[illusions]

作者: zhl409

Thanks for giving detailed instructions. I renamed those 5 files and rebooted my machine this morning. When I saw your reply here, I download and inst...

Since you rename them, it cannot find those files so it can not run those exe but it is better for you to delete those 5 files because they are viruses.

It is only when it run those exe then Nyancat thing will appear.


Note: I just noticed the registry run command of rr.exe and ar.exe still there refer to the picture.
Also the free version of Ccleaner can do the job no need to use the trial or buy the Ccleaner software.

Double check there is no run commands of any of these

client.exe ....................appdata\roaming\microsoft\windows\start menu\programs\startup\client.exe
defender.exe.................appdata\roaming\microsoft\windows\start menu\programs\startup\defender.exe
startmenu.exe..............appdata\roaming\microsoft\windows\start menu\programs\startup\startmenu.exe

svchost.exe..................appdata\local\temp\rr.exe
sys32.exe....................appdata\local\temp\ar.exe