Solved Please help me remove KMS-R@1n

jmarket · Jun 26, 2017

Hi hoagvn and welcome to PCHF

Please download Junkware Removal Tool and save it on your desktop.

Shut down your anti-virus, anti-spyware, and firewall software now to avoid potential conflicts.

Run the tool by double-clicking it. If you are using Windows Vista or Windows 7, right-click it and select Run as administrator.

The tool will open and start scanning your system.

Please be patient as this can take a while to complete depending on your system's specifications.

On completion, a log is saved to your desktop and will automatically open.

Please post the JRT log.

ZHP Diag Scan

Download ZHP Diag to your desktop.

1. Right Click Run as Admin.

2. Click the Options button.

Click on Check All
Then Click Validate
Then click close.

2. Click the Scanner button.

When complete please push the report button.
A notepad will open... copy and paste the report in your next reply.

Malwarebytes Scan.

Download MalwareBytes Anti-Malware : https://www.malwarebytes.com/mwb-download/ take the free version ( on the left )
Perform the installation
Uncheck « Enable Free Trial of Malwarebytes Anti-Malware Premium » if it’s asked
Malwarebytes will update, let this update,
Click on the « Settings » tab and then on the « Detection and Protection » tab, Check the box « Search for Rootkits »
Click on the « Analysis » tab and then on « Start analysis »
Once the review is complete, check that all detections are checked and then click [Delete Selection]
If Malwarebytes asks you to restart your PC, click « Yes »,
When restarting your PC, restart Malwarebytes
Open the « History » tab and then « Application logs »
Double click on the last Scan Log in date (the one above)
At the bottom click [Export] -> select « Text file (* .txt) »
In the explorer selects the desktop, name it mbam.txt, click [Save]

copy/paste the content of the report in your next reply

I will tag @Malnutrition to assist you

Malnutrition · Jun 26, 2017

FRST Fix.

Click Here To Download Fixlist.

Download attached fixlist.txt file and save it to the Desktop. NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work. NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system Run FRST/FRST64 and press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run. When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

File Search.

Get the Everything Search Engine
Install Program, Right Click Run As Admin. Type R@1n into to search window.
Then Click Edit.
Select all.
Right Click highlighted items>>>>>>>> Copy full name to clipboard. >>>>> Paste content of clipboard, here in your next reply.

hoagvn · Jun 27, 2017

Malnutrition said:
FRST Fix.

Click Here To Download Fixlist.

Download attached fixlist.txt file and save it to the Desktop. NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work. NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system Run FRST/FRST64 and press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run. When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

File Search.

Get the Everything Search Engine
Install Program, Right Click Run As Admin. Type R@1n into to search window.
Then Click Edit.
Select all.
Right Click highlighted items>>>>>>>> Copy full name to clipboard. >>>>> Paste content of clipboard, here in your next reply.

Fix result of Farbar Recovery Scan Tool (x64) Version: 25-06-2017 01
Ran by MasterOliveira (27-06-2017 15:24:41) Run:1
Running from C:\Users\Master\Downloads
Loaded Profiles: MasterOliveira (Available Profiles: defaultuser0 & MasterOliveira)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
CreateRestorePoint:
Closeprocesses:
Emptytemp:
RemoveProxy:
C:\Windows\KMS-R@1n.exe
C:\Windows\KMS-R@1nhook.exe
IFEO\OSppSvc.exe: [Debugger] KMS-R@1nhook.exe
IFEO\SppExtComObj.exe: [Debugger] KMS-R@1nhook.exe
R2 KMS-R@1n; C:\Windows\KMS-R@1n.exe [26112 2017-02-21] () [File not signed]
C:\WINDOWS\System32\Tasks\AutoKMS
C:\WINDOWS\System32\Tasks\R@1n-KMS
Task: {A756B3FE-23B1-46F7-8F81-F7C8D67C49E5} - System32\Tasks\R@1n-KMS\Windows64Professional => wmic [Argument = path SoftwareLicensingProduct where (ID="2de67392-b7a7-462a-b1ca-108dd189f588") call Activate]
FirewallRules: [{53248AE3-5BA9-4E25-95EA-A5D3B3C30646}] => (Allow) C:\Windows\KMS-R@1n.exe
FirewallRules: [{D848A167-283C-458D-B04C-3603C94E6C4B}] => (Allow) C:\Windows\KMS-R@1n.exe
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-03-15] (Oracle Corporation)
HKU\S-1-5-21-3746342138-3061863375-479099754-1001\...\Run: [ASRockRuefi] => [X]
HKU\S-1-5-21-3746342138-3061863375-479099754-1001\...\Run: [Fatal1tyMousePort] => [X]
Startup: C:\Users\Master\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Product Registration.lnk [2017-06-24]
ShortcutTarget: Logitech . Product Registration.lnk -> D:\Program Files (x86)\Logitech\Ereg\eReg.exe (Leader Technologies/Logitech)
GroupPolicy: Restriction <==== ATTENTION
CHR Extension: (Google Bảng tính) - C:\Users\Master\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-06-26]
CHR Extension: (Google Tài liệu ngoại tuyến) - C:\Users\Master\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-06-26]
CHR Extension: (Thanh toán trên cửa hàng Chrome trực tuyến) - C:\Users\Master\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-06-26]
CHR Extension: (Google Trang trình bày) - C:\Users\Master\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-06-26]
CHR Extension: (Google Tài liệu) - C:\Users\Master\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-06-26]
R1 ESEADriver2; C:\Users\Master\AppData\Local\Temp\ESEADriver2.sys [340096 2017-06-23] () <==== ATTENTION
C:\Users\Master\AppData\Local\Temp\ESEADriver2.sys
Folder: C:\WINDOWS\cd_127
C:\Users\Master\Downloads\uTorrent.exe
Folder: C:\WINDOWS\SHELLNEW
C:\Windows\AutoKMS.exe
Task: {5AD17E39-6EB5-4595-876D-A5BB7ADAF4AC} - System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-06-08] (NVIDIA Corporation)
Task: {67CC92E3-35E1-4EA9-8433-3DFF92BAF03A} - System32\Tasks\AutoKMS => C:\Windows\AutoKMS.exe [2017-02-21] ()
Task: {7B8FE978-A1E0-4C42-AEBE-D14C642B7EF8} - System32\Tasks\FACEIT AC => D:\Program Files\FACEIT AC\faceitclient.exe [2017-06-23] ()
Task: {37C7888E-A289-4C55-AD3D-9875C5259383} - System32\Tasks\Launcher GIGABYTE AORUS GRAPHICS ENGINE => D:\Program Files (x86)\GIGABYTE\AORUS GRAPHICS ENGINE\AORUS.exe [2017-06-08] (GIGABYTE Technology Co.,Ltd.)
Task: {952167E0-577A-4073-AF47-EBCB2572CB66} - System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe [2017-06-08] (NVIDIA Corporation)
Task: {A680943C-89B3-485F-8462-C4016A5A726E} - System32\Tasks\Microsoft\Windows\UIU\UIUTask => C:\Windows\UIUTask\UIUTask.exe [2017-06-26] (Conexant Systems, Inc.)
Task: {AEFAFE14-772D-453F-84F3-FA478385501D} - System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [2017-06-08] (NVIDIA Corporation)
Task: {B39F8B02-F86B-4170-B6EB-5F29AE97523A} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-06-08] (NVIDIA Corporation)
Task: {C5D359B9-AB9B-4D3E-AC0C-0C5A2DD09635} - System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2017-06-08] (NVIDIA Corporation)
Task: {CD80DC3A-D8E8-4338-A517-B1256D4BFB8F} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2017-06-08] (NVIDIA Corporation)
Task: {EBCDAB52-5339-44C4-86DD-A563A005E298} - System32\Tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA GeForce Experience.exe [2017-06-08] (NVIDIA Corporation)
Task: {F964B6F0-6418-49D2-9554-0D480E1B18D7} - System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe [2017-06-08] (NVIDIA Corporation)
Task: C:\WINDOWS\Tasks\AutoKMS.job => C:\Windows\AutoKMS.exe
C:\WINDOWS\KMS-QADhook.dll
C:\WINDOWS\system32\Drivers\etc\hosts
Hosts:
HKLM\...\StartupApproved\Run32: => "BCSSync"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "LWS"
HKU\S-1-5-21-3746342138-3061863375-479099754-1001\...\StartupApproved\Run: => "CocCoc Update"
HKU\S-1-5-21-3746342138-3061863375-479099754-1001\...\StartupApproved\Run: => "OneDrive"
Zip: C:\WINDOWS\Minidump
CMD: ipconfig /flushdns
reboot:
end

*****************

Error: (0) Failed to create a restore point.
Processes closed successfully.

========= RemoveProxy: =========

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\S-1-5-21-3746342138-3061863375-479099754-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\S-1-5-21-3746342138-3061863375-479099754-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully

========= End of RemoveProxy: =========

C:\Windows\KMS-R@1n.exe => moved successfully
C:\Windows\KMS-R@1nhook.exe => moved successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\OSppSvc.exe => key removed successfully
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SppExtComObj.exe => key removed successfully
HKLM\System\CurrentControlSet\Services\KMS-R@1n => key removed successfully
KMS-R@1n => service removed successfully
C:\WINDOWS\System32\Tasks\AutoKMS => moved successfully
C:\WINDOWS\System32\Tasks\R@1n-KMS => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A756B3FE-23B1-46F7-8F81-F7C8D67C49E5} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A756B3FE-23B1-46F7-8F81-F7C8D67C49E5} => key removed successfully
C:\WINDOWS\System32\Tasks\R@1n-KMS\Windows64Professional => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\R@1n-KMS\Windows64Professional => key removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{53248AE3-5BA9-4E25-95EA-A5D3B3C30646} => value removed successfully
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{D848A167-283C-458D-B04C-3603C94E6C4B} => value removed successfully
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched => value removed successfully
HKU\S-1-5-21-3746342138-3061863375-479099754-1001\Software\Microsoft\Windows\CurrentVersion\Run\\ASRockRuefi => value removed successfully
HKU\S-1-5-21-3746342138-3061863375-479099754-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Fatal1tyMousePort => value removed successfully
C:\Users\Master\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Product Registration.lnk => moved successfully
D:\Program Files (x86)\Logitech\Ereg\eReg.exe => moved successfully
C:\WINDOWS\system32\GroupPolicy\Machine => moved successfully
C:\WINDOWS\system32\GroupPolicy\GPT.ini => moved successfully
C:\Users\Master\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap => moved successfully
C:\Users\Master\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi => moved successfully
C:\Users\Master\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda => moved successfully
C:\Users\Master\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek => moved successfully
C:\Users\Master\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake => moved successfully
ESEADriver2 => Unable to stop service.
HKLM\System\CurrentControlSet\Services\ESEADriver2 => key removed successfully
ESEADriver2 => service removed successfully
C:\Users\Master\AppData\Local\Temp\ESEADriver2.sys => moved successfully

========================= Folder: C:\WINDOWS\cd_127 ========================

C:\WINDOWS\cd_127 => File

====== End of Folder: ======

C:\Users\Master\Downloads\uTorrent.exe => moved successfully

========================= Folder: C:\WINDOWS\SHELLNEW ========================

2009-07-30 07:42 - 2009-07-30 07:42 - 0008746 _____ () C:\WINDOWS\SHELLNEW\EXCEL12.XLSX
2005-12-14 10:15 - 2005-12-14 10:15 - 0059904 _____ () C:\WINDOWS\SHELLNEW\MSPUB.PUB
2007-08-22 05:56 - 2007-08-22 05:56 - 0027140 _____ () C:\WINDOWS\SHELLNEW\PWRPNT12.PPTX

====== End of Folder: ======

C:\Windows\AutoKMS.exe => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{5AD17E39-6EB5-4595-876D-A5BB7ADAF4AC} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5AD17E39-6EB5-4595-876D-A5BB7ADAF4AC} => key removed successfully
C:\WINDOWS\System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{67CC92E3-35E1-4EA9-8433-3DFF92BAF03A} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{67CC92E3-35E1-4EA9-8433-3DFF92BAF03A} => key removed successfully
C:\WINDOWS\System32\Tasks\AutoKMS => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AutoKMS => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{7B8FE978-A1E0-4C42-AEBE-D14C642B7EF8} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7B8FE978-A1E0-4C42-AEBE-D14C642B7EF8} => key removed successfully
C:\WINDOWS\System32\Tasks\FACEIT AC => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\FACEIT AC => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{37C7888E-A289-4C55-AD3D-9875C5259383} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{37C7888E-A289-4C55-AD3D-9875C5259383} => key removed successfully
C:\WINDOWS\System32\Tasks\Launcher GIGABYTE AORUS GRAPHICS ENGINE => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Launcher GIGABYTE AORUS GRAPHICS ENGINE => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{952167E0-577A-4073-AF47-EBCB2572CB66} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{952167E0-577A-4073-AF47-EBCB2572CB66} => key removed successfully
C:\WINDOWS\System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{A680943C-89B3-485F-8462-C4016A5A726E} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A680943C-89B3-485F-8462-C4016A5A726E} => key removed successfully
C:\WINDOWS\System32\Tasks\Microsoft\Windows\UIU\UIUTask => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UIU\UIUTask => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{AEFAFE14-772D-453F-84F3-FA478385501D} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AEFAFE14-772D-453F-84F3-FA478385501D} => key removed successfully
C:\WINDOWS\System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B39F8B02-F86B-4170-B6EB-5F29AE97523A} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B39F8B02-F86B-4170-B6EB-5F29AE97523A} => key removed successfully
C:\WINDOWS\System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C5D359B9-AB9B-4D3E-AC0C-0C5A2DD09635} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C5D359B9-AB9B-4D3E-AC0C-0C5A2DD09635} => key removed successfully
C:\WINDOWS\System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{CD80DC3A-D8E8-4338-A517-B1256D4BFB8F} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CD80DC3A-D8E8-4338-A517-B1256D4BFB8F} => key removed successfully
C:\WINDOWS\System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{EBCDAB52-5339-44C4-86DD-A563A005E298} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{EBCDAB52-5339-44C4-86DD-A563A005E298} => key removed successfully
C:\WINDOWS\System32\Tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{F964B6F0-6418-49D2-9554-0D480E1B18D7} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F964B6F0-6418-49D2-9554-0D480E1B18D7} => key removed successfully
C:\WINDOWS\System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => key removed successfully
C:\WINDOWS\Tasks\AutoKMS.job => moved successfully
C:\WINDOWS\KMS-QADhook.dll => moved successfully
C:\WINDOWS\system32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32\\BCSSync => value removed successfully
HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\BCSSync => value removed successfully
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32\\SunJavaUpdateSched => value removed successfully
HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched => value not found.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32\\LWS => value removed successfully
HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\LWS => value removed successfully
HKU\S-1-5-21-3746342138-3061863375-479099754-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run\\CocCoc Update => value removed successfully
HKU\S-1-5-21-3746342138-3061863375-479099754-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\CocCoc Update => value not found.
HKU\S-1-5-21-3746342138-3061863375-479099754-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run\\OneDrive => value removed successfully
HKU\S-1-5-21-3746342138-3061863375-479099754-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\OneDrive => value removed successfully
================== Zip: ===================
C:\WINDOWS\Minidump -> copied successfully to C:\Users\Master\Desktop\27.06.2017_15.24.49.zip
=========== Zip: End ===========

========= ipconfig /flushdns =========

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========

=========== EmptyTemp: ==========

BITS transfer queue => 7888896 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 17072747 B
Java, Flash, Steam htmlcache => 81686010 B
Windows/system/drivers => 3608448 B
Edge => 53014417 B
Chrome => 607824090 B
Firefox => 0 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 128 B
systemprofile32 => 0 B
LocalService => 0 B
NetworkService => 128902 B
defaultuser0 => 0 B
Master => 169104880 B

RecycleBin => 0 B
EmptyTemp: => 896.8 MB temporary data Removed.

================================

The system needed a reboot.

==== End of Fixlog 15:24:57 ====

Malnutrition · Jun 28, 2017

How is the machine running now?

ZHP Diag Scan

Download ZHP Diag to your desktop.

1. Right Click Run as Admin.

2. Click the Options button.

Click on Check All
Then Click Validate
Then click close.

2. Click the Scanner button.

When complete please push the report button.
A notepad will open... copy and paste the report in your next reply.

Malwarebytes Scan.

Download MalwareBytes Anti-Malware : https://www.malwarebytes.com/mwb-download/ take the free version ( on the left )
Perform the installation
Uncheck « Enable Free Trial of Malwarebytes Anti-Malware Premium » if it’s asked
Malwarebytes will update, let this update,
Click on the « Settings » tab and then on the « Detection and Protection » tab, Check the box « Search for Rootkits »
Click on the « Analysis » tab and then on « Start analysis »
Once the review is complete, check that all detections are checked and then click [Delete Selection]
If Malwarebytes asks you to restart your PC, click « Yes »,
When restarting your PC, restart Malwarebytes
Open the « History » tab and then « Application logs »
Double click on the last Scan Log in date (the one above)
At the bottom click [Export] -> select « Text file (* .txt) »
In the explorer selects the desktop, name it mbam.txt, click [Save]

copy/paste the content of the report in your next reply

File Search.

Get the Everything Search Engine
Install Program, Right Click Run As Admin. Type R@1n into to search window.
Then Click Edit.
Select all.
Right Click highlighted items>>>>>>>> Copy full name to clipboard. >>>>> Paste content of clipboard, here in your next reply.

Malnutrition · Jun 28, 2017

Also, please upload this newly created file from your desktop, this is your minidumps, I will take a look and see why your machine has been Bluescreening and try and work that out while we remove this malware from your machine.

Upload this file for me please. If the file is too large for this forum, then use Sendspace.com and send me the link please.

C:\Users\Master\Desktop\27.06.2017_15.24.49.zip

Malnutrition · Jun 30, 2017

@hoagvn How about an update please.

hoagvn · Jun 30, 2017

Malnutrition said:
@hoagvn How about an update please.

Sorry I have been busy for awhile.

Thank you everything seem to working fine, I don't see any KMS files anymore. I also bought a new RAM to place with the faulty one so there's no more bluescreen.

Malnutrition · Jul 1, 2017

Alright.

Glad to have helped!! Please tell a friend ...... or two about us.

Optimize your internet connection.

Click here for instructions.

suggest the following in place of adblock.
Alternate DNS Server. Ad Blocking DNS.
Ublock Origin.
Anti Ad Block Killer.

Also, keep your browsing private with these tools:

Self Destructing Cookies.
Self Destructing Cookies Chrome.

Some items to keep you safe on the internet.

VooDoo Shield. control of what is running on your machine
Qualys BrowserCheck To update plugins.
Unchecky To Avoid Bundled Software.
Privazer To Clean up your mahcine.

Now Lets Clean up the tools we used and remove old restore points.

Download DelFix by "Xplode" to your Desktop.
Right Click the tool and Run as Admin ( Xp Users Double Click)
Put a check mark next the items below:

Remove disinfection tools
Create registry backup
Purge System Restore

Now click on "Run" button.
allow the program to complete its work.
all the tools we used will be removed.
Tool will create and open a log report (DelFix.txt)
Note: The report can be located at the following location C:\DelFix.txt

hoagvn

Attachments

jmarket

PCHF's Almighty Ruler

Malnutrition

Malnurished Admin

Attachments

hoagvn

Attachments

Malnutrition

Malnurished Admin

Malnutrition

Malnurished Admin

Malnutrition

Malnurished Admin

hoagvn

Malnutrition

Malnurished Admin

Search

Search

Solved Please help me remove KMS-R@1n

We value your privacy