Home / malware

PDF

HackTool:Win32/AutoKMS

First posted on 05 February 2014.
Source: Microsoft

Aliases :

There are no other names known for HackTool:Win32/AutoKMS.

Explanation :

Threat behavior

This tool tries to activate an unregistered copy of Microsoft Office.

It shows the following message:



It drops AutoKMS.log into your PC. This file contains the following text:

----------------------------------------
AutoKMS 2.4.3.0 Ran At .
Attempting To Activate Microsoft Office
Attempting to Activate OfficeProPlus-KMS_Client

----------------------------------------

It also creates a task so that the tool is run everyday at the same time.



Analysis by Ferdinand Plazo

Symptoms

You might see a message box that looks like this:

Last update 05 February 2014

 

TOP