PUA.Win32.SilentInstall.A

To terminate the malware/grayware/spyware process:

1. Scan your computer with your Trend Micro product and take note of the name of the malware/grayware/spyware detected.
2. Open Windows Task Manager. To do this, press CTRL+SHIFT+ESC.
3. View the list of all running programs. To do this:
   • For Windows 7 and Server 2008 (R2) users, click the Processes tab.
   • For Windows 8, 8.1, 10, and Server 2012 (R2) users, click the Details tab.
4. In the list of running programs, locate a malware/grayware/spyware file detected earlier.
5. Select the detected files, then press either the End Task or the End Process button, depending on the version of Windows you are using.
6. Do the same for the remaining detected malware/grayware/spyware files in the list of running programs.
7. To check if the malware/grayware/spyware process has been terminated, close Task Manager, and then open it again.
8. Close Task Manager.

To delete the registry key this malware/grayware created:

1. Open Registry Editor.
   » For Windows 7 and Windows Server 2008 (R2) users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2) users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID
3. Still in the left panel, locate and delete the key:
   {C2B64A8F-1656-4b18-BB04-A7B2C62C82DC}
4. Again Still in the left panel, locate and delete the key:
   WebActiveEXE.EXE
5. In the left panel, double-click the following:
   HKEY_CLASSES_ROOT
6. Still in the left panel, locate and delete the key:
   WebActiveEXE.Plugin.VD1000.1
7. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>WebActiveEXE.Plugin.VD1000.1
8. Still in the left panel, locate and delete the key:
   CLSID
9. Again Still in the left panel, locate and delete the key:
   WebActiveEXE.Plugin
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>WebActiveEXE.Plugin
11. Still in the left panel, locate and delete the key:
    CLSID
12. Again Still in the left panel, locate and delete the key:
    CurVer
13. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID
14. Still in the left panel, locate and delete the key:
    {93DE405A-9C43-446b-B096-7E946A3FD891}
15. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{93DE405A-9C43-446b-B096-7E946A3FD891}
16. Still in the left panel, locate and delete the key:
    ProgID
17. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
18. Again Still in the left panel, locate and delete the key:
    Programmable
19. Again Still in the left panel, locate and delete the key:
    LocalServer32
20. Again Still in the left panel, locate and delete the key:
    Control
21. Again Still in the left panel, locate and delete the key:
    Insertable
22. Again Still in the left panel, locate and delete the key:
    ToolboxBitmap32
23. Again Still in the left panel, locate and delete the key:
    MiscStatus
24. Again Still in the left panel, locate and delete the key:
    TypeLib
25. Again Still in the left panel, locate and delete the key:
    Version
26. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID>{93DE405A-9C43-446B-B096-7E946A3FD891}
27. Still in the left panel, locate and delete the key:
    Implemented Categories
28. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID>{93DE405A-9C43-446B-B096-7E946A3FD891}>Implemented Categories
29. Still in the left panel, locate and delete the key:
    {7DD95801-9882-11CF-9FA9-00AA006C42C4}
30. Again Still in the left panel, locate and delete the key:
    {7DD95802-9882-11CF-9FA9-00AA006C42C4}
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface
32. Still in the left panel, locate and delete the key:
    {B86DA541-D44A-4479-9D60-D50AD8E993E0}
33. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{B86DA541-D44A-4479-9D60-D50AD8E993E0}
34. Still in the left panel, locate and delete the key:
    ProxyStubClsid32
35. Again Still in the left panel, locate and delete the key:
    TypeLib
36. Again Still in the left panel, locate and delete the key:
    {9E708DD2-1ED3-4AD7-8A46-4A9B03AC4504}
37. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{9E708DD2-1ED3-4AD7-8A46-4A9B03AC4504}
38. Still in the left panel, locate and delete the key:
    ProxyStubClsid32
39. Again Still in the left panel, locate and delete the key:
    TypeLib
40. Again Still in the left panel, locate and delete the key:
    {AAFD940E-A467-4250-82E6-37C212B75A85}
41. Again Still in the left panel, locate and delete the key:
    TimeGridEXE.EXE
42. Again Still in the left panel, locate and delete the key:
    TimeGridEXE.Plugin.1
43. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TimeGridEXE.Plugin.1
44. Still in the left panel, locate and delete the key:
    CLSID
45. Again Still in the left panel, locate and delete the key:
    TimeGridEXE.Plugin
46. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TimeGridEXE.Plugin
47. Still in the left panel, locate and delete the key:
    CLSID
48. Again Still in the left panel, locate and delete the key:
    CurVer
49. Again Still in the left panel, locate and delete the key:
    {E8B8D6C1-2E83-4355-A06E-EF85C98337A1}
50. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{E8B8D6C1-2E83-4355-A06E-EF85C98337A1}
51. Still in the left panel, locate and delete the key:
    ProgID
52. Again Still in the left panel, locate and delete the key:
    VersionIndependentProgID
53. Again Still in the left panel, locate and delete the key:
    Programmable
54. Again Still in the left panel, locate and delete the key:
    LocalServer32
55. Again Still in the left panel, locate and delete the key:
    Control
56. Again Still in the left panel, locate and delete the key:
    Insertable
57. Again Still in the left panel, locate and delete the key:
    ToolboxBitmap32
58. Again Still in the left panel, locate and delete the key:
    MiscStatus
59. Again Still in the left panel, locate and delete the key:
    TypeLib
60. Again Still in the left panel, locate and delete the key:
    Version
61. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID>{E8B8D6C1-2E83-4355-A06E-EF85C98337A1}
62. Still in the left panel, locate and delete the key:
    Implemented Categories
63. In the left panel, double-click the following:
    HKEY_CLASSES_ROOT>CLSID>{E8B8D6C1-2E83-4355-A06E-EF85C98337A1}>Implemented Categories
64. Still in the left panel, locate and delete the key:
    {7DD95801-9882-11CF-9FA9-00AA006C42C4}
65. Again Still in the left panel, locate and delete the key:
    {7DD95802-9882-11CF-9FA9-00AA006C42C4}
66. Again Still in the left panel, locate and delete the key:
    {1542FAD9-2744-4F1B-BA05-6A0B7B528C2B}
67. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{1542FAD9-2744-4F1B-BA05-6A0B7B528C2B}
68. Still in the left panel, locate and delete the key:
    ProxyStubClsid32
69. Again Still in the left panel, locate and delete the key:
    TypeLib
70. Again Still in the left panel, locate and delete the key:
    {31E15C9A-22F7-4A51-9D1C-8DCD7589B57E}
71. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{31E15C9A-22F7-4A51-9D1C-8DCD7589B57E}
72. Still in the left panel, locate and delete the key:
    ProxyStubClsid32
73. Again Still in the left panel, locate and delete the key:
    TypeLib
74. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>MozillaPlugins
75. Still in the left panel, locate and delete the key:
    @DVR/npmedia,version = 3.1.0.4
76. Again Still in the left panel, locate and delete the key:
    @DVR/npTimeGrid,version = 3.1.0.4
77. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor.
   » For Windows 7 and Windows Server 2008 (R2) users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2) users, right-click on the lower-left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>{C2B64A8F-1656-4b18-BB04-A7B2C62C82DC}
3. In the right panel, locate and delete the entry:
   (Default) = "WebActiveEXE"
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>WebActiveEXE.EXE
5. In the right panel, locate and delete the entry:
   AppID = "{C2B64A8F-1656-4b18-BB04-A7B2C62C82DC}"
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>WebActiveEXE.Plugin.VD1000.1
7. In the right panel, locate and delete the entry:
   (Default) = "Plugin Class"
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>WebActiveEXE.Plugin.VD1000.1>CLSID
9. In the right panel, locate and delete the entry:
   (Default) = "{93DE405A-9C43-446b-B096-7E946A3FD891}"
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>WebActiveEXE.Plugin
11. In the right panel, locate and delete the entry:
    (Default) = "Plugin Class"
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>WebActiveEXE.Plugin>CLSID
13. In the right panel, locate and delete the entry:
    (Default) = "{93DE405A-9C43-446b-B096-7E946A3FD891}"
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>WebActiveEXE.Plugin>CurVer
15. In the right panel, locate and delete the entry:
    (Default) = "WebActiveEXE.Plugin.VD1000.1"
16. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{93DE405A-9C43-446b-B096-7E946A3FD891}
17. In the right panel, locate and delete the entry:
    (Default) = "Plugin Class"
18. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{93DE405A-9C43-446b-B096-7E946A3FD891}>ProgID
19. In the right panel, locate and delete the entry:
    (Default) = "WebActiveEXE.Plugin.VD1000.1"
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{93DE405A-9C43-446b-B096-7E946A3FD891}>VersionIndependentProgID
21. In the right panel, locate and delete the entry:
    (Default) = "WebActiveEXE.Plugin"
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{93DE405A-9C43-446b-B096-7E946A3FD891}>LocalServer32
23. In the right panel, locate and delete the entry:
    (Default) = "%System Root%\Program Files\webrec\WEB30\VD1000\WebPlugin\WebActiveEXE.exe"
24. Again In the right panel, locate and delete the entry:
    AppID = "{C2B64A8F-1656-4b18-BB04-A7B2C62C82DC}"
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{93DE405A-9C43-446b-B096-7E946A3FD891}>ToolboxBitmap32
26. In the right panel, locate and delete the entry:
    (Default) = "%System Root%\Program Files\webrec\WEB30\VD1000\WebPlugin\WebActiveEXE.exe, 101"
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{93DE405A-9C43-446b-B096-7E946A3FD891}>MiscStatus
28. In the right panel, locate and delete the entry:
    (Default) = "0"
29. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{93DE405A-9C43-446b-B096-7E946A3FD891}>MiscStatus>1
30. In the right panel, locate and delete the entry:
    (Default) = "131473"
31. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{93DE405A-9C43-446b-B096-7E946A3FD891}>TypeLib
32. In the right panel, locate and delete the entry:
    (Default) = "{863D043B-0EFE-4d5a-B504-78B1BDC90313}"
33. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{93DE405A-9C43-446b-B096-7E946A3FD891}>Version
34. In the right panel, locate and delete the entry:
    (Default) = "1.0"
35. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{B86DA541-D44A-4479-9D60-D50AD8E993E0}
36. In the right panel, locate and delete the entry:
    (Default) = "_IPluginEvents"
37. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{B86DA541-D44A-4479-9D60-D50AD8E993E0}>ProxyStubClsid32
38. In the right panel, locate and delete the entry:
    (Default) = "{00020420-0000-0000-C000-000000000046}"
39. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{B86DA541-D44A-4479-9D60-D50AD8E993E0}>TypeLib
40. In the right panel, locate and delete the entry:
    (Default) = "{863D043B-0EFE-4D5A-B504-78B1BDC90313}"
41. Again In the right panel, locate and delete the entry:
    Version = "1.0"
42. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{9E708DD2-1ED3-4AD7-8A46-4A9B03AC4504}
43. In the right panel, locate and delete the entry:
    (Default) = "IPlugin"
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{9E708DD2-1ED3-4AD7-8A46-4A9B03AC4504}>ProxyStubClsid32
45. In the right panel, locate and delete the entry:
    (Default) = "{00020424-0000-0000-C000-000000000046}"
46. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{9E708DD2-1ED3-4AD7-8A46-4A9B03AC4504}>TypeLib
47. In the right panel, locate and delete the entry:
    (Default) = "{863D043B-0EFE-4D5A-B504-78B1BDC90313}"
48. Again In the right panel, locate and delete the entry:
    Version = "1.0"
49. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>{AAFD940E-A467-4250-82E6-37C212B75A85}
50. In the right panel, locate and delete the entry:
    (Default) = "TimeGridEXE"
51. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>AppID>TimeGridEXE.EXE
52. In the right panel, locate and delete the entry:
    AppID = "{AAFD940E-A467-4250-82E6-37C212B75A85}"
53. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TimeGridEXE.Plugin.1
54. In the right panel, locate and delete the entry:
    (Default) = "Plugin Class"
55. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TimeGridEXE.Plugin.1>CLSID
56. In the right panel, locate and delete the entry:
    (Default) = "{E8B8D6C1-2E83-4355-A06E-EF85C98337A1}"
57. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TimeGridEXE.Plugin
58. In the right panel, locate and delete the entry:
    (Default) = "Plugin Class"
59. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TimeGridEXE.Plugin>CLSID
60. In the right panel, locate and delete the entry:
    (Default) = "{E8B8D6C1-2E83-4355-A06E-EF85C98337A1}"
61. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>TimeGridEXE.Plugin>CurVer
62. In the right panel, locate and delete the entry:
    (Default) = "TimeGridEXE.Plugin.1"
63. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{E8B8D6C1-2E83-4355-A06E-EF85C98337A1}
64. In the right panel, locate and delete the entry:
    (Default) = "Plugin Class"
65. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{E8B8D6C1-2E83-4355-A06E-EF85C98337A1}>ProgID
66. In the right panel, locate and delete the entry:
    (Default) = "TimeGridEXE.Plugin.1"
67. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{E8B8D6C1-2E83-4355-A06E-EF85C98337A1}>VersionIndependentProgID
68. In the right panel, locate and delete the entry:
    (Default) = "TimeGridEXE.Plugin"
69. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{E8B8D6C1-2E83-4355-A06E-EF85C98337A1}>LocalServer32
70. In the right panel, locate and delete the entry:
    (Default) = "%System Root%\Program Files\webrec\WEB30\VD1000\WebPlugin\TimeGridEXE.exe"
71. Again In the right panel, locate and delete the entry:
    AppID = "{AAFD940E-A467-4250-82E6-37C212B75A85}"
72. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{E8B8D6C1-2E83-4355-A06E-EF85C98337A1}>ToolboxBitmap32
73. In the right panel, locate and delete the entry:
    (Default) = "%System Root%\Program Files\webrec\WEB30\VD1000\WebPlugin\TimeGridEXE.exe, 101"
74. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{E8B8D6C1-2E83-4355-A06E-EF85C98337A1}>MiscStatus
75. In the right panel, locate and delete the entry:
    (Default) = "0"
76. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{E8B8D6C1-2E83-4355-A06E-EF85C98337A1}>MiscStatus>1
77. In the right panel, locate and delete the entry:
    (Default) = "131473"
78. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{E8B8D6C1-2E83-4355-A06E-EF85C98337A1}>TypeLib
79. In the right panel, locate and delete the entry:
    (Default) = "{8A123CBE-8B8D-430a-8E77-46E14864109D}"
80. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{E8B8D6C1-2E83-4355-A06E-EF85C98337A1}>Version
81. In the right panel, locate and delete the entry:
    (Default) = "1.0"
82. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{1542FAD9-2744-4F1B-BA05-6A0B7B528C2B}
83. In the right panel, locate and delete the entry:
    (Default) = "_IPluginEvents"
84. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{1542FAD9-2744-4F1B-BA05-6A0B7B528C2B}>ProxyStubClsid32
85. In the right panel, locate and delete the entry:
    (Default) = "{00020420-0000-0000-C000-000000000046}"
86. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{1542FAD9-2744-4F1B-BA05-6A0B7B528C2B}>TypeLib
87. In the right panel, locate and delete the entry:
    (Default) = "{8A123CBE-8B8D-430A-8E77-46E14864109D}"
88. Again In the right panel, locate and delete the entry:
    Version = "1.0"
89. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{31E15C9A-22F7-4A51-9D1C-8DCD7589B57E}
90. In the right panel, locate and delete the entry:
    (Default) = "IPlugin"
91. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{31E15C9A-22F7-4A51-9D1C-8DCD7589B57E}>ProxyStubClsid32
92. In the right panel, locate and delete the entry:
    (Default) = "{00020424-0000-0000-C000-000000000046}"
93. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{31E15C9A-22F7-4A51-9D1C-8DCD7589B57E}>TypeLib
94. In the right panel, locate and delete the entry:
    (Default) = "{8A123CBE-8B8D-430A-8E77-46E14864109D}"
95. Again In the right panel, locate and delete the entry:
    Version = "1.0"
96. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Wow6432Node>MozillaPlugins>@DVR/npmedia,version=3.1.0.4
97. In the right panel, locate and delete the entry:
    Path = "%System Root%\Program Files\webrec\WEB30\VD1000\WebPlugin\npmedia.dll"
98. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Wow6432Node>MozillaPlugins>@DVR/npTimeGrid,version=3.1.0.4
99. In the right panel, locate and delete the entry:
    Path = "%System Root%\Program Files\webrec\WEB30\VD1000\WebPlugin\npTimeGrid.dll"
100. Close Registry Editor.

To manually delete a malware/grayware file from an affected system:

•For Windows 7, Windows Server 2008 (R2), Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2):

1. Open a Windows Explorer window.
   • For Windows 7 and Server 2008 (R2) users, click Start>Computer.
   • For Windows 8, 8.1, 10, and Server 2012 (R2) users, right-click on the lower-left corner of the screen,then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %System Root%\Program Files\webrec\WEB30\VD1000\WebPlugin\Version.ini
   • %System Root%\Program Files\webrec\WEB30\VD1000\WebPlugin\registPlugin.bat
   • %System Root%\Program Files\webrec\WEB30\VD1000\WebPlugin\unregist.bat
   • %System Root%\Program Files\webrec\WEB30\VD1000\WebPlugin\dhplay.dll
   • %System Root%\Program Files\webrec\WEB30\VD1000\WebPlugin\TimeGridEXE.exe
   • %System Root%\Program Files\webrec\WEB30\VD1000\WebPlugin\WebActiveEXE.exe_tmpdata
   • %System Root%\Program Files\webrec\WEB30\VD1000\WebPlugin\uninstall.exe
   • %System Root%\Program Files\webrec\WEB30\VD1000\WebPlugin\h264dec.dll
   • %System Root%\Program Files\webrec\WEB30\VD1000\WebPlugin\mjpegdec.dll
   • %System Root%\Program Files\webrec\WEB30\VD1000\WebPlugin\DHSurveillanceDll.dll
   • %Start Menu%\Programs\WebPlugin\uninstall.exe.lnk
   • %System Root%\Program Files\webrec\WEB30\VD1000\WebPlugin\postproc.dll
   • %System Root%\Program Files\webrec\WEB30\VD1000\WebPlugin\dhnetsdk.dll
   • %System Root%\Program Files\webrec\WEB30\VD1000\WebPlugin\timeAxesDll.dll
   • %System Root%\Program Files\webrec\WEB30\VD1000\WebPlugin\7zResource.7z
   • %System Root%\Program Files\webrec\WEB30\VD1000\WebPlugin\VideoWindow.dll
   • %System Root%\Program Files\webrec\WEB30\VD1000\WebPlugin\npmedia.dll
   • %System Root%\Program Files\webrec\WEB30\VD1000\WebPlugin\npTimeGrid.dll
3. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7 and Windows Server 2008 (R2).

To delete malware/grayware/spyware folders:

For Windows 7, Windows Server 2008 (R2), Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2):

1. Open a Windows Explorer window.
   • For Windows 7 and Server 2008 (R2) users, click Start>Computer.
   • For Windows 8, 8.1, 10, and Server 2012 (R2) users, right-click on the lower-left corner of the screen,then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %Start Menu%\Programs\WebPlugin
   • %System Root%\Program Files\webrec\WEB30\VD1000
   • %System Root%\Program Files\webrec\WEB30
   • %System Root%\Program Files\webrec\WEB30\VD1000\WebPlugin
   • %System Root%\Program Files\webrec
3. Once located, select the file then press SHIFT+DELETE to permanently delete the folder.
4. Repeat steps 2-3 for the remaining folders:
   • %Start Menu%\Programs\WebPlugin
   • %System Root%\Program Files\webrec\WEB30\VD1000
   • %System Root%\Program Files\webrec\WEB30
   • %System Root%\Program Files\webrec\WEB30\VD1000\WebPlugin
   • %System Root%\Program Files\webrec
   *Note: Read the following Microsoft page if these steps do not work on Windows 7 and Server 2008 (R2).