attempting to fully scrub system of kms authenticators

[adoppie91]

Hello,

 

im sorry if this isnt the appropriate forum for such a  request but i am trying to fully rid my system of any trace of the three kms activators that i have installed in the past.

kmspico

KMSAuto Net - ratiborus

KMS R@1n

 

My system is being strangled by Microsoft Software Protection Platform Service (sppsvc.exe) cpu usage upwards of 30-50%.

I have run MB3 threat scan and have attached the results below as well as adwcleaner results.

i am assuming thatthere still remnats from kms in folders within temp/app data etc. as well as registry entries that need to be deleted. is this correct?

I really appreciate any direction you may be able to provide!

mb3_scan_results_june_21_2019.txt adw_cleaner_scan_results_june_21_2019.txt

[adoppie91]

FRST attached, thanks in advanced!FRST_scan_June_21_2019.txtFRST_scan_Addition_June_21_2019.txt

[AdvancedSetup]

Hello @adoppie91 and

The best advice really would be to copy all of your personal data to a backup folder on an external drive. Then download the official Windows 10 ISO image from Microsoft since you've now gone legit and burn that to an 8GB USB thumb drive. Then boot from that USB drive and remove the partition and allow Windows to create a new partition and install Windows 10 clean.

Cleaning up the damage done from these hacking tools will leave the computer in a quasi non trusted state as you'll never know 100% if you did remove all the damage done.

The entire process would only take a few hours even for a new person, but the results would be a clean, well trusted computing environment.

Thanks

Ron

 

[adoppie91]

Roger that.  thank you for your input.

 

as for the high cpu usage from Microsoft Software Protection Platform Service (sppsvc.exe) the culprit was (kms-R@1n)  task setup in taskscheduler running/re-arming every 60 seconds which was initiating the sppsvc. once the task was deleted, cpu usage leveled out.  just posting this as this seems to be a common occurrence.

 

Thanks

[AdvancedSetup]

Yes, there is no doubt I can stop and clean up the computer. It's the hidden damage that is not so easy to find and ensure there is not some sort of back door in place.

 

Edited June 22, 2019 by AdvancedSetup
updated information

[AdvancedSetup]

Since this issue is resolved the topic will now be closed to prevent others from posting here.

If you need assistance please start your own new topic and someone will be happy to assist you.

Thanks