New fake xp virus Trojan

Windows 7 got hit

even in safe mode the funny message still showing

So I chose to shutdown the system in safemode , then I saw gog.exe is sticking

Restart the PC , press f8

Choose repair

Then run cmd

Do a search for gog.exe and rename it

Voila, the PC boots to normal mode and install malwarebyte's anti malware update and scan
it can find the renamed file, under username appdata roamdata?

You have to know the local admin password to recover this way
It