Satiloler manual removal:
Kill processes:
lsass.exe, ctfmon.exe, userinit.exe
Delete registry values:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\userinit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable=FFFFFF9D
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan=0
Delete files:lsass.exe, ctfmon.exe, userinit.exe, bluetooth.dll, sfc_os.dll, desktops.ini
Misc:Exact file location:
lsass.exe - C:\Program Files\Common Files\System
ctfmon.exe - C:\Windows\System or C:\Winnt\System
userinit.exe, bluetooth.dll, sfc_os.dll, desktops.ini - C:\Windows\System, C:\Windows\System32 or C:\Winnt\System32
Post Comment: