Application.Hacktool.KMSActivator.GG removal tips

The Application.Hacktool.KMSActivator.GG is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Application.Hacktool.KMSActivator.GG virus can do?

Yara rule detections observed from a process memory dump/dropped files/CAPE
Dynamic (imported) function loading detected
Reads data out of its own binary image
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Application.Hacktool.KMSActivator.GG?


File Info:
name: 1E9F4142357C72071D59.mlw
path: /opt/CAPEv2/storage/binaries/73222a5f5855dbf5e9fb8fa6286ed8e6d872ec02660027a335245fad4f30b9b4
crc32: F799B5C5
md5: 1e9f4142357c72071d5972f74efa4d6e
sha1: 5c6ba7097d4912a191546e61b8ff0561d5f68f7d
sha256: 73222a5f5855dbf5e9fb8fa6286ed8e6d872ec02660027a335245fad4f30b9b4
sha512: 0d699ca4034e1b23d481592a0b1f360626c8443c8a042285a3e341ef4eb03a57ba3394584d85dbe5619f1de67aa5e734aad8a45d5a0d9efcffe365234587daef
ssdeep: 6144:S5VP9Ge3+hoAvdeJBbLncZHesONzON5qL9gkJq5KAxfguMmE3H1kXi:S5393whFOBbA6celCPz7y
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T17B74F121BBEA41F6C5E33270591537A691FBF3350F1559CB6B90060B2E226D29F3E2C6
sha3_384: 16630aadd5fb491df02b1b95e53190940677a288f4865c79fe7e95b823784fef01537e8cef8dff93f832cfa6ffdef4ae
ep_bytes: 558bec6aff6880fa410068f0c4410064
timestamp: 2016-04-02 22:14:34

Version Info:
CompanyName: mephistooo2 - TNCTR.com
FileDescription: $OEM$ Sanal KMS Sunucu v5
FileVersion: 5.0.0.0
InternalName: $OEM$.exe
LegalCopyright: mephistooo2 - TNCTR.com
OriginalFilename: $OEM$.exe
ProductName: Sanal KMS Sunucu v5
ProductVersion: 5.0.0.0
Translation: 0x0409 0x04b0

Application.Hacktool.KMSActivator.GG also known as:

Lionic	Trojan.Win32.Generic.4!c
MicroWorld-eScan	Application.Hacktool.KMSActivator.GG
FireEye	Generic.mg.1e9f4142357c7207
CAT-QuickHeal	Trojan.Bluteal
McAfee	Artemis!1E9F4142357C
Cylance	Unsafe
Sangfor	Hacktool.Win32.AutoKMS.mt
K7AntiVirus	Unwanted-Program ( 0056d7e41 )
K7GW	Unwanted-Program ( 0056d7e41 )
Cybereason	malicious.2357c7
BitDefenderTheta	Gen:NN.ZexaE.34182.lu0@amxKechi
Cyren	W64/Trojan.SIAN-6321
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/HackKMS.BP potentially unsafe
TrendMicro-HouseCall	TROJ_GEN.R002H06L820
Paloalto	generic.ml
ClamAV	Win.Malware.Drivepack-9884589-1
BitDefender	Application.Hacktool.KMSActivator.GG
Avast	FileRepMalware [PUP]
Sophos	Generic Reputation PUA (PUA)
Comodo	Malware@#12l2zd95yglam
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0DJN21
McAfee-GW-Edition	BehavesLike.Win32.Generic.fc
Emsisoft	Application.Hacktool.KMSActivator.GG (B)
SentinelOne	Static AI – Suspicious SFX
Jiangmin	Trojan/CoinMiner.ab.a
eGambit	Unsafe.AI_Score_99%
MAX	malware (ai score=97)
Antiy-AVL	GrayWare/Win32.Presenoker
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	HackTool:Win32/AutoKMS
GData	Application.Hacktool.KMSActivator.FQ
AhnLab-V3	Malware/Win32.Generic.C2503327
ALYac	Application.Hacktool.KMSActivator.FQ
VBA32	BScope.TrojanDownloader.Banload
Malwarebytes	Malware.AI.4257922059
APEX	Malicious
Rising	Trojan.Bluteal!8.EFE7 (CLOUD)
Fortinet	W32/PossibleThreat
Webroot	W32.Adware.Gen
AVG	FileRepMalware [PUP]
Panda	Trj/CI.A

How to remove Application.Hacktool.KMSActivator.GG?

Application.Hacktool.KMSActivator.GG removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X