Rogue software PCHOME\.SETUPF, Realupdate.exe solution _ Virus killing

This log is from the Help Sreng log sorted out, the main performance is pop-up ads, after receiving the mail, found that this dongdong in front of time to tidy up the rogue software 0848\baisoa almost consistent, it seems to be just a new version of nothing new

Virus files and folders


%windir%\winamps.exe
%windir%\realupdate.exe
%windir%\popnts. Dll
%windir%\scnotify.dll
%system%\{pchome}\.setupf\


To add a registry startup entry

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
Updatereal%windir%\realupdate.exe Other
Winsamps%windir%\winamps.exe


Startup items posing as Microsoft information


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
Nt\currentversion\winlogon\notify]
Sccardlogn%windir%\scnotify.dll


Add a BHO


HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID]
[HKEY_CLASSES_ROOT\CLSID]
{de7c3cf0-4b15-11d1-abed-709549c10000}%windir%\popnts. Dll


Solution:

1. Stop the process of Winamps.exe and Realupdate.exe
2, delete all the registry information added
3, after reboot delete, or use unlocker to remove all virus files

Ps:

1, due to virus variants, may be the actual situation with the description of this article is different, but the removal method is certain
2, because it has download horse characteristics, in addition, may accompany other virus or rogue software