ブラウザからtammgf119.sysを削除します

Tammgf119.sys is a very specific threat, since it is believed to modify your system files and it prevents the antimalware software to clean your computer from it. There are two methods to remove it:

メソッド番号 1 (Easier way)

1.Using an alternative browser, ブラウザの機能が無効になる可能性があるため. If you are having problems on Internet Explorer, ウイルス対策ソフトウェアのダウンロードについては、MozillaFirefoxを参照してください。, 例えば.
2. Using a usb drive. 別のコンピューターをお持ちの場合, download the antimalware software on that computer. その後、フラッシュドライブを使用してインストーラーを転送し、感染したPCにインストールしてから、スキャンします.
3. セーフモードの使用. ソフトウェアでマルウェアをスキャンしているときに問題が発生した場合, コンピュータを再起動し、再起動したらすぐに, F8キーを押し始めてから、[セーフモードとネットワーク]を選択します. コンピュータがセーフモードで起動した後、ウイルス対策ソフトウェアでスキャンします.

スキャン後に脅威が発見された場合, erase it, then reboot your PC and you should be fine.

メソッド番号 2 (手動による取り外し)

手動で削除したい場合 (より複雑で時間のかかる方法), 次の手順に従ってください:

ステップ 1: Task Manager kill of tammgR119.sys/tammgF119.sys
Press Ctrl+Shift+Esc altogether in order to start Windows Task Manager. その後, clock on ‘Processes’ 上のタブ. Windowsで実行している場合 7 PC click on the button ‘Show Processes From All Users’ 下. Then Look for one of these two .sys processes – tammgR119.sys/tammgF119.sys, mark them with the mouse and press on the down right button of the task manager, called ‘End Task’

ステップ 2: 彼らが「死んだ」後, あなたのPCから隠しファイルを明らかにする:

1) Clicking on Start button and then on Control Panel
2) Clicking on Personalization
3) Pressing Windows button + E button together to open Computer Window
4) Clicking on the View Tab
5) Unticking ‘Hidden Items’ tick box in order to see hidden files
6) Unchecking ‘Hide Protected System Files’ フォルダオプションで
7) After which clicking on the ‘OK’ ボタン

ステップ 3: レジストリエントリのクリーニング:

In order to delete modified registry settings please:
1)Press Windows button+R in order to bring up the Run prompt
2)Type in it regedit then click on OK
3)While you are in the Registry Editor, press Ctrl+F in order to open the search prompt.
4)その後、現在のレジストリファイルを検索します:
5)Look for tammg files (tammgR119.sys or tammgF119.sys) or anything similar to this.
6)Look for the current registry or directory filenames and delete them:

“HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{5FE4C7E8-4766-445B-82F6-71173C81FCDB}”
“HKLM SOFTWARE Microsoft Windows NT CurrentVersion Schedule TaskCache Tasks {5FE4C7E8-4766-445B-82F6-71173C81FCDB}”
C:\Windows\System32\Tasks\ProPCCleaner_Start
“HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ProPCCleaner_Start”
“HKLM SOFTWARE Microsoft Windows NT CurrentVersion Schedule TaskCache Plain {8EBE8D1E-A665-47B4-8B2B-EAFE489702FB}”
“HKLM SOFTWARE Microsoft Windows NT CurrentVersion Schedule TaskCache Tasks {8EBE8D1E-A665-47B4-8B2B-EAFE489702FB}”
“HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\tammgF119.sys”
“HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\tammgR119.sys”
“HKLM\System\CurrentControlSet\Control\SafeBoot\Network\tammgF119.sys”
“HKLM\System\CurrentControlSet\Control\SafeBoot\Network\tammgR119.sys”
“HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Yobepv”
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{A956B474-0F3F-46F8-8E15-221ACEC9E521}
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{A0C43E7F-3710-49F2-BB2D-BBE11A4CB0F2}
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{751B456C-915D-4B36-9219-00DE00FF9921}
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{ECBCD4AD-7DA0-4910-97AC-45C9B72E1EC5}
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{23876C7D-0A49-48CB-BB8E-177AE7FB8CE3}
“C:\ProgramData\boostwebapp”
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ospd_us_1051
HKU\S-1-5-21-2738088566-3435062512-1088739105-1002\Software\Microsoft\Windows\CurrentVersion\Run\\WindApp
“C:\Users\signalhunt\AppData\Roaming\Store\WindApp”
“HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer”
HKU\S-1-5-21-2738088566-3435062512-1088739105-1002\Software\Microsoft\Internet Explorer\Main\\Secondary Start Pages
HKU\S-1-5-21-2738088566-3435062512-1088739105-1002\Software\Microsoft\Internet Explorer\Main\\Default_Secondary_Page_URL
“HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}”
HKCR\Wow6432Node\CLSID\{006ee092-9658-4fd6-bd8e-a21a348e59f5}
“HKU\S-1-5-21-2738088566-3435062512-1088739105-1002\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66}”
HKCR CLSID {012E1000-F331-11DB-8314-0800200C9A66}
“HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}”
“HKCR CLSID {B4F3A835-0E21-4959-BA22-42B3008E02FF}”
Winsock: Catalog entry 000000000001 => Deleted successfully.
Winsock: Catalog entry 000000000002 => Deleted successfully.
Winsock: Catalog entry 000000000003 => Deleted successfully.
Winsock: Catalog entry 000000000004 => Deleted successfully.
Winsock: Catalog entry 000000000016 => Deleted successfully.
Winsock: Catalog entry 000000000001 => Deleted successfully.
Winsock: Catalog entry 000000000002 => Deleted successfully.
Winsock: Catalog entry 000000000003 => Deleted successfully.
Winsock: Catalog entry 000000000004 => Deleted successfully.
Winsock: Catalog entry 000000000016 => Deleted successfully.
Chrome HomePage
“HKU\S-1-5-21-2738088566-3435062512-1088739105-1002\SOFTWARE\Google\Chrome\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh”
{3bd15086-1d37-406a-8359-19d3be69d4dd}Gw64
“C:\windows\System32\Tasks\ProPCCleaner_Popup”
“C:\windows\System32\Tasks\ProPCCleaner_Start”
“C:\Users\VictimPC\Documents\ProPCCleaner”
“C:\Users\VictimPC\AppData\Local\Pro_PC_Cleaner”
C:\windows\SysWOW64\Yobepv.ini
C:\windows\SysWOW64\YobepvOff.ini
C:\windows\system32\YobepvOff.ini
C:\windows\system32\Drivers\tammgR119.sys
C:\windows\system32\Drivers\tammgF119.sys
“C:\windows\system32\Yobepv64.dll”
“C:\windows\SysWOW64\Yobepv.dll”

Note that those files and registries were all infected or corrupted and only some of them could be removed so don`t be scared if you are not able to delete all of them. Also bear in mind that these files are from a different system so there might be some variables, 別のOSのように, 例えば.

My advice is to follow the first method because of the uniqueness of your situation.