Should I block it?
Yes, 98% block recommendation.
Possible reason:
Multiple malware detections
Additional versions
AutoKMS.exe
AutoKMS
| Version: | 2.2.2.0 |
| MD5: | 07605abeb10fc533881c91f19decf69a |
| SHA1: | 13ee8c9fce6f74512dcd188cca0655c5ede37612 |
| SHA256: | cf7ea402d800e3fc6a0cda2136afd044aa2f8a97182b7e527d3e1970303c0067 |
Warning 19 antivirus scanners has detected malware.
Overview
autokms.exe is set to be start when the PC boots and any user logs into Windows (added to the Run registry key for the all users under the local machine). The assembly utilizes the .NET run-time framework (which is required to be installed on the PC).
Details
| File name: | autokms.exe |
| Product name: | AutoKMS |
| Typical file path: | C:\windows\autokms\autokms.exe |
| File version: | 2.2.2.0 |
| Size: | 1.83 MB (1,923,584 bytes) |
| Digital DNA |
| File packed: | No |
| Code language: | Microsoft Visual C# / Basic .NET |
| .NET CLR: | Yes |
| .NET NGENed: | No |
More details
Behaviors
Scheduled tasks
- The job 'AutoKMSCustom' runs daily in the path '\AutoKMSCustom'
- The task 'AutoKMSDaily' runs daily in the path '\AutoKMSDaily'
- The job 'AutoKMS' runs daily in the path '\AutoKMS'
- Entry path '\AutoKMSDaily'
- Entry path '\AutoKMS'
- Entry path 'C:\WINDOWS\Tasks\AutoKMS.job'
Scheduled tasks startups
Set to load on user login (bypasses Windows UAC if enabled)
- Login entry path '\AutoKMS'
Startup files (all users) run
Runs under the registry key 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
- 'AutoKMS' → C:\WINDOWS\AutoKMS.exe
Malware detections
Based on 40+ industry antivirus scanners, 19 of them detected the following malware.
| Antivirus engine | Engine version | Detection |
| Agnitum |
5.5.1.3 |
Trojan.DR.Agent!vUMtdLQQGW8 |
| Avira AntiVir |
7.11.72.208 |
TR/Dropper.Gen |
| Antiy Labs AVL |
2.0.3.7 |
Trojan/Win32.Pakes.gen |
| avast! |
6.0.1289.0 |
Win32:PUP-gen [PUP] |
| AVG |
2014.0.3629 |
HackTool.TEO |
| Commtouch |
5.4.1.7 |
W32/Trojan.IOLG-8678 |
| Comodo Internet Security |
15943 |
UnclassifiedMalware |
| eSafe |
7.0.17.0 |
Win32.TRDropper |
| ESET NOD32 |
7.8231 |
a variant of Win32/HackKMS.B |
| Fortinet |
5.0.43.0 |
W32/CrackOffice.0A24!tr |
| Ikarus |
T3.1.4.0.0 |
not-a-virus:Activator.MSOffice |
| Malwarebytes |
1.70.0.9 |
Trojan.AutoKMS |
| McAfee |
5.400.1158 |
Generic KeyGen |
| McAfee Gateway Anti-Malware |
v2012.1-dat |
Generic KeyGen |
| Norman |
7.00.22 |
Suspicious_Gen2.PQUNW |
| Sophos |
4.87.0 |
Troj/AutoKMS-A |
| Trend Micro |
9.740.0.1012 |
HKTL_HACKMS |
| Trend Micro HouseCall |
9.700.0.1001 |
HKTL_HACKMS |
| VIPRE Antivirus |
16902 |
Trojan.Win32.Generic!BT |
Distribution by Windows OS
| OS version | distribution |
| Windows 7 Ultimate |
32.91% |
|
| Windows 7 Home Premium |
16.46% |
|
| Windows 8 |
7.59% |
|
| Windows 7 Professional |
7.59% |
|
| Windows 8 Pro |
7.59% |
|
| Windows 8.1 |
5.06% |
|
| Windows 8.1 Pro with Media Center |
3.80% |
|
| Windows 8.1 Single Language |
2.53% |
|
| Windows 8 Enterprise N |
2.53% |
|
| Microsoft Windows XP |
2.53% |
|
| Windows 7 Enterprise |
2.53% |
|
| Windows 7 Starter |
2.53% |
|
| Windows 8 Enterprise |
2.53% |
|
| Windows 8.1 Pro |
1.27% |
|
| Windows 8.1 Pro Preview with Media Center |
1.27% |
|
| Windows 7 Home Basic |
1.27% |
|
Distribution by country
United States installs about 11.39% of AutoKMS.
Distribution by PC manufacturer
| PC Manufacturer | distribution |
| Lenovo |
33.71% |
|
| ASUS |
15.73% |
|
| Toshiba |
13.48% |
|
| Acer |
8.99% |
|
| Hewlett-Packard |
7.87% |
|
| Intel |
4.49% |
|
| Dell |
4.49% |
|
| GIGABYTE |
4.49% |
|
| American Megatrends |
3.37% |
|
| Samsung |
3.37% |
|
