xd9\x8a \xd8\xa7\xd9\x84\xd9\x86\xd8\xb3\xd8\xae\xd8\xa9 \xd8\xa7\xd9\x84\xd8\xa3\xd8\xae\xd9\x8a\xd8\xb1\xd8\xa9.lnk
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\WinRAR\xd8\xaa\xd8\xb9\xd9\x84\xd9\x8a\xd9\x85\xd8\xa7\xd8\xaa WinRAR.lnk
   • %Program Files%\WinRAR\Descript.ion
   • %Program Files%\WinRAR\Uninstall.exe
   • %Program Files%\WinRAR\7zxa.dll
   • %Program Files%\WinRAR\WinRAR.chm
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\WinRAR\xd9\x85\xd8\xa7 \xd9\x87\xd9\x88 \xd8\xa7\xd9\x84\xd8\xac\xd8\xaf\xd9\x8a\xd8\xaf \xd9\x81\xd9\x8a \xd8\xa7\xd9\x84\xd9\x86\xd8\xb3\xd8\xae\xd8\xa9 \xd8\xa7\xd9\x84\xd8\xa3\xd8\xae\xd9\x8a\xd8\xb1\xd8\xa9.lnk
   • %Program Files%\WinRAR\License.txt
   • %Program Files%\WinRAR\uninstall.lng
   • %Program Files%\WinRAR\WhatsNew.txt
   • %User Temp%\RarSFX0\winrar-x32-571ar.exe
   • %Program Files%\WinRAR\RarFiles.lst
   • %Program Files%\WinRAR\rarnew.dat
   • %Program Files%\WinRAR\WinRAR.exe
3. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7 and Windows Server 2008 (R2).

To delete malware/grayware/spyware folders:

For Windows 7, Windows Server 2008 (R2), Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2):

1. Open a Windows Explorer window.
   • For Windows 7 and Server 2008 (R2) users, click Start>Computer.
   • For Windows 8, 8.1, 10, and Server 2012 (R2) users, right-click on the lower-left corner of the screen,then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %Start Menu%\Programs\WinRAR
   • %System Root%\Users
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\WinRAR
   • %User Temp%\RarSFX0
   • %User Profile%\AppData
   • %Program Files%\WinRAR
3. Once located, select the file then press SHIFT+DELETE to permanently delete the folder.
4. Repeat steps 2-3 for the remaining folders:
   • %Start Menu%\Programs\WinRAR
   • %System Root%\Users
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\WinRAR
   • %User Temp%\RarSFX0
   • %User Profile%\AppData
   • %Program Files%\WinRAR
   *Note: Read the following Microsoft page if these steps do not work on Windows 7 and Server 2008 (R2).