Klone manual removal:
Kill processes:
paradise.raw.exe, symsvcsa.exe, winlogon.exe, [X].exe
Delete registry values:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nvchost
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\nvchost
Delete files:paradise.raw.exe, symsvcsa.exe, winlogon.exe, [X].exe, winuqw32.dll
Misc:[X] is a combination of random characters.
Exact file location:
winlogon.exe - C:\Windows or C:\Winnt
paradise.raw.exe, symsvcsa.exe, [X].exe, winuqw32.dll - C:\Windows\System, C:\Windows\System32 or C:\Winnt\System32
Post Comment: