TSPY_BANCOS.ATL

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall
3. Still in the left panel, locate and delete the key:
   WinRAR (USB Edition) 3.79
4. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>WinRAR>Formats
5. Still in the left panel, locate and delete the key:
   7z.fmt
6. Again Still in the left panel, locate and delete the key:
   ace.fmt
7. Again Still in the left panel, locate and delete the key:
   arj.fmt
8. Again Still in the left panel, locate and delete the key:
   bz2.fmt
9. Again Still in the left panel, locate and delete the key:
   cab.fmt
10. Again Still in the left panel, locate and delete the key:
    gz.fmt
11. Again Still in the left panel, locate and delete the key:
    iso.fmt
12. Again Still in the left panel, locate and delete the key:
    lzh.fmt
13. Again Still in the left panel, locate and delete the key:
    tar.fmt
14. Again Still in the left panel, locate and delete the key:
    uue.fmt
15. Again Still in the left panel, locate and delete the key:
    z.fmt
16. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Profiles
17. Still in the left panel, locate and delete the key:
    0
18. Again Still in the left panel, locate and delete the key:
    1
19. Again Still in the left panel, locate and delete the key:
    2
20. Again Still in the left panel, locate and delete the key:
    3
21. Again Still in the left panel, locate and delete the key:
    4
22. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR
23. Still in the left panel, locate and delete the key:
    General
24. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Interface
25. Still in the left panel, locate and delete the key:
    Themes
26. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Setup
27. Still in the left panel, locate and delete the key:
    .rar
28. Again Still in the left panel, locate and delete the key:
    .zip
29. Again Still in the left panel, locate and delete the key:
    .cab
30. Again Still in the left panel, locate and delete the key:
    .arj
31. Again Still in the left panel, locate and delete the key:
    .lzh
32. Again Still in the left panel, locate and delete the key:
    .ace
33. Again Still in the left panel, locate and delete the key:
    .7z
34. Again Still in the left panel, locate and delete the key:
    .tar
35. Again Still in the left panel, locate and delete the key:
    .gz
36. Again Still in the left panel, locate and delete the key:
    .uue
37. Again Still in the left panel, locate and delete the key:
    .bz2
38. Again Still in the left panel, locate and delete the key:
    .jar
39. Again Still in the left panel, locate and delete the key:
    .iso
40. Again Still in the left panel, locate and delete the key:
    .z
41. Again Still in the left panel, locate and delete the key:
    Links
42. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>App Paths
43. Still in the left panel, locate and delete the key:
    WinRAR.exe
44. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID
45. Still in the left panel, locate and delete the key:
    {B41DB860-8EE4-11D2-9906-E49FADC173CA}
46. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID>{B41DB860-8EE4-11D2-9906-E49FADC173CA}
47. Still in the left panel, locate and delete the key:
    InProcServer32
48. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>WinRAR>shellex>ContextMenuHandlers
49. Still in the left panel, locate and delete the key:
    {B41DB860-8EE4-11D2-9906-E49FADC173CA}
50. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>WinRAR>shellex>PropertySheetHandlers
51. Still in the left panel, locate and delete the key:
    {B41DB860-8EE4-11D2-9906-E49FADC173CA}
52. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>WinRAR.ZIP>shellex>ContextMenuHandlers
53. Still in the left panel, locate and delete the key:
    {B41DB860-8EE4-11D2-9906-E49FADC173CA}
54. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>WinRAR.ZIP>shellex>PropertySheetHandlers
55. Still in the left panel, locate and delete the key:
    {B41DB860-8EE4-11D2-9906-E49FADC173CA}
56. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>exefile>shellex>PropertySheetHandlers
57. Still in the left panel, locate and delete the key:
    {B41DB860-8EE4-11D2-9906-E49FADC173CA}
58. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>WinRAR>shellex
59. Still in the left panel, locate and delete the key:
    DropHandler
60. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>WinRAR.ZIP>shellex
61. Still in the left panel, locate and delete the key:
    DropHandler
62. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>*>shellex>ContextMenuHandlers
63. Still in the left panel, locate and delete the key:
    WinRAR
64. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>Folder>shellex>ContextMenuHandlers
65. Still in the left panel, locate and delete the key:
    WinRAR
66. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>Folder>shellex>DragDropHandlers
67. Still in the left panel, locate and delete the key:
    WinRAR
68. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>Drive>shellex>DragDropHandlers
69. Still in the left panel, locate and delete the key:
    WinRAR
70. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>Directory>shellex>ContextMenuHandlers
71. Still in the left panel, locate and delete the key:
    WinRAR
72. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>Directory>shellex>DragDropHandlers
73. Still in the left panel, locate and delete the key:
    WinRAR
74. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>WinRAR>shell>open
75. Still in the left panel, locate and delete the key:
    command
76. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>WinRAR
77. Still in the left panel, locate and delete the key:
    DefaultIcon
78. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>WinRAR.ZIP>shell>open
79. Still in the left panel, locate and delete the key:
    command
80. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>WinRAR.ZIP
81. Still in the left panel, locate and delete the key:
    DefaultIcon
82. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT
83. Still in the left panel, locate and delete the key:
    .rev
84. Again Still in the left panel, locate and delete the key:
    WinRAR.REV
85. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>WinRAR.REV>shell>open
86. Still in the left panel, locate and delete the key:
    command
87. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>WinRAR.REV
88. Still in the left panel, locate and delete the key:
    DefaultIcon
89. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Uninstall>WinRAR (USB Edition) 3.79
3. In the right panel, locate and delete the entry:
   DisplayName = "WinRAR (USB Edition) 3.79"
4. Again In the right panel, locate and delete the entry:
   DisplayIcon = "%User Temp%\Uninstall.exe"
5. Again In the right panel, locate and delete the entry:
   UninstallString = "%User Temp%\Uninstall.exe"
6. Again In the right panel, locate and delete the entry:
   NoModify = "1"
7. Again In the right panel, locate and delete the entry:
   NoRepair = "1"
8. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>WinRAR>Formats>7z.fmt
9. In the right panel, locate and delete the entry:
   Info = "{random values}"
10. Again In the right panel, locate and delete the entry:
    Ident = "e721d80015c00"
11. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Formats>ace.fmt
12. In the right panel, locate and delete the entry:
    Info = "{random values}"
13. Again In the right panel, locate and delete the entry:
    Ident = "e721d800dc00"
14. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Formats>arj.fmt
15. In the right panel, locate and delete the entry:
    Info = "{random values}"
16. Again In the right panel, locate and delete the entry:
    Ident = "e721d800d000"
17. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Formats>bz2.fmt
18. In the right panel, locate and delete the entry:
    Info = "{random values}"
19. Again In the right panel, locate and delete the entry:
    Ident = "e721d80012000"
20. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Formats>cab.fmt
21. In the right panel, locate and delete the entry:
    Info = "{random values}"
22. Again In the right panel, locate and delete the entry:
    Ident = "e721d800c800"
23. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Formats>gz.fmt
24. In the right panel, locate and delete the entry:
    Info = "{random values}"
25. Again In the right panel, locate and delete the entry:
    Ident = "e721d800f800"
26. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Formats>iso.fmt
27. In the right panel, locate and delete the entry:
    Info = "{random values}"
28. Again In the right panel, locate and delete the entry:
    Ident = "e721d80012000"
29. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Formats>lzh.fmt
30. In the right panel, locate and delete the entry:
    Info = "{random values}"
31. Again In the right panel, locate and delete the entry:
    Ident = "e721d800e400"
32. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Formats>tar.fmt
33. In the right panel, locate and delete the entry:
    Info = "{random values}"
34. Again In the right panel, locate and delete the entry:
    Ident = "e721d800d800"
35. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Formats>uue.fmt
36. In the right panel, locate and delete the entry:
    Info = "{random values}"
37. Again In the right panel, locate and delete the entry:
    Ident = "e721d800bc00"
38. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Formats>z.fmt
39. In the right panel, locate and delete the entry:
    Info = "{random values}"
40. Again In the right panel, locate and delete the entry:
    Ident = "e721d800e800"
41. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Profiles>0
42. In the right panel, locate and delete the entry:
    Name = "Default Profile"
43. Again In the right panel, locate and delete the entry:
    Default = "1"
44. Again In the right panel, locate and delete the entry:
    ImmExec = "0"
45. Again In the right panel, locate and delete the entry:
    UseRAR = "1"
46. Again In the right panel, locate and delete the entry:
    SFXElevate = "0"
47. Again In the right panel, locate and delete the entry:
    CmtTextData = "{random values}"
48. Again In the right panel, locate and delete the entry:
    VolumeSize = "0"
49. Again In the right panel, locate and delete the entry:
    VolPause = "0"
50. Again In the right panel, locate and delete the entry:
    OldVolNames = "0"
51. Again In the right panel, locate and delete the entry:
    RecVolNumber = "0"
52. Again In the right panel, locate and delete the entry:
    Update = "0"
53. Again In the right panel, locate and delete the entry:
    Fresh = "0"
54. Again In the right panel, locate and delete the entry:
    SyncFiles = "0"
55. Again In the right panel, locate and delete the entry:
    Move = "0"
56. Again In the right panel, locate and delete the entry:
    Solid = "0"
57. Again In the right panel, locate and delete the entry:
    AV = "0"
58. Again In the right panel, locate and delete the entry:
    Test = "0"
59. Again In the right panel, locate and delete the entry:
    Recovery = "0"
60. Again In the right panel, locate and delete the entry:
    EraseDest = "0"
61. Again In the right panel, locate and delete the entry:
    AddArcOnly = "0"
62. Again In the right panel, locate and delete the entry:
    ClearArc = "0"
63. Again In the right panel, locate and delete the entry:
    Lock = "0"
64. Again In the right panel, locate and delete the entry:
    Method = "3"
65. Again In the right panel, locate and delete the entry:
    DictSizeLZ = "4"
66. Again In the right panel, locate and delete the entry:
    Background = "0"
67. Again In the right panel, locate and delete the entry:
    WaitForOther = "0"
68. Again In the right panel, locate and delete the entry:
    Shutdown = "0"
69. Again In the right panel, locate and delete the entry:
    Password = "{random values}"
70. Again In the right panel, locate and delete the entry:
    EncryptHeaders = "0"
71. Again In the right panel, locate and delete the entry:
    OpenShared = "0"
72. Again In the right panel, locate and delete the entry:
    ProcessOwners = "0"
73. Again In the right panel, locate and delete the entry:
    SaveStreams = "0"
74. Again In the right panel, locate and delete the entry:
    GenerateArcName = "0"
75. Again In the right panel, locate and delete the entry:
    VersionControl = "0"
76. Again In the right panel, locate and delete the entry:
    GenerateMask = "yyyymmddhhnnss"
77. Again In the right panel, locate and delete the entry:
    FileTimeMode = "0"
78. Again In the right panel, locate and delete the entry:
    FileDays = "0"
79. Again In the right panel, locate and delete the entry:
    FileHours = "0"
80. Again In the right panel, locate and delete the entry:
    FileMinutes = "0"
81. Again In the right panel, locate and delete the entry:
    FileTimeBefore = "88"
82. Again In the right panel, locate and delete the entry:
    FileTimeAfter = "88"
83. Again In the right panel, locate and delete the entry:
    ArcTimeOriginal = "0"
84. Again In the right panel, locate and delete the entry:
    ArcTimeLatest = "0"
85. Again In the right panel, locate and delete the entry:
    mtime = "4"
86. Again In the right panel, locate and delete the entry:
    ctime = "0"
87. Again In the right panel, locate and delete the entry:
    atime = "0"
88. Again In the right panel, locate and delete the entry:
    PathsAbs = "0"
89. Again In the right panel, locate and delete the entry:
    PathsNone = "0"
90. Again In the right panel, locate and delete the entry:
    PathsAbsDrive = "0"
91. Again In the right panel, locate and delete the entry:
    SeparateArc = "0"
92. Again In the right panel, locate and delete the entry:
    PackDetails = "{random values}"
93. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>WinRAR>Profiles>1
94. In the right panel, locate and delete the entry:
    Name = "Create e-mail attachment"
95. Again In the right panel, locate and delete the entry:
    Default = "0"
96. Again In the right panel, locate and delete the entry:
    ImmExec = "0"
97. Again In the right panel, locate and delete the entry:
    UseRAR = "1"
98. Again In the right panel, locate and delete the entry:
    SFXElevate = "0"
99. Again In the right panel, locate and delete the entry:
    CmtTextData = "{random values}"
100. Again In the right panel, locate and delete the entry:
     VolumeSize = "0"
101. Again In the right panel, locate and delete the entry:
     VolPause = "0"
102. Again In the right panel, locate and delete the entry:
     OldVolNames = "0"
103. Again In the right panel, locate and delete the entry:
     RecVolNumber = "0"
104. Again In the right panel, locate and delete the entry:
     Update = "0"
105. Again In the right panel, locate and delete the entry:
     Fresh = "0"
106. Again In the right panel, locate and delete the entry:
     SyncFiles = "0"
107. Again In the right panel, locate and delete the entry:
     Move = "0"
108. Again In the right panel, locate and delete the entry:
     Solid = "1"
109. Again In the right panel, locate and delete the entry:
     AV = "1"
110. Again In the right panel, locate and delete the entry:
     Test = "0"
111. Again In the right panel, locate and delete the entry:
     Recovery = "0"
112. Again In the right panel, locate and delete the entry:
     EraseDest = "0"
113. Again In the right panel, locate and delete the entry:
     AddArcOnly = "0"
114. Again In the right panel, locate and delete the entry:
     ClearArc = "0"
115. Again In the right panel, locate and delete the entry:
     Lock = "0"
116. Again In the right panel, locate and delete the entry:
     Method = "5"
117. Again In the right panel, locate and delete the entry:
     DictSizeLZ = "4"
118. Again In the right panel, locate and delete the entry:
     Background = "0"
119. Again In the right panel, locate and delete the entry:
     WaitForOther = "0"
120. Again In the right panel, locate and delete the entry:
     Shutdown = "0"
121. Again In the right panel, locate and delete the entry:
     Password = "{random values}"
122. Again In the right panel, locate and delete the entry:
     EncryptHeaders = "0"
123. Again In the right panel, locate and delete the entry:
     OpenShared = "0"
124. Again In the right panel, locate and delete the entry:
     ProcessOwners = "0"
125. Again In the right panel, locate and delete the entry:
     SaveStreams = "0"
126. Again In the right panel, locate and delete the entry:
     GenerateArcName = "0"
127. Again In the right panel, locate and delete the entry:
     VersionControl = "0"
128. Again In the right panel, locate and delete the entry:
     GenerateMask = "yyyymmddhhnnss"
129. Again In the right panel, locate and delete the entry:
     FileTimeMode = "0"
130. Again In the right panel, locate and delete the entry:
     FileDays = "0"
131. Again In the right panel, locate and delete the entry:
     FileHours = "0"
132. Again In the right panel, locate and delete the entry:
     FileMinutes = "0"
133. Again In the right panel, locate and delete the entry:
     FileTimeBefore = "88"
134. Again In the right panel, locate and delete the entry:
     FileTimeAfter = "88"
135. Again In the right panel, locate and delete the entry:
     ArcTimeOriginal = "0"
136. Again In the right panel, locate and delete the entry:
     ArcTimeLatest = "0"
137. Again In the right panel, locate and delete the entry:
     mtime = "4"
138. Again In the right panel, locate and delete the entry:
     ctime = "0"
139. Again In the right panel, locate and delete the entry:
     atime = "0"
140. Again In the right panel, locate and delete the entry:
     PathsAbs = "0"
141. Again In the right panel, locate and delete the entry:
     PathsNone = "0"
142. Again In the right panel, locate and delete the entry:
     PathsAbsDrive = "0"
143. Again In the right panel, locate and delete the entry:
     SeparateArc = "0"
144. Again In the right panel, locate and delete the entry:
     PackDetails = "{random values}"
145. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>WinRAR>Profiles>2
146. In the right panel, locate and delete the entry:
     Name = "Backup selected files"
147. Again In the right panel, locate and delete the entry:
     Default = "0"
148. Again In the right panel, locate and delete the entry:
     ImmExec = "0"
149. Again In the right panel, locate and delete the entry:
     UseRAR = "1"
150. Again In the right panel, locate and delete the entry:
     SFXElevate = "0"
151. Again In the right panel, locate and delete the entry:
     CmtTextData = "{random values}"
152. Again In the right panel, locate and delete the entry:
     VolumeSize = "0"
153. Again In the right panel, locate and delete the entry:
     VolPause = "0"
154. Again In the right panel, locate and delete the entry:
     OldVolNames = "0"
155. Again In the right panel, locate and delete the entry:
     RecVolNumber = "0"
156. Again In the right panel, locate and delete the entry:
     Update = "0"
157. Again In the right panel, locate and delete the entry:
     Fresh = "0"
158. Again In the right panel, locate and delete the entry:
     SyncFiles = "0"
159. Again In the right panel, locate and delete the entry:
     Move = "0"
160. Again In the right panel, locate and delete the entry:
     Solid = "0"
161. Again In the right panel, locate and delete the entry:
     AV = "0"
162. Again In the right panel, locate and delete the entry:
     Test = "0"
163. Again In the right panel, locate and delete the entry:
     Recovery = "ffffffff"
164. Again In the right panel, locate and delete the entry:
     EraseDest = "0"
165. Again In the right panel, locate and delete the entry:
     AddArcOnly = "0"
166. Again In the right panel, locate and delete the entry:
     ClearArc = "0"
167. Again In the right panel, locate and delete the entry:
     Lock = "0"
168. Again In the right panel, locate and delete the entry:
     Method = "3"
169. Again In the right panel, locate and delete the entry:
     DictSizeLZ = "4"
170. Again In the right panel, locate and delete the entry:
     Background = "0"
171. Again In the right panel, locate and delete the entry:
     WaitForOther = "0"
172. Again In the right panel, locate and delete the entry:
     Shutdown = "0"
173. Again In the right panel, locate and delete the entry:
     Password = "{random values}"
174. Again In the right panel, locate and delete the entry:
     EncryptHeaders = "0"
175. Again In the right panel, locate and delete the entry:
     OpenShared = "1"
176. Again In the right panel, locate and delete the entry:
     ProcessOwners = "0"
177. Again In the right panel, locate and delete the entry:
     SaveStreams = "1"
178. Again In the right panel, locate and delete the entry:
     GenerateArcName = "1"
179. Again In the right panel, locate and delete the entry:
     VersionControl = "0"
180. Again In the right panel, locate and delete the entry:
     GenerateMask = "yyyymmddhhnnss"
181. Again In the right panel, locate and delete the entry:
     FileTimeMode = "0"
182. Again In the right panel, locate and delete the entry:
     FileDays = "0"
183. Again In the right panel, locate and delete the entry:
     FileHours = "0"
184. Again In the right panel, locate and delete the entry:
     FileMinutes = "0"
185. Again In the right panel, locate and delete the entry:
     FileTimeBefore = "88"
186. Again In the right panel, locate and delete the entry:
     FileTimeAfter = "88"
187. Again In the right panel, locate and delete the entry:
     ArcTimeOriginal = "0"
188. Again In the right panel, locate and delete the entry:
     ArcTimeLatest = "0"
189. Again In the right panel, locate and delete the entry:
     mtime = "4"
190. Again In the right panel, locate and delete the entry:
     ctime = "0"
191. Again In the right panel, locate and delete the entry:
     atime = "0"
192. Again In the right panel, locate and delete the entry:
     PathsAbs = "0"
193. Again In the right panel, locate and delete the entry:
     PathsNone = "0"
194. Again In the right panel, locate and delete the entry:
     PathsAbsDrive = "0"
195. Again In the right panel, locate and delete the entry:
     SeparateArc = "0"
196. Again In the right panel, locate and delete the entry:
     PackDetails = "{random values}"
197. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>WinRAR>Profiles>3
198. In the right panel, locate and delete the entry:
     Name = "Create 1.44MB volumes"
199. Again In the right panel, locate and delete the entry:
     Default = "0"
200. Again In the right panel, locate and delete the entry:
     ImmExec = "0"
201. Again In the right panel, locate and delete the entry:
     UseRAR = "1"
202. Again In the right panel, locate and delete the entry:
     SFXElevate = "0"
203. Again In the right panel, locate and delete the entry:
     CmtTextData = "{random values}"
204. Again In the right panel, locate and delete the entry:
     VolumeSize = "1457664"
205. Again In the right panel, locate and delete the entry:
     VolPause = "0"
206. Again In the right panel, locate and delete the entry:
     OldVolNames = "0"
207. Again In the right panel, locate and delete the entry:
     RecVolNumber = "0"
208. Again In the right panel, locate and delete the entry:
     Update = "0"
209. Again In the right panel, locate and delete the entry:
     Fresh = "0"
210. Again In the right panel, locate and delete the entry:
     SyncFiles = "0"
211. Again In the right panel, locate and delete the entry:
     Move = "0"
212. Again In the right panel, locate and delete the entry:
     Solid = "1"
213. Again In the right panel, locate and delete the entry:
     AV = "1"
214. Again In the right panel, locate and delete the entry:
     Test = "0"
215. Again In the right panel, locate and delete the entry:
     Recovery = "ffffffff"
216. Again In the right panel, locate and delete the entry:
     EraseDest = "0"
217. Again In the right panel, locate and delete the entry:
     AddArcOnly = "0"
218. Again In the right panel, locate and delete the entry:
     ClearArc = "0"
219. Again In the right panel, locate and delete the entry:
     Lock = "0"
220. Again In the right panel, locate and delete the entry:
     Method = "5"
221. Again In the right panel, locate and delete the entry:
     DictSizeLZ = "4"
222. Again In the right panel, locate and delete the entry:
     Background = "0"
223. Again In the right panel, locate and delete the entry:
     WaitForOther = "0"
224. Again In the right panel, locate and delete the entry:
     Shutdown = "0"
225. Again In the right panel, locate and delete the entry:
     Password = "{random values}"
226. Again In the right panel, locate and delete the entry:
     EncryptHeaders = "0"
227. Again In the right panel, locate and delete the entry:
     OpenShared = "0"
228. Again In the right panel, locate and delete the entry:
     ProcessOwners = "0"
229. Again In the right panel, locate and delete the entry:
     SaveStreams = "0"
230. Again In the right panel, locate and delete the entry:
     GenerateArcName = "0"
231. Again In the right panel, locate and delete the entry:
     VersionControl = "0"
232. Again In the right panel, locate and delete the entry:
     GenerateMask = "yyyymmddhhnnss"
233. Again In the right panel, locate and delete the entry:
     FileTimeMode = "0"
234. Again In the right panel, locate and delete the entry:
     FileDays = "0"
235. Again In the right panel, locate and delete the entry:
     FileHours = "0"
236. Again In the right panel, locate and delete the entry:
     FileMinutes = "0"
237. Again In the right panel, locate and delete the entry:
     FileTimeBefore = "88"
238. Again In the right panel, locate and delete the entry:
     FileTimeAfter = "88"
239. Again In the right panel, locate and delete the entry:
     ArcTimeOriginal = "0"
240. Again In the right panel, locate and delete the entry:
     ArcTimeLatest = "0"
241. Again In the right panel, locate and delete the entry:
     mtime = "4"
242. Again In the right panel, locate and delete the entry:
     ctime = "0"
243. Again In the right panel, locate and delete the entry:
     atime = "0"
244. Again In the right panel, locate and delete the entry:
     PathsAbs = "0"
245. Again In the right panel, locate and delete the entry:
     PathsNone = "0"
246. Again In the right panel, locate and delete the entry:
     PathsAbsDrive = "0"
247. Again In the right panel, locate and delete the entry:
     SeparateArc = "0"
248. Again In the right panel, locate and delete the entry:
     PackDetails = "{random values}"
249. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>WinRAR>Profiles>4
250. In the right panel, locate and delete the entry:
     Name = "ZIP archive (low compression)"
251. Again In the right panel, locate and delete the entry:
     Default = "0"
252. Again In the right panel, locate and delete the entry:
     ImmExec = "0"
253. Again In the right panel, locate and delete the entry:
     UseRAR = "0"
254. Again In the right panel, locate and delete the entry:
     SFXElevate = "0"
255. Again In the right panel, locate and delete the entry:
     CmtTextData = "{random values}"
256. Again In the right panel, locate and delete the entry:
     VolumeSize = "0"
257. Again In the right panel, locate and delete the entry:
     VolPause = "0"
258. Again In the right panel, locate and delete the entry:
     OldVolNames = "0"
259. Again In the right panel, locate and delete the entry:
     RecVolNumber = "0"
260. Again In the right panel, locate and delete the entry:
     Update = "0"
261. Again In the right panel, locate and delete the entry:
     Fresh = "0"
262. Again In the right panel, locate and delete the entry:
     SyncFiles = "0"
263. Again In the right panel, locate and delete the entry:
     Move = "0"
264. Again In the right panel, locate and delete the entry:
     Solid = "0"
265. Again In the right panel, locate and delete the entry:
     AV = "0"
266. Again In the right panel, locate and delete the entry:
     Test = "0"
267. Again In the right panel, locate and delete the entry:
     Recovery = "0"
268. Again In the right panel, locate and delete the entry:
     EraseDest = "0"
269. Again In the right panel, locate and delete the entry:
     AddArcOnly = "0"
270. Again In the right panel, locate and delete the entry:
     ClearArc = "0"
271. Again In the right panel, locate and delete the entry:
     Lock = "0"
272. Again In the right panel, locate and delete the entry:
     Method = "5"
273. Again In the right panel, locate and delete the entry:
     DictSizeLZ = "4"
274. Again In the right panel, locate and delete the entry:
     Background = "0"
275. Again In the right panel, locate and delete the entry:
     WaitForOther = "0"
276. Again In the right panel, locate and delete the entry:
     Shutdown = "0"
277. Again In the right panel, locate and delete the entry:
     Password = "{random values}"
278. Again In the right panel, locate and delete the entry:
     EncryptHeaders = "0"
279. Again In the right panel, locate and delete the entry:
     OpenShared = "0"
280. Again In the right panel, locate and delete the entry:
     ProcessOwners = "0"
281. Again In the right panel, locate and delete the entry:
     SaveStreams = "0"
282. Again In the right panel, locate and delete the entry:
     GenerateArcName = "0"
283. Again In the right panel, locate and delete the entry:
     VersionControl = "0"
284. Again In the right panel, locate and delete the entry:
     GenerateMask = "yyyymmddhhnnss"
285. Again In the right panel, locate and delete the entry:
     FileTimeMode = "0"
286. Again In the right panel, locate and delete the entry:
     FileDays = "0"
287. Again In the right panel, locate and delete the entry:
     FileHours = "0"
288. Again In the right panel, locate and delete the entry:
     FileMinutes = "0"
289. Again In the right panel, locate and delete the entry:
     FileTimeBefore = "88"
290. Again In the right panel, locate and delete the entry:
     FileTimeAfter = "88"
291. Again In the right panel, locate and delete the entry:
     ArcTimeOriginal = "0"
292. Again In the right panel, locate and delete the entry:
     ArcTimeLatest = "0"
293. Again In the right panel, locate and delete the entry:
     mtime = "4"
294. Again In the right panel, locate and delete the entry:
     ctime = "0"
295. Again In the right panel, locate and delete the entry:
     atime = "0"
296. Again In the right panel, locate and delete the entry:
     PathsAbs = "0"
297. Again In the right panel, locate and delete the entry:
     PathsNone = "0"
298. Again In the right panel, locate and delete the entry:
     PathsAbsDrive = "0"
299. Again In the right panel, locate and delete the entry:
     SeparateArc = "0"
300. Again In the right panel, locate and delete the entry:
     PackDetails = "{random values}"
301. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>WinRAR>General
302. In the right panel, locate and delete the entry:
     AppDataCopied = "1"
303. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>WinRAR>Setup>.rar
304. In the right panel, locate and delete the entry:
     Set = "0"
305. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>WinRAR>Setup>.zip
306. In the right panel, locate and delete the entry:
     Set = "0"
307. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>WinRAR>Setup>.cab
308. In the right panel, locate and delete the entry:
     Set = "0"
309. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>WinRAR>Setup>.arj
310. In the right panel, locate and delete the entry:
     Set = "0"
311. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>WinRAR>Setup>.lzh
312. In the right panel, locate and delete the entry:
     Set = "0"
313. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>WinRAR>Setup>.ace
314. In the right panel, locate and delete the entry:
     Set = "0"
315. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>WinRAR>Setup>.7z
316. In the right panel, locate and delete the entry:
     Set = "0"
317. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>WinRAR>Setup>.tar
318. In the right panel, locate and delete the entry:
     Set = "0"
319. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>WinRAR>Setup>.gz
320. In the right panel, locate and delete the entry:
     Set = "0"
321. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>WinRAR>Setup>.uue
322. In the right panel, locate and delete the entry:
     Set = "0"
323. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>WinRAR>Setup>.bz2
324. In the right panel, locate and delete the entry:
     Set = "0"
325. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>WinRAR>Setup>.jar
326. In the right panel, locate and delete the entry:
     Set = "0"
327. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>WinRAR>Setup>.iso
328. In the right panel, locate and delete the entry:
     Set = "0"
329. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>WinRAR>Setup>.z
330. In the right panel, locate and delete the entry:
     Set = "0"
331. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>WinRAR>Setup>Links
332. In the right panel, locate and delete the entry:
     Desktop = "0"
333. Again In the right panel, locate and delete the entry:
     StartMenu = "0"
334. Again In the right panel, locate and delete the entry:
     Programs = "1"
335. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>WinRAR>Setup
336. In the right panel, locate and delete the entry:
     ShellExt = "1"
337. Again In the right panel, locate and delete the entry:
     CascadedMenu = "0"
338. Again In the right panel, locate and delete the entry:
     MenuIcons = "1"
339. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>App Paths>WinRAR.exe
340. In the right panel, locate and delete the entry:
     Path = "%User Temp%"
341. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B41DB860-8EE4-11D2-9906-E49FADC173CA}>InProcServer32
342. In the right panel, locate and delete the entry:
     ThreadingModel = "Apartment"
343. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Shell Extensions>Approved
344. In the right panel, locate and delete the entry:
     {B41DB860-8EE4-11D2-9906-E49FADC173CA} = "WinRAR shell extension"
345. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>WBEM>WDM
346. In the right panel, locate and delete the entry:
     %System%\advapi32.dll[MofResourceName] = "{random characters}"
347. Again In the right panel, locate and delete the entry:
     %System%\DRIVERS\ACPI.sys[ACPIMOFResource] = "{random characters}"
348. Again In the right panel, locate and delete the entry:
     %System%\DRIVERS\mssmbios.sys[MofResource] = "{random characters}"
349. Again In the right panel, locate and delete the entry:
     %System%\DRIVERS\intelppm.sys[PROCESSORWMI] = "{random characters}"
350. Again In the right panel, locate and delete the entry:
     %System%\DRIVERS\ipnat.sys[IPNATMofResource] = "{random characters}"
351. Again In the right panel, locate and delete the entry:
     %System%\Drivers\HTTP.sys[UlMofResource] = "{random characters}"
352. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %User Temp%\$inst\2.tmp
   • %User Temp%\$inst\temp_0.tmp
   • %User Temp%\Uninstall.ini
   • %Start Menu%\Programs\WinRAR\WinRAR.lnk
   • %Start Menu%\Programs\WinRAR\WinRAR help.lnk
   • %Start Menu%\Programs\WinRAR\Console RAR manual.lnk
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %User Temp%\$inst\2.tmp
   • %User Temp%\$inst\temp_0.tmp
   • %User Temp%\Uninstall.ini
   • %Start Menu%\Programs\WinRAR\WinRAR.lnk
   • %Start Menu%\Programs\WinRAR\WinRAR help.lnk
   • %Start Menu%\Programs\WinRAR\Console RAR manual.lnk
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.

To delete malware/grayware/spyware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • %User Temp%\$inst
   • %User Temp%\Formats
   • %User Profile%\Application Data\WinRAR
   • %Start Menu%\Programs\WinRAR
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • %User Temp%\$inst
   • %User Temp%\Formats
   • %User Profile%\Application Data\WinRAR
   • %Start Menu%\Programs\WinRAR