Categories: Crack

Should I remove “HackTool.Win32.KMSAuto.i”?

The HackTool.Win32.KMSAuto.i is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What HackTool.Win32.KMSAuto.i virus can do?

Behavioural detection: Executable code extraction – unpacking
Sample contains Overlay data
Reads data out of its own binary image
Drops a binary and executes it
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine HackTool.Win32.KMSAuto.i?


File Info:
name: 7A596F43E30C04B044A1.mlwpath: /opt/CAPEv2/storage/binaries/c0f05ae32ba4b8ecaebf95c1b02eb15d8b7b0379d221af7e9b6733f6feecf9a0crc32: 20FC8824md5: 7a596f43e30c04b044a172b6f859dfd5sha1: 54780a4b890b8eed1195c07c51cf7afe056717d1sha256: c0f05ae32ba4b8ecaebf95c1b02eb15d8b7b0379d221af7e9b6733f6feecf9a0sha512: 1db86b3e65fc68b497423e573e1711862927701a18e77c5cc4752ebec4a2607c55186df63eeb0529afd7583ca643340dc6e3be13eeaf07bb74e1bc7c0ea882cfssdeep: 49152:PhbNVHUylYcWtO8w4JxsOvJRw5LtImArZZtySrpMl54zhReLKEe:PvVHUFe4/sm36ShrtVwaheKEetype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T180952302F7D34435F669057DD8A1C088AF3B797969F1142E2EFCD60E5ABD1816C3B9A0sha3_384: f4ab8d98a664454630e876940b58f2f7b6a9b51b4b75297f70ad22b599480411534538c4eb3f8070df9b86dac6a0dea8ep_bytes: 558bec83c4a453565733c08945c48945timestamp: 2010-04-10 16:57:59
Version Info:
Comments: This installation was built with Inno Setup.CompanyName: Staforce Team                                               FileDescription: Активатор Office 2010                                       FileVersion: 2010                LegalCopyright: Staforce Team                                                                                       ProductName: Активатор Office 2010                                       ProductVersion: 3.1                 Translation: 0x0000 0x04b0

HackTool.Win32.KMSAuto.i also known as:

Bkav	W32.Common.D2137C58
Lionic	Hacktool.Win32.KMSActivator.3!c
MicroWorld-eScan	Application.Hacktool.KMSActivator.BG
FireEye	Application.Hacktool.KMSActivator.BG
CAT-QuickHeal	HackTool.KMSAuto.S71577
Skyhigh	BehavesLike.Win32.ObfuscatedPoly.tc
McAfee	Artemis!7A596F43E30C
Cylance	unsafe
Sangfor	Hacktool.Win32.KMSAuto.Vgoy
Symantec	PUA.InstallCore
ESET-NOD32	a variant of Win32/HackKMS.A potentially unsafe
TrendMicro-HouseCall	TROJ_GEN.R002C0DBG24
Kaspersky	HackTool.Win32.KMSAuto.i
BitDefender	Application.Hacktool.KMSActivator.BG
Emsisoft	Application.Hacktool.KMSActivator.BG (B)
DrWeb	Trojan.DownLoader26.23169
VIPRE	Application.Hacktool.KMSActivator.BG
TrendMicro	TROJ_GEN.R002C0DBG24
Sophos	Keygen (PUA)
Webroot	W32.Malware.Gen
Varist	W32/Risk.CPMH-7345
MAX	malware (ai score=100)
Kingsoft	Win32.HackTool.KMSAuto.i
Microsoft	Trojan:Win32/Phonzy.A!ml
Xcitium	ApplicUnwnt@#3pzsk6oead550
Arcabit	Application.Hacktool.KMSActivator.BG
ZoneAlarm	HackTool.Win32.KMSAuto.i
GData	Application.Hacktool.KMSActivator.BG
BitDefenderTheta	Gen:NN.ZexaF.36804.jmW@aKDmhmj
ALYac	Application.Hacktool.KMSActivator.BG
VBA32	Trojan.Downloader
Malwarebytes	Generic.Malware/Suspicious
Rising	Trojan.Generic@AI.90 (RDML:cSHVIstLPPfDywmuQDV2dA)
Ikarus	Trojan.Win32.Agent
MaxSecure	Trojan.Malware.3405.susgen
Fortinet	W32/Backdoor!tr
DeepInstinct	MALICIOUS