Trojan.Win32.FAREIT.UHBAZCLIG

To delete the registry value this malware/grayware created:

1. Open Registry Editor.
   » For Windows 7 and Windows Server 2008 (R2) users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, Windows 10, and Windows Server 2012 (R2) users, right-click on the lower-left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{DBCDFB21-E896-4B0B-B9B0-84F9AB755F5E}
3. In the right panel, locate and delete the entry:
   (Default) = "_ATXmlFormNode"
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{DBCDFB21-E896-4B0B-B9B0-84F9AB755F5E}>ProxyStubClsid32
5. In the right panel, locate and delete the entry:
   (Default) = "{00020424-0000-0000-C000-000000000046}"
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{DBCDFB21-E896-4B0B-B9B0-84F9AB755F5E}>TypeLib
7. In the right panel, locate and delete the entry:
   (Default) = "{F5AF018C-2993-4F60-B186-72AE59CCD1E3}"
8. Again In the right panel, locate and delete the entry:
   Version = "2.1"
9. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{6CAAD269-40AA-4122-A8DB-860B452D23F7}
10. In the right panel, locate and delete the entry:
    (Default) = "_ATXmlIndexNode"
11. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{6CAAD269-40AA-4122-A8DB-860B452D23F7}>ProxyStubClsid32
12. In the right panel, locate and delete the entry:
    (Default) = "{00020424-0000-0000-C000-000000000046}"
13. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{6CAAD269-40AA-4122-A8DB-860B452D23F7}>TypeLib
14. In the right panel, locate and delete the entry:
    (Default) = "{F5AF018C-2993-4F60-B186-72AE59CCD1E3}"
15. Again In the right panel, locate and delete the entry:
    Version = "2.1"
16. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{A051CF9E-DE19-4190-961D-C0131CB19D55}
17. In the right panel, locate and delete the entry:
    (Default) = "_ATXmlParseError"
18. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{A051CF9E-DE19-4190-961D-C0131CB19D55}>ProxyStubClsid32
19. In the right panel, locate and delete the entry:
    (Default) = "{00020424-0000-0000-C000-000000000046}"
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{A051CF9E-DE19-4190-961D-C0131CB19D55}>TypeLib
21. In the right panel, locate and delete the entry:
    (Default) = "{F5AF018C-2993-4F60-B186-72AE59CCD1E3}"
22. Again In the right panel, locate and delete the entry:
    Version = "2.1"
23. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{421B6D3E-4B0C-4615-B456-5C2AE7C23D3C}
24. In the right panel, locate and delete the entry:
    (Default) = "_ATXmlRangeNode"
25. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{421B6D3E-4B0C-4615-B456-5C2AE7C23D3C}>ProxyStubClsid32
26. In the right panel, locate and delete the entry:
    (Default) = "{00020424-0000-0000-C000-000000000046}"
27. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{421B6D3E-4B0C-4615-B456-5C2AE7C23D3C}>TypeLib
28. In the right panel, locate and delete the entry:
    (Default) = "{F5AF018C-2993-4F60-B186-72AE59CCD1E3}"
29. Again In the right panel, locate and delete the entry:
    Version = "2.1"
30. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{118B1C3F-83C8-466F-9996-8CCB80359E32}
31. In the right panel, locate and delete the entry:
    (Default) = "_ATXmlTabNode"
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{118B1C3F-83C8-466F-9996-8CCB80359E32}>ProxyStubClsid32
33. In the right panel, locate and delete the entry:
    (Default) = "{00020424-0000-0000-C000-000000000046}"
34. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{118B1C3F-83C8-466F-9996-8CCB80359E32}>TypeLib
35. In the right panel, locate and delete the entry:
    (Default) = "{F5AF018C-2993-4F60-B186-72AE59CCD1E3}"
36. Again In the right panel, locate and delete the entry:
    Version = "2.1"
37. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{A8713635-724C-4CCD-BA0C-F2F58EB0BFBE}
38. In the right panel, locate and delete the entry:
    (Default) = "_ATXmlDataNode"
39. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{A8713635-724C-4CCD-BA0C-F2F58EB0BFBE}>ProxyStubClsid32
40. In the right panel, locate and delete the entry:
    (Default) = "{00020424-0000-0000-C000-000000000046}"
41. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{A8713635-724C-4CCD-BA0C-F2F58EB0BFBE}>TypeLib
42. In the right panel, locate and delete the entry:
    (Default) = "{F5AF018C-2993-4F60-B186-72AE59CCD1E3}"
43. Again In the right panel, locate and delete the entry:
    Version = "2.1"
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{4C2BE82C-FBE6-4D5F-BB69-8486E231927D}
45. In the right panel, locate and delete the entry:
    (Default) = "_ATXmlDOMDocument"
46. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{4C2BE82C-FBE6-4D5F-BB69-8486E231927D}>ProxyStubClsid32
47. In the right panel, locate and delete the entry:
    (Default) = "{00020424-0000-0000-C000-000000000046}"
48. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{4C2BE82C-FBE6-4D5F-BB69-8486E231927D}>TypeLib
49. In the right panel, locate and delete the entry:
    (Default) = "{F5AF018C-2993-4F60-B186-72AE59CCD1E3}"
50. Again In the right panel, locate and delete the entry:
    Version = "2.1"
51. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{30744E3C-24A7-45C0-BD32-FDA5448BA9D1}
52. In the right panel, locate and delete the entry:
    (Default) = "_ATXmlReturnNode"
53. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{30744E3C-24A7-45C0-BD32-FDA5448BA9D1}>ProxyStubClsid32
54. In the right panel, locate and delete the entry:
    (Default) = "{00020424-0000-0000-C000-000000000046}"
55. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{30744E3C-24A7-45C0-BD32-FDA5448BA9D1}>TypeLib
56. In the right panel, locate and delete the entry:
    (Default) = "{F5AF018C-2993-4F60-B186-72AE59CCD1E3}"
57. Again In the right panel, locate and delete the entry:
    Version = "2.1"
58. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{C7BCC8D3-B191-4ED4-B46A-B2277861C015}
59. In the right panel, locate and delete the entry:
    (Default) = "_ATXmlClientNode"
60. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{C7BCC8D3-B191-4ED4-B46A-B2277861C015}>ProxyStubClsid32
61. In the right panel, locate and delete the entry:
    (Default) = "{00020424-0000-0000-C000-000000000046}"
62. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{C7BCC8D3-B191-4ED4-B46A-B2277861C015}>TypeLib
63. In the right panel, locate and delete the entry:
    (Default) = "{F5AF018C-2993-4F60-B186-72AE59CCD1E3}"
64. Again In the right panel, locate and delete the entry:
    Version = "2.1"
65. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{9F790079-8315-4F94-B839-0EE7C3819F12}
66. In the right panel, locate and delete the entry:
    (Default) = "_ATXmlFormSetNode"
67. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{9F790079-8315-4F94-B839-0EE7C3819F12}>ProxyStubClsid32
68. In the right panel, locate and delete the entry:
    (Default) = "{00020424-0000-0000-C000-000000000046}"
69. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{9F790079-8315-4F94-B839-0EE7C3819F12}>TypeLib
70. In the right panel, locate and delete the entry:
    (Default) = "{F5AF018C-2993-4F60-B186-72AE59CCD1E3}"
71. Again In the right panel, locate and delete the entry:
    Version = "2.1"
72. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{1476A3D2-6A76-45CF-8A0B-983E4F259098}
73. In the right panel, locate and delete the entry:
    (Default) = "_clsATXPrint"
74. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{1476A3D2-6A76-45CF-8A0B-983E4F259098}>ProxyStubClsid32
75. In the right panel, locate and delete the entry:
    (Default) = "{00020424-0000-0000-C000-000000000046}"
76. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{1476A3D2-6A76-45CF-8A0B-983E4F259098}>TypeLib
77. In the right panel, locate and delete the entry:
    (Default) = "{F5AF018C-2993-4F60-B186-72AE59CCD1E3}"
78. Again In the right panel, locate and delete the entry:
    Version = "2.1"
79. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{E4946C33-031F-47E5-A655-5DFF4A3E6EE2}
80. In the right panel, locate and delete the entry:
    (Default) = "_clsEFILE"
81. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{E4946C33-031F-47E5-A655-5DFF4A3E6EE2}>ProxyStubClsid32
82. In the right panel, locate and delete the entry:
    (Default) = "{00020424-0000-0000-C000-000000000046}"
83. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{E4946C33-031F-47E5-A655-5DFF4A3E6EE2}>TypeLib
84. In the right panel, locate and delete the entry:
    (Default) = "{F5AF018C-2993-4F60-B186-72AE59CCD1E3}"
85. Again In the right panel, locate and delete the entry:
    Version = "2.1"
86. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{322E61AA-53A2-498D-8644-03B53A2105C9}
87. In the right panel, locate and delete the entry:
    (Default) = "_clsReturn"
88. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{322E61AA-53A2-498D-8644-03B53A2105C9}>ProxyStubClsid32
89. In the right panel, locate and delete the entry:
    (Default) = "{00020424-0000-0000-C000-000000000046}"
90. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{322E61AA-53A2-498D-8644-03B53A2105C9}>TypeLib
91. In the right panel, locate and delete the entry:
    (Default) = "{F5AF018C-2993-4F60-B186-72AE59CCD1E3}"
92. Again In the right panel, locate and delete the entry:
    Version = "2.1"
93. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{28A55B1F-C3F4-4A28-8FD3-39280F6CFAB3}
94. In the right panel, locate and delete the entry:
    (Default) = "_IMain"
95. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{28A55B1F-C3F4-4A28-8FD3-39280F6CFAB3}>ProxyStubClsid32
96. In the right panel, locate and delete the entry:
    (Default) = "{00020424-0000-0000-C000-000000000046}"
97. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{28A55B1F-C3F4-4A28-8FD3-39280F6CFAB3}>TypeLib
98. In the right panel, locate and delete the entry:
    (Default) = "{F5AF018C-2993-4F60-B186-72AE59CCD1E3}"
99. Again In the right panel, locate and delete the entry:
    Version = "2.1"
100. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{E3F7EF3D-CF41-48BD-93D5-D1925DFEC795}
101. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.clsEFILE"
102. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{E3F7EF3D-CF41-48BD-93D5-D1925DFEC795}>ProgID
103. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.clsEFILE"
104. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{E3F7EF3D-CF41-48BD-93D5-D1925DFEC795}>LocalServer32
105. In the right panel, locate and delete the entry:
     (Default) = "{malware file path and name}"
106. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{E3F7EF3D-CF41-48BD-93D5-D1925DFEC795}>TypeLib
107. In the right panel, locate and delete the entry:
     (Default) = "{F5AF018C-2993-4F60-B186-72AE59CCD1E3}"
108. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{E3F7EF3D-CF41-48BD-93D5-D1925DFEC795}>VERSION
109. In the right panel, locate and delete the entry:
     (Default) = "2.1"
110. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ATXml06.clsEFILE
111. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.clsEFILE"
112. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ATXml06.clsEFILE>Clsid
113. In the right panel, locate and delete the entry:
     (Default) = "{E3F7EF3D-CF41-48BD-93D5-D1925DFEC795}"
114. Again In the right panel, locate and delete the entry:
     (Default) = "clsEFILE"
115. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{E4946C33-031F-47E5-A655-5DFF4A3E6EE2}>ProxyStubClsid
116. In the right panel, locate and delete the entry:
     (Default) = "{00020424-0000-0000-C000-000000000046}"
117. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{B280B23B-7E53-4577-8FD5-7FC81B1739F0}
118. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.clsATXPrint"
119. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{B280B23B-7E53-4577-8FD5-7FC81B1739F0}>ProgID
120. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.clsATXPrint"
121. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{B280B23B-7E53-4577-8FD5-7FC81B1739F0}>LocalServer32
122. In the right panel, locate and delete the entry:
     (Default) = "{malware file path and name}"
123. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{B280B23B-7E53-4577-8FD5-7FC81B1739F0}>TypeLib
124. In the right panel, locate and delete the entry:
     (Default) = "{F5AF018C-2993-4F60-B186-72AE59CCD1E3}"
125. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{B280B23B-7E53-4577-8FD5-7FC81B1739F0}>VERSION
126. In the right panel, locate and delete the entry:
     (Default) = "2.1"
127. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ATXml06.clsATXPrint
128. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.clsATXPrint"
129. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ATXml06.clsATXPrint>Clsid
130. In the right panel, locate and delete the entry:
     (Default) = "{B280B23B-7E53-4577-8FD5-7FC81B1739F0}"
131. Again In the right panel, locate and delete the entry:
     (Default) = "clsATXPrint"
132. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{1476A3D2-6A76-45CF-8A0B-983E4F259098}>ProxyStubClsid
133. In the right panel, locate and delete the entry:
     (Default) = "{00020424-0000-0000-C000-000000000046}"
134. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{B72B32D5-9B6F-4630-8F99-DCE75A0BCB47}
135. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.IMain"
136. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{B72B32D5-9B6F-4630-8F99-DCE75A0BCB47}>ProgID
137. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.IMain"
138. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{B72B32D5-9B6F-4630-8F99-DCE75A0BCB47}>LocalServer32
139. In the right panel, locate and delete the entry:
     (Default) = "{malware file path and name}"
140. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{B72B32D5-9B6F-4630-8F99-DCE75A0BCB47}>TypeLib
141. In the right panel, locate and delete the entry:
     (Default) = "{F5AF018C-2993-4F60-B186-72AE59CCD1E3}"
142. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{B72B32D5-9B6F-4630-8F99-DCE75A0BCB47}>VERSION
143. In the right panel, locate and delete the entry:
     (Default) = "2.1"
144. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ATXml06.IMain
145. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.IMain"
146. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ATXml06.IMain>Clsid
147. In the right panel, locate and delete the entry:
     (Default) = "{B72B32D5-9B6F-4630-8F99-DCE75A0BCB47}"
148. Again In the right panel, locate and delete the entry:
     (Default) = "IMain"
149. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{28A55B1F-C3F4-4A28-8FD3-39280F6CFAB3}>ProxyStubClsid
150. In the right panel, locate and delete the entry:
     (Default) = "{00020424-0000-0000-C000-000000000046}"
151. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{9A89175F-8D8D-4846-ACFF-49EC7DC1FF0D}
152. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.clsReturn"
153. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{9A89175F-8D8D-4846-ACFF-49EC7DC1FF0D}>ProgID
154. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.clsReturn"
155. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{9A89175F-8D8D-4846-ACFF-49EC7DC1FF0D}>TypeLib
156. In the right panel, locate and delete the entry:
     (Default) = "{F5AF018C-2993-4F60-B186-72AE59CCD1E3}"
157. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{9A89175F-8D8D-4846-ACFF-49EC7DC1FF0D}>VERSION
158. In the right panel, locate and delete the entry:
     (Default) = "2.1"
159. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ATXml06.clsReturn
160. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.clsReturn"
161. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ATXml06.clsReturn>Clsid
162. In the right panel, locate and delete the entry:
     (Default) = "{9A89175F-8D8D-4846-ACFF-49EC7DC1FF0D}"
163. Again In the right panel, locate and delete the entry:
     (Default) = "clsReturn"
164. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{322E61AA-53A2-498D-8644-03B53A2105C9}>ProxyStubClsid
165. In the right panel, locate and delete the entry:
     (Default) = "{00020424-0000-0000-C000-000000000046}"
166. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{35849DFA-D9D3-40F1-8117-4BAB84DEB2AE}
167. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.ATXmlFormSetNode"
168. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{35849DFA-D9D3-40F1-8117-4BAB84DEB2AE}>ProgID
169. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.ATXmlFormSetNode"
170. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{35849DFA-D9D3-40F1-8117-4BAB84DEB2AE}>LocalServer32
171. In the right panel, locate and delete the entry:
     (Default) = "{malware file path and name}"
172. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{35849DFA-D9D3-40F1-8117-4BAB84DEB2AE}>TypeLib
173. In the right panel, locate and delete the entry:
     (Default) = "{F5AF018C-2993-4F60-B186-72AE59CCD1E3}"
174. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{35849DFA-D9D3-40F1-8117-4BAB84DEB2AE}>VERSION
175. In the right panel, locate and delete the entry:
     (Default) = "2.1"
176. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ATXml06.ATXmlFormSetNode
177. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.ATXmlFormSetNode"
178. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ATXml06.ATXmlFormSetNode>Clsid
179. In the right panel, locate and delete the entry:
     (Default) = "{35849DFA-D9D3-40F1-8117-4BAB84DEB2AE}"
180. Again In the right panel, locate and delete the entry:
     (Default) = "ATXmlFormSetNode"
181. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{9F790079-8315-4F94-B839-0EE7C3819F12}>ProxyStubClsid
182. In the right panel, locate and delete the entry:
     (Default) = "{00020424-0000-0000-C000-000000000046}"
183. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{4017EC2C-56FA-4C9A-A598-9D880B76D3D7}
184. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.ATXmlClientNode"
185. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{4017EC2C-56FA-4C9A-A598-9D880B76D3D7}>ProgID
186. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.ATXmlClientNode"
187. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{4017EC2C-56FA-4C9A-A598-9D880B76D3D7}>LocalServer32
188. In the right panel, locate and delete the entry:
     (Default) = "{malware file path and name}"
189. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{4017EC2C-56FA-4C9A-A598-9D880B76D3D7}>TypeLib
190. In the right panel, locate and delete the entry:
     (Default) = "{F5AF018C-2993-4F60-B186-72AE59CCD1E3}"
191. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{4017EC2C-56FA-4C9A-A598-9D880B76D3D7}>VERSION
192. In the right panel, locate and delete the entry:
     (Default) = "2.1"
193. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ATXml06.ATXmlClientNode
194. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.ATXmlClientNode"
195. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ATXml06.ATXmlClientNode>Clsid
196. In the right panel, locate and delete the entry:
     (Default) = "{4017EC2C-56FA-4C9A-A598-9D880B76D3D7}"
197. Again In the right panel, locate and delete the entry:
     (Default) = "ATXmlClientNode"
198. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{C7BCC8D3-B191-4ED4-B46A-B2277861C015}>ProxyStubClsid
199. In the right panel, locate and delete the entry:
     (Default) = "{00020424-0000-0000-C000-000000000046}"
200. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{CA2333E8-3255-4C72-93B1-25463753DD3F}
201. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.ATXmlReturnNode"
202. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{CA2333E8-3255-4C72-93B1-25463753DD3F}>ProgID
203. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.ATXmlReturnNode"
204. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{CA2333E8-3255-4C72-93B1-25463753DD3F}>LocalServer32
205. In the right panel, locate and delete the entry:
     (Default) = "{malware file path and name}"
206. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{CA2333E8-3255-4C72-93B1-25463753DD3F}>TypeLib
207. In the right panel, locate and delete the entry:
     (Default) = "{F5AF018C-2993-4F60-B186-72AE59CCD1E3}"
208. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{CA2333E8-3255-4C72-93B1-25463753DD3F}>VERSION
209. In the right panel, locate and delete the entry:
     (Default) = "2.1"
210. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ATXml06.ATXmlReturnNode
211. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.ATXmlReturnNode"
212. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ATXml06.ATXmlReturnNode>Clsid
213. In the right panel, locate and delete the entry:
     (Default) = "{CA2333E8-3255-4C72-93B1-25463753DD3F}"
214. Again In the right panel, locate and delete the entry:
     (Default) = "ATXmlReturnNode"
215. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{30744E3C-24A7-45C0-BD32-FDA5448BA9D1}>ProxyStubClsid
216. In the right panel, locate and delete the entry:
     (Default) = "{00020424-0000-0000-C000-000000000046}"
217. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{7BFDF3AD-3C06-4F9C-BD14-8802431EAB9D}
218. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.ATXmlDOMDocument"
219. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{7BFDF3AD-3C06-4F9C-BD14-8802431EAB9D}>ProgID
220. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.ATXmlDOMDocument"
221. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{7BFDF3AD-3C06-4F9C-BD14-8802431EAB9D}>LocalServer32
222. In the right panel, locate and delete the entry:
     (Default) = "{malware file path and name}"
223. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{7BFDF3AD-3C06-4F9C-BD14-8802431EAB9D}>TypeLib
224. In the right panel, locate and delete the entry:
     (Default) = "{F5AF018C-2993-4F60-B186-72AE59CCD1E3}"
225. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{7BFDF3AD-3C06-4F9C-BD14-8802431EAB9D}>VERSION
226. In the right panel, locate and delete the entry:
     (Default) = "2.1"
227. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ATXml06.ATXmlDOMDocument
228. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.ATXmlDOMDocument"
229. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ATXml06.ATXmlDOMDocument>Clsid
230. In the right panel, locate and delete the entry:
     (Default) = "{7BFDF3AD-3C06-4F9C-BD14-8802431EAB9D}"
231. Again In the right panel, locate and delete the entry:
     (Default) = "ATXmlDOMDocument"
232. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{4C2BE82C-FBE6-4D5F-BB69-8486E231927D}>ProxyStubClsid
233. In the right panel, locate and delete the entry:
     (Default) = "{00020424-0000-0000-C000-000000000046}"
234. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{E5742954-02BA-4107-8453-04473C31B49A}
235. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.ATXmlDataNode"
236. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{E5742954-02BA-4107-8453-04473C31B49A}>ProgID
237. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.ATXmlDataNode"
238. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{E5742954-02BA-4107-8453-04473C31B49A}>LocalServer32
239. In the right panel, locate and delete the entry:
     (Default) = "{malware file path and name}"
240. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{E5742954-02BA-4107-8453-04473C31B49A}>TypeLib
241. In the right panel, locate and delete the entry:
     (Default) = "{F5AF018C-2993-4F60-B186-72AE59CCD1E3}"
242. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{E5742954-02BA-4107-8453-04473C31B49A}>VERSION
243. In the right panel, locate and delete the entry:
     (Default) = "2.1"
244. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ATXml06.ATXmlDataNode
245. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.ATXmlDataNode"
246. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ATXml06.ATXmlDataNode>Clsid
247. In the right panel, locate and delete the entry:
     (Default) = "{E5742954-02BA-4107-8453-04473C31B49A}"
248. Again In the right panel, locate and delete the entry:
     (Default) = "ATXmlDataNode"
249. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{A8713635-724C-4CCD-BA0C-F2F58EB0BFBE}>ProxyStubClsid
250. In the right panel, locate and delete the entry:
     (Default) = "{00020424-0000-0000-C000-000000000046}"
251. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{506C91FD-BA31-44F5-A4C3-A5E65C7CF4DC}
252. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.ATXmlTabNode"
253. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{506C91FD-BA31-44F5-A4C3-A5E65C7CF4DC}>ProgID
254. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.ATXmlTabNode"
255. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{506C91FD-BA31-44F5-A4C3-A5E65C7CF4DC}>LocalServer32
256. In the right panel, locate and delete the entry:
     (Default) = "{malware file path and name}"
257. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{506C91FD-BA31-44F5-A4C3-A5E65C7CF4DC}>TypeLib
258. In the right panel, locate and delete the entry:
     (Default) = "{F5AF018C-2993-4F60-B186-72AE59CCD1E3}"
259. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{506C91FD-BA31-44F5-A4C3-A5E65C7CF4DC}>VERSION
260. In the right panel, locate and delete the entry:
     (Default) = "2.1"
261. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ATXml06.ATXmlTabNode
262. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.ATXmlTabNode"
263. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ATXml06.ATXmlTabNode>Clsid
264. In the right panel, locate and delete the entry:
     (Default) = "{506C91FD-BA31-44F5-A4C3-A5E65C7CF4DC}"
265. Again In the right panel, locate and delete the entry:
     (Default) = "ATXmlTabNode"
266. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{118B1C3F-83C8-466F-9996-8CCB80359E32}>ProxyStubClsid
267. In the right panel, locate and delete the entry:
     (Default) = "{00020424-0000-0000-C000-000000000046}"
268. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{90804A8E-0E10-4780-99E0-600F4273FC7C}
269. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.ATXmlRangeNode"
270. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{90804A8E-0E10-4780-99E0-600F4273FC7C}>ProgID
271. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.ATXmlRangeNode"
272. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{90804A8E-0E10-4780-99E0-600F4273FC7C}>LocalServer32
273. In the right panel, locate and delete the entry:
     (Default) = "{malware file path and name}"
274. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{90804A8E-0E10-4780-99E0-600F4273FC7C}>TypeLib
275. In the right panel, locate and delete the entry:
     (Default) = "{F5AF018C-2993-4F60-B186-72AE59CCD1E3}"
276. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{90804A8E-0E10-4780-99E0-600F4273FC7C}>VERSION
277. In the right panel, locate and delete the entry:
     (Default) = "2.1"
278. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ATXml06.ATXmlRangeNode
279. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.ATXmlRangeNode"
280. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ATXml06.ATXmlRangeNode>Clsid
281. In the right panel, locate and delete the entry:
     (Default) = "{90804A8E-0E10-4780-99E0-600F4273FC7C}"
282. Again In the right panel, locate and delete the entry:
     (Default) = "ATXmlRangeNode"
283. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{421B6D3E-4B0C-4615-B456-5C2AE7C23D3C}>ProxyStubClsid
284. In the right panel, locate and delete the entry:
     (Default) = "{00020424-0000-0000-C000-000000000046}"
285. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{417D8B2B-B8AA-41C5-B3B9-91FCA194C145}
286. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.ATXmlParseError"
287. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{417D8B2B-B8AA-41C5-B3B9-91FCA194C145}>ProgID
288. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.ATXmlParseError"
289. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{417D8B2B-B8AA-41C5-B3B9-91FCA194C145}>LocalServer32
290. In the right panel, locate and delete the entry:
     (Default) = "{malware file path and name}"
291. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{417D8B2B-B8AA-41C5-B3B9-91FCA194C145}>TypeLib
292. In the right panel, locate and delete the entry:
     (Default) = "{F5AF018C-2993-4F60-B186-72AE59CCD1E3}"
293. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{417D8B2B-B8AA-41C5-B3B9-91FCA194C145}>VERSION
294. In the right panel, locate and delete the entry:
     (Default) = "2.1"
295. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ATXml06.ATXmlParseError
296. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.ATXmlParseError"
297. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ATXml06.ATXmlParseError>Clsid
298. In the right panel, locate and delete the entry:
     (Default) = "{417D8B2B-B8AA-41C5-B3B9-91FCA194C145}"
299. Again In the right panel, locate and delete the entry:
     (Default) = "ATXmlParseError"
300. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{A051CF9E-DE19-4190-961D-C0131CB19D55}>ProxyStubClsid
301. In the right panel, locate and delete the entry:
     (Default) = "{00020424-0000-0000-C000-000000000046}"
302. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{271BBCFA-A2CA-45F3-816B-23AD8485D43B}
303. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.ATXmlIndexNode"
304. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{271BBCFA-A2CA-45F3-816B-23AD8485D43B}>ProgID
305. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.ATXmlIndexNode"
306. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{271BBCFA-A2CA-45F3-816B-23AD8485D43B}>LocalServer32
307. In the right panel, locate and delete the entry:
     (Default) = "{malware file path and name}"
308. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{271BBCFA-A2CA-45F3-816B-23AD8485D43B}>TypeLib
309. In the right panel, locate and delete the entry:
     (Default) = "{F5AF018C-2993-4F60-B186-72AE59CCD1E3}"
310. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{271BBCFA-A2CA-45F3-816B-23AD8485D43B}>VERSION
311. In the right panel, locate and delete the entry:
     (Default) = "2.1"
312. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ATXml06.ATXmlIndexNode
313. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.ATXmlIndexNode"
314. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ATXml06.ATXmlIndexNode>Clsid
315. In the right panel, locate and delete the entry:
     (Default) = "{271BBCFA-A2CA-45F3-816B-23AD8485D43B}"
316. Again In the right panel, locate and delete the entry:
     (Default) = "ATXmlIndexNode"
317. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{6CAAD269-40AA-4122-A8DB-860B452D23F7}>ProxyStubClsid
318. In the right panel, locate and delete the entry:
     (Default) = "{00020424-0000-0000-C000-000000000046}"
319. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{A8E1F7FF-02BC-4692-BCC1-8650AA5864D1}
320. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.ATXmlFormNode"
321. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{A8E1F7FF-02BC-4692-BCC1-8650AA5864D1}>ProgID
322. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.ATXmlFormNode"
323. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{A8E1F7FF-02BC-4692-BCC1-8650AA5864D1}>LocalServer32
324. In the right panel, locate and delete the entry:
     (Default) = "{malware file path and name}"
325. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{A8E1F7FF-02BC-4692-BCC1-8650AA5864D1}>TypeLib
326. In the right panel, locate and delete the entry:
     (Default) = "{F5AF018C-2993-4F60-B186-72AE59CCD1E3}"
327. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>CLSID>{A8E1F7FF-02BC-4692-BCC1-8650AA5864D1}>VERSION
328. In the right panel, locate and delete the entry:
     (Default) = "2.1"
329. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ATXml06.ATXmlFormNode
330. In the right panel, locate and delete the entry:
     (Default) = "ATXml06.ATXmlFormNode"
331. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>ATXml06.ATXmlFormNode>Clsid
332. In the right panel, locate and delete the entry:
     (Default) = "{A8E1F7FF-02BC-4692-BCC1-8650AA5864D1}"
333. Again In the right panel, locate and delete the entry:
     (Default) = "ATXmlFormNode"
334. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Classes>Wow6432Node>Interface>{DBCDFB21-E896-4B0B-B9B0-84F9AB755F5E}>ProxyStubClsid
335. In the right panel, locate and delete the entry:
     (Default) = "{00020424-0000-0000-C000-000000000046}"
336. Close Registry Editor.