Help to get rid of Trojan Virus AActools

[u/Yogurt_Cezary]

So I got infected by a fake Windows key product but .. I didn't download it?? At all?

I deleted all files that were named or anything AActools I deleted in normal mode, safe mode and task scheduler.

I also know of AutoKMS or so but I didn't have any files named that (yes I also had show hidden files)

My windows say there's no activation key anymore and my windows security scans all came out clean (offline and quick) except I'm doing the long check rn.

I've logged out of all suspicious log ins to my accounts and changed all passwords.

I'm still paranoid and need advice.

[u/Iam_best_dev]

Did you buy this from a local shop or somewhere else? They might have installed it.

I never heard about that but if the seller downloaded it from a somewhat trustworthy site it should be safe?

[u/Yogurt_Cezary → u/Iam_best_dev]

hey first thanks for replying! Secondly I was gifted the device (in this case a Lenovo Laptop) from one of my mom's old coworkers. 

From what my mom told me it's brand new and barely used but I do think because they did use it there's maybe a chance.

Of course I don't want to blame anyone however for it because there's also a chance I somehow got it. 

The reason I don't really think it's safe is because My Windows security flagged it and almost instantly started to delete and quarantine. (<- to add on it even send me to the Microsoft website that proves it's a real Trojan virus) At some point it even failed to deleted the remnants of the virus, so, cue me, who has no knowledge on tech, booting up safe mode to get rid of the files the defender failed to delete.

Additionally my accounts had logins from devices I don't own. 

Now my windows defender claims there's no threats, my activation key claims there is no key (which is true I don't have a key) and there appears to be no more files related to AActools nor KMSAuto.

I've checked apps, deleted zips, ran commands and everything seems fine, though I don't have a watermark for windows (very strange)

I just want to make sure I've deleted everything and gotten rid of the virus.

Oh and also I cleared my browser cache AND turned off my WiFi during the process of deleting stuff

[u/Iam_best_dev → u/Yogurt_Cezary]

Additionally my accounts had logins from devices I don't own.

That's an important detail you didn't mention. In that case reinstall Windows using a USB there's plenty of tutorials on YouTube. Also disconnect from the internet and change all your passwords and logins you had on that Laptop on another device. If you need help then I'll try my best here

Edit: I'm an idiot and didn't see you saying that in the post. Sorry!

[u/Yogurt_Cezary → u/Iam_best_dev]

Haha you're fine I'm the bigger idiot.

Now here comes the issue.. I can't really reinstall windows using an usb. I don't have spare laptops or computers laying around. 

I could maybe go back into the safe mode screen or whatever it's called and try to reinstall windows from there (I think I saw an option like that) but otherwise I don't believe I have any hopes.

Also I disconnected it from the WiFi thanks!

If you could offer anymore advice, what could it be? 

[u/Iam_best_dev → u/Yogurt_Cezary]

You're texting on a phone right? Not sure about iPhones but on Android you can prepare the USB as well if you have one that plugs into your phone's port.

Do you know anyone that has a computer? You could ask them if they can let you use it for a few minutes maybe an hour it shouldn't take too long I think

[u/Yogurt_Cezary → u/Iam_best_dev]

Yes I'm texting on android, however I have spectacular news! I didn't actually have any suspicious logging ins. Turns out since my phone is a TCL and I have a sim card, the "suspicious" log in was actually... Me. Bruh sound effect.

t613k is just coined with the TCL phone. Not a random hacker.

I did have a strange Linux log in however but it hasn't attempted to log in since I removed it and it was a long time ago. 

I don't think I have an USB that can connect to my phone however, yikes. 

As for someone with a computer or laptop, I know yes, but they literally use Tlauncher for Minecraft so my guess their laptop is with spyware is pretty much solid 

[u/Iam_best_dev → u/Yogurt_Cezary]

Linux logins happen sometimes on Android if you use desktop mode.

Not sure if it's malware or not. You can maybe install something like Malwarebytes temporary and do a full scan just to see what those say compared to Windows Defender.

If you don't notice anything weird then you're probably safe.

I'd say just don't login on any accounts on it for now and see what Malwarebytes or another antivirus says.

[u/Yogurt_Cezary → u/Iam_best_dev]

Cheers mate I'll do that. Currently running the Microsoft malicious software removal tool to see what it has in store for me, I'll get Malwarebytes and if that cleans everything out I'll let the laptop chill for a few days then I'll log onto accounts 

[u/Iam_best_dev → u/Yogurt_Cezary]

If Malwarebytes does detect anything it's best to reinstall... If nothing gets detected you might just be fine

[u/Yogurt_Cezary → u/Iam_best_dev]

Malwarebytes found nothing! And actually it's kind of pretty nice ngl though I'll run a second scan and I'll let you know