PUA.Win32.ShellBand.A

To terminate the malware/grayware/spyware process:

1. Scan your computer with your Trend Micro product and take note of the name of the malware/grayware/spyware detected.
2. Open Windows Task Manager. To do this, press CTRL+SHIFT+ESC.
3. View the list of all running programs. To do this:
   • For Windows 7 and Server 2008 (R2) users, click the Processes tab.
   • For Windows 8, 8.1, 10, and Server 2012 (R2) users, click the Details tab.
4. In the list of running programs, locate a malware/grayware/spyware file detected earlier.
5. Select the detected files, then press either the End Task or the End Process button, depending on the version of Windows you are using.
6. Do the same for the remaining detected malware/grayware/spyware files in the list of running programs.
7. To check if the malware/grayware/spyware process has been terminated, close Task Manager, and then open it again.
8. Close Task Manager.

To delete the registry value this malware/grayware created:

1. Open Registry Editor.
   » For Windows 7 and Windows Server 2008 (R2) users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2) users, right-click on the lower-left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{4839CB99-22A3-4F95-9972-8E35BB52DF38}>Implemented Categories>{2211057D-0906-49DF-ABF4-37652C71E0F2}
3. In the right panel, locate and delete the entry:
   uuid = "92f50a7fda04c2fdf6fd4927f33c28f0"
4. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>k52zip>setup
5. In the right panel, locate and delete the entry:
   tid1 = "140"
6. Again In the right panel, locate and delete the entry:
   tid2 = "1"
7. Again In the right panel, locate and delete the entry:
   id = "400"
8. Again In the right panel, locate and delete the entry:
   installpath = "%Program Files%\k52zip"
9. Again In the right panel, locate and delete the entry:
   installtime = "1577789043"
10. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Uninstall>k52zip
11. In the right panel, locate and delete the entry:
    DisplayIcon = "%Program Files%\k52zip\kzip_main.exe"
12. Again In the right panel, locate and delete the entry:
    DisplayVersion = "2019.1.3"
13. Again In the right panel, locate and delete the entry:
    DisplayName = "52\xe5\xa5\xbd\xe5\x8e\x8b"
14. Again In the right panel, locate and delete the entry:
    UninstallString = "%Program Files%\k52zip\uninstall.exe"
15. Again In the right panel, locate and delete the entry:
    Publisher = ""
16. Again In the right panel, locate and delete the entry:
    URLInfoAbout = ""
17. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{6B4DFEAB-4A11-45B9-A2D9-E12ABCD71A4E}
18. In the right panel, locate and delete the entry:
    (Default) = "k52zip shell band"
19. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{6B4DFEAB-4A11-45B9-A2D9-E12ABCD71A4E}>InprocServer32
20. In the right panel, locate and delete the entry:
    (Default) = "%Program Files%\k52zip\kzip_ext64.dll"
21. Again In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B1832224-9F22-4965-A6E8-E6A6E3C4FDF7}
23. In the right panel, locate and delete the entry:
    (Default) = "k52zip shell menu"
24. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>CLSID>{B1832224-9F22-4965-A6E8-E6A6E3C4FDF7}>InprocServer32
25. In the right panel, locate and delete the entry:
    (Default) = "%Program Files%\k52zip\kzip_ext64.dll"
26. Again In the right panel, locate and delete the entry:
    ThreadingModel = "Apartment"
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>*>shellex>ContextMenuHandlers>kzipext
28. In the right panel, locate and delete the entry:
    (Default) = "{B1832224-9F22-4965-A6E8-E6A6E3C4FDF7}"
29. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Directory>shellex>ContextMenuHandlers>kzipext
30. In the right panel, locate and delete the entry:
    (Default) = "{B1832224-9F22-4965-A6E8-E6A6E3C4FDF7}"
31. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>k52zip
32. In the right panel, locate and delete the entry:
    inject = "1577789164"
33. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Classes>Local Settings>Software>Microsoft>Windows>Shell>MuiCache>%Program Files%>k52zip
34. In the right panel, locate and delete the entry:
    kzip_main.exe = "52\xe5\xa5\xbd\xe5\x8e\x8b"
35. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>RegisteredApplications
36. In the right panel, locate and delete the entry:
    k52zip = "Software\k52zip\Capabilities"
37. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Wow6432Node>k52zip>Capabilities>FileAssociations
38. In the right panel, locate and delete the entry:
    .7z = "k52zip"
39. Again In the right panel, locate and delete the entry:
    .xz = "k52zip"
40. Again In the right panel, locate and delete the entry:
    .bzip2 = "k52zip"
41. Again In the right panel, locate and delete the entry:
    .gzip = "k52zip"
42. Again In the right panel, locate and delete the entry:
    .tar = "k52zip"
43. Again In the right panel, locate and delete the entry:
    .zip = "k52zip"
44. Again In the right panel, locate and delete the entry:
    .wim = "k52zip"
45. Again In the right panel, locate and delete the entry:
    .arj = "k52zip"
46. Again In the right panel, locate and delete the entry:
    .cab = "k52zip"
47. Again In the right panel, locate and delete the entry:
    .cpio = "k52zip"
48. Again In the right panel, locate and delete the entry:
    .dmg = "k52zip"
49. Again In the right panel, locate and delete the entry:
    .fat = "k52zip"
50. Again In the right panel, locate and delete the entry:
    .hfs = "k52zip"
51. Again In the right panel, locate and delete the entry:
    .iso = "k52zip"
52. Again In the right panel, locate and delete the entry:
    .lzh = "k52zip"
53. Again In the right panel, locate and delete the entry:
    .lzma = "k52zip"
54. Again In the right panel, locate and delete the entry:
    .ntfs = "k52zip"
55. Again In the right panel, locate and delete the entry:
    .rar = "k52zip"
56. Again In the right panel, locate and delete the entry:
    .rpm = "k52zip"
57. Again In the right panel, locate and delete the entry:
    .squashfs = "k52zip"
58. Again In the right panel, locate and delete the entry:
    .xar = "k52zip"
59. Again In the right panel, locate and delete the entry:
    .z = "k52zip"
60. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Classes>.7z
61. In the right panel, locate and delete the entry:
    (Default) = "k52zip.7z"
62. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Classes>.7z>OpenWithProgids
63. In the right panel, locate and delete the entry:
    k52zip.7z = ""
64. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Classes>k52zip.7z>DefaultIcon
65. In the right panel, locate and delete the entry:
    (Default) = "%Program Files%\k52zip\kzip_main.exe"
66. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Classes>k52zip.7z>shell>open>command
67. In the right panel, locate and delete the entry:
    (Default) = "%Program Files%\k52zip\kzip_main.exe -from:extension_association -action:open -in
68. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Classes>.xz
69. In the right panel, locate and delete the entry:
    (Default) = "k52zip.xz"
70. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Classes>.xz>OpenWithProgids
71. In the right panel, locate and delete the entry:
    k52zip.xz = ""
72. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Classes>k52zip.xz>DefaultIcon
73. In the right panel, locate and delete the entry:
    (Default) = "%Program Files%\k52zip\kzip_main.exe"
74. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Classes>k52zip.xz>shell>open>command
75. In the right panel, locate and delete the entry:
    (Default) = "%Program Files%\k52zip\kzip_main.exe -from:extension_association -action:open -in
76. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Classes>.bzip2
77. In the right panel, locate and delete the entry:
    (Default) = "k52zip.bzip2"
78. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Classes>.bzip2>OpenWithProgids
79. In the right panel, locate and delete the entry:
    k52zip.bzip2 = ""
80. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Classes>k52zip.bzip2>DefaultIcon
81. In the right panel, locate and delete the entry:
    (Default) = "%Program Files%\k52zip\kzip_main.exe"
82. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Classes>k52zip.bzip2>shell>open>command
83. In the right panel, locate and delete the entry:
    (Default) = "%Program Files%\k52zip\kzip_main.exe -from:extension_association -action:open -in
84. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Classes>.gzip
85. In the right panel, locate and delete the entry:
    (Default) = "k52zip.gzip"
86. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Classes>.gzip>OpenWithProgids
87. In the right panel, locate and delete the entry:
    k52zip.gzip = ""
88. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Classes>k52zip.gzip>DefaultIcon
89. In the right panel, locate and delete the entry:
    (Default) = "%Program Files%\k52zip\kzip_main.exe"
90. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Classes>k52zip.gzip>shell>open>command
91. In the right panel, locate and delete the entry:
    (Default) = "%Program Files%\k52zip\kzip_main.exe -from:extension_association -action:open -in
92. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Classes>.tar
93. In the right panel, locate and delete the entry:
    (Default) = "k52zip.tar"
94. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Classes>.tar>OpenWithProgids
95. In the right panel, locate and delete the entry:
    k52zip.tar = ""
96. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Classes>k52zip.tar>DefaultIcon
97. In the right panel, locate and delete the entry:
    (Default) = "%Program Files%\k52zip\kzip_main.exe"
98. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Classes>k52zip.tar>shell>open>command
99. In the right panel, locate and delete the entry:
    (Default) = "%Program Files%\k52zip\kzip_main.exe -from:extension_association -action:open -in
100. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>.zip
101. In the right panel, locate and delete the entry:
     (Default) = "k52zip.zip"
102. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>.zip>OpenWithProgids
103. In the right panel, locate and delete the entry:
     k52zip.zip = ""
104. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>k52zip.zip>DefaultIcon
105. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\k52zip\kzip_main.exe"
106. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>k52zip.zip>shell>open>command
107. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\k52zip\kzip_main.exe -from:extension_association -action:open -in
108. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>.wim
109. In the right panel, locate and delete the entry:
     (Default) = "k52zip.wim"
110. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>.wim>OpenWithProgids
111. In the right panel, locate and delete the entry:
     k52zip.wim = ""
112. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>k52zip.wim>DefaultIcon
113. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\k52zip\kzip_main.exe"
114. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>k52zip.wim>shell>open>command
115. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\k52zip\kzip_main.exe -from:extension_association -action:open -in
116. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>.arj
117. In the right panel, locate and delete the entry:
     (Default) = "k52zip.arj"
118. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>.arj>OpenWithProgids
119. In the right panel, locate and delete the entry:
     k52zip.arj = ""
120. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>k52zip.arj>DefaultIcon
121. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\k52zip\kzip_main.exe"
122. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>k52zip.arj>shell>open>command
123. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\k52zip\kzip_main.exe -from:extension_association -action:open -in
124. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>.cab
125. In the right panel, locate and delete the entry:
     (Default) = "k52zip.cab"
126. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>.cab>OpenWithProgids
127. In the right panel, locate and delete the entry:
     k52zip.cab = ""
128. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>k52zip.cab>DefaultIcon
129. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\k52zip\kzip_main.exe"
130. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>k52zip.cab>shell>open>command
131. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\k52zip\kzip_main.exe -from:extension_association -action:open -in
132. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>.cpio
133. In the right panel, locate and delete the entry:
     (Default) = "k52zip.cpio"
134. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>.cpio>OpenWithProgids
135. In the right panel, locate and delete the entry:
     k52zip.cpio = ""
136. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>k52zip.cpio>DefaultIcon
137. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\k52zip\kzip_main.exe"
138. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>k52zip.cpio>shell>open>command
139. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\k52zip\kzip_main.exe -from:extension_association -action:open -in
140. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>.dmg
141. In the right panel, locate and delete the entry:
     (Default) = "k52zip.dmg"
142. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>.dmg>OpenWithProgids
143. In the right panel, locate and delete the entry:
     k52zip.dmg = ""
144. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>k52zip.dmg>DefaultIcon
145. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\k52zip\kzip_main.exe"
146. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>k52zip.dmg>shell>open>command
147. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\k52zip\kzip_main.exe -from:extension_association -action:open -in
148. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>.fat
149. In the right panel, locate and delete the entry:
     (Default) = "k52zip.fat"
150. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>.fat>OpenWithProgids
151. In the right panel, locate and delete the entry:
     k52zip.fat = ""
152. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>k52zip.fat>DefaultIcon
153. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\k52zip\kzip_main.exe"
154. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>k52zip.fat>shell>open>command
155. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\k52zip\kzip_main.exe -from:extension_association -action:open -in
156. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>.hfs
157. In the right panel, locate and delete the entry:
     (Default) = "k52zip.hfs"
158. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>.hfs>OpenWithProgids
159. In the right panel, locate and delete the entry:
     k52zip.hfs = ""
160. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>k52zip.hfs>DefaultIcon
161. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\k52zip\kzip_main.exe"
162. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>k52zip.hfs>shell>open>command
163. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\k52zip\kzip_main.exe -from:extension_association -action:open -in
164. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>.iso
165. In the right panel, locate and delete the entry:
     (Default) = "k52zip.iso"
166. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>.iso>OpenWithProgids
167. In the right panel, locate and delete the entry:
     k52zip.iso = ""
168. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>k52zip.iso>DefaultIcon
169. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\k52zip\kzip_main.exe"
170. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>k52zip.iso>shell>open>command
171. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\k52zip\kzip_main.exe -from:extension_association -action:open -in
172. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>.lzh
173. In the right panel, locate and delete the entry:
     (Default) = "k52zip.lzh"
174. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>.lzh>OpenWithProgids
175. In the right panel, locate and delete the entry:
     k52zip.lzh = ""
176. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>k52zip.lzh>DefaultIcon
177. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\k52zip\kzip_main.exe"
178. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>k52zip.lzh>shell>open>command
179. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\k52zip\kzip_main.exe -from:extension_association -action:open -in
180. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>.lzma
181. In the right panel, locate and delete the entry:
     (Default) = "k52zip.lzma"
182. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>.lzma>OpenWithProgids
183. In the right panel, locate and delete the entry:
     k52zip.lzma = ""
184. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>k52zip.lzma>DefaultIcon
185. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\k52zip\kzip_main.exe"
186. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>k52zip.lzma>shell>open>command
187. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\k52zip\kzip_main.exe -from:extension_association -action:open -in
188. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>.ntfs
189. In the right panel, locate and delete the entry:
     (Default) = "k52zip.ntfs"
190. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>.ntfs>OpenWithProgids
191. In the right panel, locate and delete the entry:
     k52zip.ntfs = ""
192. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>k52zip.ntfs>DefaultIcon
193. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\k52zip\kzip_main.exe"
194. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>k52zip.ntfs>shell>open>command
195. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\k52zip\kzip_main.exe -from:extension_association -action:open -in
196. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>.rar
197. In the right panel, locate and delete the entry:
     (Default) = "k52zip.rar"
198. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>.rar>OpenWithProgids
199. In the right panel, locate and delete the entry:
     k52zip.rar = ""
200. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>k52zip.rar>DefaultIcon
201. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\k52zip\kzip_main.exe"
202. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>k52zip.rar>shell>open>command
203. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\k52zip\kzip_main.exe -from:extension_association -action:open -in
204. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>.rpm
205. In the right panel, locate and delete the entry:
     (Default) = "k52zip.rpm"
206. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>.rpm>OpenWithProgids
207. In the right panel, locate and delete the entry:
     k52zip.rpm = ""
208. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>k52zip.rpm>DefaultIcon
209. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\k52zip\kzip_main.exe"
210. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>k52zip.rpm>shell>open>command
211. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\k52zip\kzip_main.exe -from:extension_association -action:open -in
212. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>.squashfs
213. In the right panel, locate and delete the entry:
     (Default) = "k52zip.squashfs"
214. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>.squashfs>OpenWithProgids
215. In the right panel, locate and delete the entry:
     k52zip.squashfs = ""
216. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>k52zip.squashfs>DefaultIcon
217. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\k52zip\kzip_main.exe"
218. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>k52zip.squashfs>shell>open>command
219. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\k52zip\kzip_main.exe -from:extension_association -action:open -in
220. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>.xar
221. In the right panel, locate and delete the entry:
     (Default) = "k52zip.xar"
222. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>.xar>OpenWithProgids
223. In the right panel, locate and delete the entry:
     k52zip.xar = ""
224. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>k52zip.xar>DefaultIcon
225. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\k52zip\kzip_main.exe"
226. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>k52zip.xar>shell>open>command
227. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\k52zip\kzip_main.exe -from:extension_association -action:open -in
228. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>.z
229. In the right panel, locate and delete the entry:
     (Default) = "k52zip.z"
230. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>.z>OpenWithProgids
231. In the right panel, locate and delete the entry:
     k52zip.z = ""
232. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>k52zip.z>DefaultIcon
233. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\k52zip\kzip_main.exe"
234. In the left panel, double-click the following:
     HKEY_CURRENT_USER>Software>Classes>k52zip.z>shell>open>command
235. In the right panel, locate and delete the entry:
     (Default) = "%Program Files%\k52zip\kzip_main.exe -from:extension_association -action:open -in
236. Close Registry Editor.

To manually delete a malware/grayware file from an affected system:

•For Windows 7, Windows Server 2008 (R2), Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2):

1. Open a Windows Explorer window.
   • For Windows 7 and Server 2008 (R2) users, click Start>Computer.
   • For Windows 8, 8.1, 10, and Server 2012 (R2) users, right-click on the lower-left corner of the screen,then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %Program Files%\k52zip\api-ms-win-core-namedpipe-l1-1-0.dll
   • %Program Files%\k52zip\api-ms-win-crt-environment-l1-1-0.dll
   • %Program Files%\k52zip\vcruntime140.dll
   • %Program Files%\k52zip\msvcr80.dll
   • %Program Files%\k52zip\ucrtbase.dll
   • %Program Files%\k52zip\api-ms-win-core-libraryloader-l1-1-0.dll
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\52\xe5\xa5\xbd\xe5\x8e\x8b\52\xe5\xa5\xbd\xe5\x8e\x8b.lnk
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\52\xe5\xa5\xbd\xe5\x8e\x8b\xe5\x8d\xb8\xe8\xbd\xbd52\xe5\xa5\xbd\xe5\x8e\x8b.lnk
   • %Program Files%\k52zip\api-ms-win-crt-multibyte-l1-1-0.dll
   • %Program Files%\k52zip\update.exe
   • %Program Files%\k52zip\api-ms-win-crt-heap-l1-1-0.dll
   • %Program Files%\k52zip\msvcp140.dll
   • %Program Files%\k52zip\msvcp80.dll
   • %Program Files%\k52zip\api-ms-win-core-synch-l1-2-0.dll
   • %Program Files%\k52zip\kzip_casual.exe
   • %Program Files%\k52zip\api-ms-win-core-synch-l1-1-0.dll
   • %Program Files%\k52zip\kdumprep.exe
   • %Program Files%\k52zip\api-ms-win-crt-locale-l1-1-0.dll
   • %Program Files%\k52zip\api-ms-win-core-string-l1-1-0.dll
   • %Program Files%\k52zip\kzip_casual64.exe
   • %Program Files%\k52zip\api-ms-win-core-console-l1-1-0.dll
   • %Program Files%\k52zip\api-ms-win-crt-filesystem-l1-1-0.dll
   • %Program Files%\k52zip\api-ms-win-core-timezone-l1-1-0.dll
   • %Program Files%\k52zip\microsoft.vc80.crt.manifest
   • %Program Files%\k52zip\api-ms-win-core-memory-l1-1-0.dll
   • %Program Files%\k52zip\data\local_config.dat
   • %Program Files%\k52zip\api-ms-win-crt-time-l1-1-0.dll
   • %Program Files%\k52zip\api-ms-win-core-processthreads-l1-1-1.dll
   • %Program Files%\k52zip\kdump.dll
   • %Program Files%\k52zip\api-ms-win-crt-stdio-l1-1-0.dll
   • %Program Files%\k52zip\api-ms-win-core-interlocked-l1-1-0.dll
   • %Program Files%\k52zip\api-ms-win-core-file-l1-1-0.dll
   • %Program Files%\k52zip\api-ms-win-crt-private-l1-1-0.dll
   • %Program Files%\k52zip\api-ms-win-core-handle-l1-1-0.dll
   • %Program Files%\k52zip\api-ms-win-crt-math-l1-1-0.dll
   • %Program Files%\k52zip\kzip_ext64.dll
   • %Program Files%\k52zip\vccorlib140.dll
   • %Program Files%\k52zip\kzip_main.exe
   • %Program Files%\k52zip\api-ms-win-core-localization-l1-2-0.dll
   • %Program Files%\k52zip\api-ms-win-crt-conio-l1-1-0.dll
   • %Program Files%\k52zip\kdumpcfg.dat
   • %Program Files%\k52zip\api-ms-win-crt-utility-l1-1-0.dll
   • %Program Files%\k52zip\api-ms-win-core-file-l1-2-0.dll
   • %Program Files%\k52zip\api-ms-win-core-processenvironment-l1-1-0.dll
   • %Program Files%\k52zip\api-ms-win-core-util-l1-1-0.dll
   • %Program Files%\k52zip\kdumprepn.exe
   • %Program Files%\k52zip\api-ms-win-core-file-l2-1-0.dll
   • %Program Files%\k52zip\api-ms-win-crt-string-l1-1-0.dll
   • %Program Files%\k52zip\kzip_ext.dll
   • %Program Files%\k52zip\api-ms-win-core-rtlsupport-l1-1-0.dll
   • %Program Files%\k52zip\microsoft.vc80.mfc.manifest
   • %Program Files%\k52zip\api-ms-win-crt-process-l1-1-0.dll
   • %Program Files%\k52zip\kisarchive.dll
   • %Program Files%\k52zip\kzip_util.dll
   • %Program Files%\k52zip\fpinfo.dat
   • %Program Files%\k52zip\api-ms-win-crt-convert-l1-1-0.dll
   • %Program Files%\k52zip\api-ms-win-core-profile-l1-1-0.dll
   • %Program Files%\k52zip\api-ms-win-core-datetime-l1-1-0.dll
   • %Program Files%\k52zip\kinst.exe
   • %Program Files%\k52zip\api-ms-win-core-errorhandling-l1-1-0.dll
   • %Program Files%\k52zip\runapp_passuac.dll
   • %Program Files%\k52zip\api-ms-win-core-debug-l1-1-0.dll
   • %Program Files%\k52zip\installconfig.xml
   • %Program Files%\k52zip\concrt140.dll
   • %Program Files%\k52zip\api-ms-win-core-processthreads-l1-1-0.dll
   • %Program Files%\k52zip\api-ms-win-core-sysinfo-l1-1-0.dll
   • %Program Files%\k52zip\api-ms-win-core-heap-l1-1-0.dll
   • %Program Files%\k52zip\api-ms-win-crt-runtime-l1-1-0.dll
   • %Program Files%\k52zip\uninstall.exe
3. Once located, select the file then press SHIFT+DELETE to delete it.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7 and Windows Server 2008 (R2).

To delete malware/grayware/spyware folders:

For Windows 7, Windows Server 2008 (R2), Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2):

1. Open a Windows Explorer window.
   • For Windows 7 and Server 2008 (R2) users, click Start>Computer.
   • For Windows 8, 8.1, 10, and Server 2012 (R2) users, right-click on the lower-left corner of the screen,then click File Explorer.
2. In the Search Computer/This PC input box, type:
   
   • %Program Files%\k52zip\data
   • %Program Files%\k52zip
   • %User Temp%\access
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\52\xe5\xa5\xbd\xe5\x8e\x8b
   • %Program Files%\k52zip\phoenix
   • %Program Files%\k52zip\phoenix\11
3. Once located, select the file then press SHIFT+DELETE to permanently delete the folder.
4. Repeat steps 2-3 for the remaining folders:
   • %Program Files%\k52zip\data
   • %Program Files%\k52zip
   • %User Temp%\access
   • %All Users Profile%\Microsoft\Windows\Start Menu\Programs\52\xe5\xa5\xbd\xe5\x8e\x8b
   • %Program Files%\k52zip\phoenix
   • %Program Files%\k52zip\phoenix\11
   *Note: Read the following Microsoft page if these steps do not work on Windows 7 and Server 2008 (R2).