Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Another KMSpico virus


  • Please log in to reply
2 replies to this topic

#1 samthebull

samthebull

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:01:30 PM

Posted 22 April 2017 - 07:15 PM

Hello,

 

Windows 10 Pro

 

I've been infected with the KMSPico virus.  I've run  Adwcleaner, Malwarebytes Anti-Malware and Junkware Removal Tool, however, there is a script file (cmd), that starts delayed as soon as I login to Windows and the virus returns.

 

Avast finds variations of this: C\Windows\System32\BIT275B.tmp, and quarantines it. It is a svchost.exe process

 

Program Files (x86)\a6a285fa-015b-4bb6-937c-9770911605db1492724791 is present and can not be deleted.

 

My Chrome search provider has been hijacked and always defaults to a variation of: intitialpage123.

 

There are also multiple instances (always 3 or 4) of Google Chrome running in task manager, when only one window or tab is in use.

 

Help is appreciated,

 

Thank you.


Edited by samthebull, 22 April 2017 - 08:53 PM.
Moved from MRL (no FRST log) to AII - Hamluis.


BC AdBot (Login to Remove)

 


#2 samthebull

samthebull
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:01:30 PM

Posted 24 April 2017 - 03:53 PM

Additional information:

 

Can not access Google Chrome extension folder - access denied (can not load extensions adblock etc), gives me this error:

 

Could not move extension directory into profile.



#3 samthebull

samthebull
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:01:30 PM

Posted 26 April 2017 - 10:18 PM

Please close,

 

Reformatted.

 

Thx anyway.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users