Syswin32 virus and exe Association

Today, we helped our colleagues to kill viruses. It was the syswin32 virus. Because no antivirus software was available on his machine, it was nothing complicated to Kaba. But this virus changes the registry, making it impossible for all EXE files to run. When running any EXE file, a dialog box is displayed. Change the EXE suffix to com or SCR to run properly. Check the registry, no image hijacking, check startup items, and no suspicious startup items. At last, it is basically suspected that it is the association of the extension in the registry.
But there is no ready-made solution, so if you try it in it, you don't need to talk nonsense if you take a lot of detours. The final solution is to delete the exefile project under hk_class_root and replace it with the same project of the normal host. The problem is that the default open method of EXE is modified.