WinRecon manual removal:
Kill processes:
dataview.exe, codex.exe, condex.exe, sp5.exe, winrecon.exe
Delete registry values:HKEY_LOCAL_MACHINE\SOFTWARE\Arboc
HKEY_LOCAL_MACHINE\SOFTWARE\Gentee\Paths\WinRecon [XVS]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\kpsc.kpscEnc
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\kpview1.kpview
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3B7C8860-D78F-101B-B9B5-04021C009402}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3EDF892D-D60F-4E94-83BC-A93BC4C91D1D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{78E5A540-1850-11CF-9D53-00AA003C9CB6}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AFC634B0-4B8B-11CF-8989-00AA00688B10}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B617B991-A767-4F05-99BA-AC6FCABB102E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3065315-1D2C-4992-8F24-57FEF0E1DCB5}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{09D14D02-1C28-4EA5-9D34-101E6A1C688F}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3B7C8862-D78F-101B-B9B5-04021C009402}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4008A442-D2E8-4A64-8BBA-F145CA9D60C9}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{859321D0-3FD1-11CF-8981-00AA00688B10}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D0E090C1-F267-4152-B718-EFB01B139522}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3DE1EFF-67BA-4317-89D7-BB60FC26E414}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E9A5593C-CAB0-11D1-8C0B-0000F8754DA1}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{ED117630-4090-11CF-8981-00AA00688B10}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{1CA5F9A1-DA0A-4C31-8C7F-81B497EAD912}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3B7C8863-D78F-101B-B9B5-04021C009402}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F2DDA1D5-C5A2-4149-9D82-3B7ABE4CB411}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\TypeLib\(Default)={BDC217C8-ED16-11CD-956C-0000C04E4C0A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\TypeLib\(Default)={BDC217C8-ED16-11CD-956C-0000C04E4C0A}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinRecon
Delete files:dataview.exe, codex.exe, condex.exe, sp5.exe, winrecon.exe, kpaccess.dll, kpsc.ocx, kpview.ocx
Misc:[XVS] is the version number or name.
Exact file location:
dataview.exe, codex.exe, condex.exe, sp5.exe, winrecon.exe - C:\Program Files\WinRecon
kpaccess.dll, kpsc.ocx, kpview.ocx - C:\Windows\System, C:\Windows\System32 or C:\Winnt\System32