Windows 10 Pro
I've been infected with the KMSPico virus. I've run Adwcleaner, Malwarebytes Anti-Malware and Junkware Removal Tool, however, there is a script file (cmd), that starts delayed as soon as I login to Windows and the virus returns.
Avast finds variations of this: C\Windows\System32\BIT275B.tmp, and quarantines it. It is a svchost.exe process
Program Files (x86)\a6a285fa-015b-4bb6-937c-9770911605db1492724791 is present and can not be deleted.
My Chrome search provider has been hijacked and always defaults to a variation of: intitialpage123.
There are also multiple instances (always 3 or 4) of Google Chrome running in task manager, when only one window or tab is in use.
Help is appreciated,
Edited by samthebull, 22 April 2017 - 08:53 PM.
Moved from MRL (no FRST log) to AII - Hamluis.