KMSEmulator

Viruses and worms
21

Can you tell me how to get rid of it?

22

Aside KMSEmulator, no malicous entries was found in logs. Waiting for VirusTotal results. If you can’t upload it to VirusTotal, let me know and I will give you instructions for FRST fix.

23

Oh, hello, i have already posted results from Virustotal.

24

Sorry.

KMS Emulator is also used for Microsoft Office and you have Microsoft Office Professional Plus 2010 installed which you defintely didn’t buy because that edition is only available to enterprise customers. I can rid of it but you will not be able to use Microsoft Office and you will have to install free alternative like LibreOffice.

25
  • Open Notepad (click Start button → type notepad.exe → press Enter)
  • Copy text from code block below and paste it into Notepad
HKLM\...\Run: [AutoKMS] => C:\Windows\AutoKMS.exe [615936 2016-01-02] ()
C:\Windows\AutoKMS.exe
C:\windows\kmsemulator.exe
  • Go to File → Save As
  • Make sure that UTF-8 is selected as Encoding (left side of Save button)
  • Save it as fixlist.txt on Desktop
  • Open again FRST and click on button Fix
  • Wait until FRST finishes
  • fixlog.txt should be genereted and opened. Attach it your post and wait further instructions.
26

I am sorry… I want to trust you, but in the code there is RUN and i dont want to turn it on.

27

I am sorry if i ask you something dumb like this… I am kind of scared so i dont want to make a mistake.

28

This will remove KMS activator form your system. Do whatever you want.

29

Here… Fixlog

30
Every time i turn on PC and i got on my desktop, Firewall pops up and saying if i want to allow KMSemulator in private or public networks.....
And what does it say now?
31

Well… now there was no Firewall saying this… Now there was an error text : AutoKMS - you have acitvated … (something, i cant remember what was it) more then 10 times…

32

And now nothing, because thanks for the code, i dont have AutoKMS now :)… but kmsemulator was still in firewall…

33

Can you make screenshot of that error?

34

Sorry, I can´t… that code you send me deleted the AutoKMS and i restarted PC and i don´t have the messege again…

35

Well then, this is it.

• The following will implement some post-cleanup procedures:

=> Please download DelFix by Xplode to your Desktop.
Run the tool and check the following boxes below;
[i]
http://www.mcshield.net/personal/magna86/Images/checkmark.png
Remove disinfection tools

http://www.mcshield.net/personal/magna86/Images/checkmark.png
Create registry backup

http://www.mcshield.net/personal/magna86/Images/checkmark.png
Purge System Restore [/i]
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:[b]DelFix.txt[/b])

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.

36

And after i do this?? I dont have it anymore?

37

KMSEmulator should be gone right?

38

Yep. It is gone.

39

Thnaks for help guys :slight_smile: