Jump to content

recovering from unauthorized use of KMSpico by repair shop


Recommended Posts

Hello all,

I am not sure if I can ask for help with this issue here or not, but I thought I'd check.

Last Saturday I took my laptop in to a local repair shop.  The hard drive was dead, and the repair person replaced it, and also installed new copies of Windows 8.1 and Microsoft Office.   I picked up the computer on Monday, and on Tuesday noticed the presence of the "KMSpico" program in my start menu.  Some quick Googling revealed that this was a tool for illegally activating Office, and from these forums and other websites I learned that it could also come with some bad side effects.  So I'll describe what I've done so far, and then my questions will concern what I should do next.  Also, please note that I have read the policy regarding pirated software.  I did not give permission for pirated software to be installed on my computer, and if any remains on here, I want to get it off.

What I've done so far:

(1) I used the standard uninstall option in Windows to remove KMSpico.  This only removed some files.

(2) I uninstalled Microsoft Office.  I have replaced it with a new, legal version of Microsoft Office (I can get it as a free download through my University's software service).

(3) I ran Malwarebytes with the "scan for rootkits" option checked.  That found one and removed one file, named "HackTool."

(4) I manually deleted a folder I found in C:\ called "MSFree."

(5) I made sure that WIndows Firewall was on.

(5) I removed the antivirus software that the repair person had installed (Avast), and enabled Windows Defender.

(6) I ran a full scan with Windows Defender.  It found and removed two files:

TrojanDownloader:JS/nemucod.P

HackTool:Win32/AutoKMS

(7) I am running a new Full scan with Defender as I write this.

I have the suspicion that not all of the relevant files have been removed.  I have downloaded the Farbar Recovery Scan Tool, so if it would help, I could send logs from that. 

So my questions at this point are the following:

(1) I am now wondering if the new copy of Windows 8.1 is also not legit.  Is there a way I can check?   Do I need to do a clean install of the OS?

(2) What else do I need to do to make sure my machine is safe, and that all the KMSpico-related files are removed?

 

Thanks very much for your time.

 

 

 

 

 

 

 

 

 

Link to post
Share on other sites

Thanks for the reply.  That's unfortunate to hear that it may be a counterfeit OS.   When I purchased the laptop (Sony Vaio, from a Best Buy, in 2013), it came with Windows 8 installed.  I upgraded to 8.1 when that became available.   I still have the box the laptop came in, and I've been looking through the paperwork in there, and can't find anything that looks like a Windows 8 product key.  Is there some other way I could access the license info?  I was thinking of maybe contacting Vaio support (although they don't make Vaio laptops anymore, I think they still support them....).

 

Link to post
Share on other sites

Update on this: I could not find the product key for my original version of Windows, but I was able to get a new, legal copy of Windows 8.1., and a product key, from my University.  So a few days ago, I reinstalled Windows 8.1.  When doing so, I chose the option to "remove everything", although I see that Windows didn't really remove absolutely everything.  Amongst other things, there's a remaining folder in C: called "Windows.old" which I have not been able to delete.  I am first asked for administrator permission (which I can give), but then I am told that I need permission from "SYSTEM" to delete the files. 

So, I have two remaining questions:

-- Is the remaining Windows.old folder a concern (and/or is it a concern that I'm not being allowed to delete it)?

-- Can I be confident now that I'm clear of the malware left behind my KMSpico (note, both the Malwarebytes and Windows Defender scans come up clean)?

Thanks again for the time and input.

 

 

Link to post
Share on other sites

  • 2 months later...
  • Root Admin

Glad we could help. :)If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.