Trend Micro Security

CRCK_ACTVTOR

2015年5月6日
 別名:

Trojan.ADH.SMH (Symantec); Trojan.Win32.Generic!BT (Sunbelt); Could be a Trojan horse Dropper.Msil (AVG)

 プラットフォーム:

Windows

 危険度:
 感染確認数:
 システムへの影響:
 情報漏えい:


  • マルウェアタイプ: クラッキングツール
  • 破壊活動の有無: なし
  • 暗号化:  
  • 感染報告の有無: はい

  概要


プログラムは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

  詳細

ファイルサイズ 2,936,496 bytes
タイプ EXE
メモリ常駐 なし
発見日 2015年5月6日

侵入方法

プログラムは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

インストール

プログラムは、以下のフォルダを作成します。

  • %User Temp%\is-SCG0R.tmp
  • %User Temp%\is-7LLRS.tmp
  • %User Temp%\is-7LLRS.tmp\_isetup
  • %Program Files%\KMSpico
  • %Program Files%\KMSpico\sounds
  • %Program Files%\KMSpico\cert
  • %Program Files%\KMSpico\icons
  • %Program Files%\KMSpico\cert\kmscert2010
  • %Program Files%\KMSpico\cert\kmscert2010\Access
  • %Program Files%\KMSpico\cert\kmscert2010\Excel
  • %Program Files%\KMSpico\cert\kmscert2010\Groove
  • %Program Files%\KMSpico\cert\kmscert2010\InfoPath
  • %Program Files%\KMSpico\cert\kmscert2010\OneNote
  • %Program Files%\KMSpico\cert\kmscert2010\Outlook
  • %Program Files%\KMSpico\cert\kmscert2010\PowerPoint
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectPro
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectStd
  • %Program Files%\KMSpico\cert\kmscert2010\ProPlus
  • %Program Files%\KMSpico\cert\kmscert2010\Publisher
  • %Program Files%\KMSpico\cert\kmscert2010\SmallBusBasics
  • %Program Files%\KMSpico\cert\kmscert2010\Standard
  • %Program Files%\KMSpico\cert\kmscert2010\Visio
  • %Program Files%\KMSpico\cert\kmscert2010\Word
  • %Program Files%\KMSpico\cert\kmscert2013
  • %Program Files%\KMSpico\cert\kmscert2013\Access
  • %Program Files%\KMSpico\cert\kmscert2013\Excel
  • %Program Files%\KMSpico\cert\kmscert2013\InfoPath
  • %Program Files%\KMSpico\cert\kmscert2013\Lync
  • %Program Files%\KMSpico\cert\kmscert2013\OneNote
  • %Program Files%\KMSpico\cert\kmscert2013\Outlook
  • %Program Files%\KMSpico\cert\kmscert2013\PowerPoint
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectPro
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectStd
  • %Program Files%\KMSpico\cert\kmscert2013\ProPlus
  • %Program Files%\KMSpico\cert\kmscert2013\Publisher
  • %Program Files%\KMSpico\cert\kmscert2013\Standard
  • %Program Files%\KMSpico\cert\kmscert2013\VisioPro
  • %Program Files%\KMSpico\cert\kmscert2013\VisioStd
  • %Program Files%\KMSpico\cert\kmscert2013\Word
  • %Program Files%\KMSpico\cert\kmscertw6
  • %Program Files%\KMSpico\cert\kmscertw6\Business
  • %Program Files%\KMSpico\cert\kmscertw6\Enterprise
  • %Program Files%\KMSpico\cert\kmscertw7
  • %Program Files%\KMSpico\cert\kmscertw7\Enterprise
  • %Program Files%\KMSpico\cert\kmscertw7\Professional
  • %Program Files%\KMSpico\cert\kmscertw8
  • %Program Files%\KMSpico\cert\kmscertw8\Enterprise
  • %Program Files%\KMSpico\cert\kmscertw8\Enterprise\plugin-manifests-signed
  • %Program Files%\KMSpico\cert\kmscertw8\Enterprise\tokens
  • %Program Files%\KMSpico\cert\kmscertw8\Enterprise\tokens\addons
  • %Program Files%\KMSpico\cert\kmscertw8\Enterprise\tokens\addons\APPXLOB-Client
  • %Program Files%\KMSpico\cert\kmscertw8\Enterprise\tokens\addons\OCUR
  • %Program Files%\KMSpico\cert\kmscertw8\Enterprise\tokens\issuance
  • %Program Files%\KMSpico\cert\kmscertw8\Enterprise\tokens\legacy
  • %Program Files%\KMSpico\cert\kmscertw8\Enterprise\tokens\pkeyconfig
  • %Program Files%\KMSpico\cert\kmscertw8\Enterprise\tokens\ppdlic
  • %Program Files%\KMSpico\cert\kmscertw8\Enterprise\tokens\rules
  • %Program Files%\KMSpico\cert\kmscertw8\Enterprise\tokens\skus
  • %Program Files%\KMSpico\cert\kmscertw8\Enterprise\tokens\skus\csvlk-pack
  • %Program Files%\KMSpico\cert\kmscertw8\Enterprise\tokens\skus\Enterprise
  • %Program Files%\KMSpico\cert\kmscertw8\Professional
  • %Program Files%\KMSpico\cert\kmscertw81
  • %Program Files%\KMSpico\cert\kmscertw81\Professional
  • %Program Files%\KMSpico\logs
  • %Program Files%\KMSpico\scripts
  • %Program Files%\KMSpico\driver
  • %Program Files%\KMSpico\x64
  • %Program Files%\KMSpico\x86
  • %Start Menu%\Programs\KMSpico

(註：%User Temp%フォルダは、ユーザの一時フォルダで、Windows 2000、XP および Server 2003 の場合、通常、"C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"、Windows Vista 、 7 、8、8.1 、Server 2008 および Server 2012の場合、"C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。.. %Program Files%フォルダは、プログラムファイルのフォルダで、いずれのオペレーティングシステム(OS)でも通常、 "C:\Program Files"、64bitのOS上で32bitのアプリケーションを実行している場合、 "C:\Program Files (x86)" です。.. %Start Menu%フォルダは、Windows 2000、XP および Server 2003 の場合、通常、"C:\Windows\Start Menu" または "C:\Documents and Settings\＜ユーザ名＞\Start Menu"、Windows Vista 、 7 、8、8.1 、Server 2008 および Server 2012の場合、"C:\Users\＜ユーザ名＞\AppData\Roaming\Microsoft\Windows\Start Menu" です。.)

他のシステム変更

プログラムは、以下のファイルを削除します。

  • %Start Menu%\Programs\KMSpico\KMSpico.pif
  • %Start Menu%\Programs\KMSpico\KMSpico.url
  • %Start Menu%\Programs\KMSpico\Log KMSpico.pif
  • %Start Menu%\Programs\KMSpico\Log KMSpico.url
  • %Start Menu%\Programs\KMSpico\AutoPico.pif
  • %Start Menu%\Programs\KMSpico\AutoPico.url
  • %Start Menu%\Programs\KMSpico\Uninstall KMSpico.pif
  • %Start Menu%\Programs\KMSpico\Uninstall KMSpico.url
  • %Program Files%\KMSpico\logs\KMSELDI.log

(註：%Start Menu%フォルダは、Windows 2000、XP および Server 2003 の場合、通常、"C:\Windows\Start Menu" または "C:\Documents and Settings\＜ユーザ名＞\Start Menu"、Windows Vista 、 7 、8、8.1 、Server 2008 および Server 2012の場合、"C:\Users\＜ユーザ名＞\AppData\Roaming\Microsoft\Windows\Start Menu" です。.. %Program Files%フォルダは、プログラムファイルのフォルダで、いずれのオペレーティングシステム(OS)でも通常、 "C:\Program Files"、64bitのOS上で32bitのアプリケーションを実行している場合、 "C:\Program Files (x86)" です。.)

プログラムは、以下のレジストリキーを追加します。

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\System

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\PhishingFilter

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
KMSpico_is1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
ESENT\Process\KMSELDI

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
ESENT\Process\KMSELDI\
DEBUG

プログラムは、以下のレジストリ値を追加します。

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\System
EnableSmartScreen = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer
SmartScreenEnabled = "Off"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\PhishingFilter
EnabledV9 = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
KMSpico_is1
Inno Setup: Setup Version = "5.5.3 (a)"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
KMSpico_is1
Inno Setup: App Path = "%Program Files%\KMSpico"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
KMSpico_is1
InstallLocation = "%Program Files%\KMSpico"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
KMSpico_is1
Inno Setup: Icon Group = "KMSpico"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
KMSpico_is1
Inno Setup: User = "Wilbert"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
KMSpico_is1
Inno Setup: Language = "default"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
KMSpico_is1
DisplayName = "KMSpico v9.3"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
KMSpico_is1
DisplayIcon = "%Program Files%\KMSpico\KMSELDI.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
KMSpico_is1
UninstallString = "%Program Files%\KMSpico\unins000.exe "

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
KMSpico_is1
QuietUninstallString = "%Program Files%\KMSpico\unins000.exe /SILENT"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
KMSpico_is1
DisplayVersion = "9.3"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
KMSpico_is1
ModifyPath = "%Program Files%\KMSpico\UninsHs.exe /m0=AppId"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
KMSpico_is1
NoRepair = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
KMSpico_is1
InstallDate = "20140623"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
KMSpico_is1
MajorVersion = "9"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
KMSpico_is1
MinorVersion = "3"

プログラムは、以下のレジストリ値を変更します。

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Eventlog\Application\
ESENT
EventMessageFile = "%System%\ESENT.dll"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Eventlog\Application\
ESENT
CategoryMessageFile = "%System%\ESENT.dll"

(註：変更前の上記レジストリ値は、「{random values}」となります。)

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Eventlog\Application\
ESENT
CategoryCount = "1"

(註：変更前の上記レジストリ値は、「10」となります。)

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Eventlog\Application\
ESENT
TypesSupported = "7"

(註：変更前の上記レジストリ値は、「7」となります。)

プログラムは、以下のレジストリキーを削除します。

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
KMSpico_is1

作成活動

プログラムは、以下のファイルを作成します。

  • %Program Files%\KMSpico\cert\kmscert2010\ProjectPro\is-MNF5I.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectPro\is-H6Q09.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectPro\is-FDT02.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectPro\is-INK26.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectPro\is-VINT3.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectPro\is-I75KU.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectPro\is-B6N2A.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectPro\is-Q1LKF.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectPro\is-8HRRH.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectPro\is-465S1.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectPro\is-A1MGR.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectPro\is-6JAK3.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectStd\is-1MRCJ.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectStd\is-VHKGB.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectStd\is-6MKHC.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectStd\is-P18TP.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectStd\is-CTS01.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectStd\is-UU50J.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectStd\is-KJADL.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectStd\is-HI729.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectStd\is-UH69K.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectStd\is-0AQFI.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectStd\is-RDVJG.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectStd\is-7R26C.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectStd\is-QM413.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectStd\is-M1TJV.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectStd\is-28NKI.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectStd\is-GG42Q.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProPlus\is-N2U27.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProPlus\is-D6IOJ.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProPlus\is-5M06M.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProPlus\is-PR94A.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProPlus\is-GDQCO.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProPlus\is-MVFS5.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProPlus\is-SDV3H.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProPlus\is-H76BL.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProPlus\is-B4Q4D.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProPlus\is-AEIHE.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProPlus\is-M508U.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProPlus\is-AFFDI.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProPlus\is-UUNGU.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProPlus\is-S5LV6.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProPlus\is-7J3OI.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProPlus\is-B5SIP.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Publisher\is-KL3U4.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Publisher\is-H8903.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Publisher\is-VSBO7.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Publisher\is-2SGO3.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Publisher\is-5N5RN.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Publisher\is-RA430.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Publisher\is-AAAHL.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Publisher\is-24VE8.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Publisher\is-L5MTE.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Publisher\is-IQVAJ.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Publisher\is-86GIJ.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Publisher\is-9KIPV.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\SmallBusBasics\is-181R1.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\SmallBusBasics\is-DF8DK.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\SmallBusBasics\is-M5QCQ.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\SmallBusBasics\is-ITHK1.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\SmallBusBasics\is-LA0G9.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\SmallBusBasics\is-LLOMS.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\SmallBusBasics\is-OKUM1.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\SmallBusBasics\is-SD595.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\SmallBusBasics\is-BIPSU.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\SmallBusBasics\is-HAB52.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\SmallBusBasics\is-ILS81.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\SmallBusBasics\is-9UVQ3.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Standard\is-M504N.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Standard\is-CLIAV.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Standard\is-IU80H.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Standard\is-JL1RK.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Standard\is-ENEFC.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Standard\is-79EFA.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Standard\is-A6R1A.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Standard\is-450MG.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Standard\is-KN78M.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Standard\is-8B3CS.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Standard\is-6S0G3.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Standard\is-GAC7E.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Standard\is-92I0D.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Standard\is-7PEID.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Standard\is-OV3ML.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Standard\is-PDKV7.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-VCPA7.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-20T2J.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-A8U2N.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-JGI2I.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-3R8TV.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-JC1K9.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-TT562.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-HF7A7.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-TBBNB.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-11AI5.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-IUOMD.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-06B2V.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-RH9M3.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-STNQV.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-DLGDH.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-2ECDI.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-805U0.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-PSH1G.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-IKA95.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-6ROUN.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-QASMQ.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-DRRCF.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-7GOB2.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-PK2V7.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-ME1C8.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-7EFML.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-KREOV.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-R87BP.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-4ISE2.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-4AGEP.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Word\is-C9HSL.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Word\is-E3JL5.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Word\is-QR9G1.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Word\is-U4VNK.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Word\is-UV43R.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Word\is-K0C05.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Word\is-N6L9T.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Word\is-BAL7U.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Word\is-NAK0A.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Word\is-TGH5E.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Word\is-HVRND.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Word\is-P5KAD.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Access\is-I1A7P.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Access\is-KC6HQ.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Access\is-O45O9.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Access\is-D01TS.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Access\is-PCNK1.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Access\is-IKO61.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Access\is-4J7GA.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Access\is-1JQL1.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Access\is-EP32P.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Access\is-VT0MQ.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Access\is-ONU78.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Access\is-UN8MK.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Access\is-LKNLQ.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Access\is-M6FCU.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Excel\is-QQE8Q.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Excel\is-FMPTE.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Excel\is-RGIIR.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Excel\is-O3E54.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Excel\is-AB14O.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Excel\is-7BLO6.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Excel\is-0HH3K.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Excel\is-9E7G4.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Excel\is-1M3ER.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Excel\is-5VJ9L.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Excel\is-C2ULV.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Excel\is-45CIN.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Excel\is-4H2UQ.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Excel\is-VDF8I.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\InfoPath\is-0Q2RH.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\InfoPath\is-ASR5L.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\InfoPath\is-2GCGE.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\InfoPath\is-6F1VM.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\InfoPath\is-BQFA5.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\InfoPath\is-2K3LL.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\InfoPath\is-TMA3F.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\InfoPath\is-B7LDO.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\InfoPath\is-IBDRG.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\InfoPath\is-51F3G.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\InfoPath\is-CB0RK.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\InfoPath\is-1RR5H.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\InfoPath\is-9EEDD.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\InfoPath\is-5253T.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Lync\is-LDF0L.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Lync\is-F62DP.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Lync\is-B6L1H.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Lync\is-6VHVK.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Lync\is-FD9UB.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Lync\is-0OE16.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Lync\is-517TM.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Lync\is-LPCJE.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Lync\is-GTS4E.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Lync\is-TRAEJ.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Lync\is-2ETBK.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Lync\is-74SG3.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Lync\is-AI36L.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Lync\is-6P3OM.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\OneNote\is-VU9P2.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\OneNote\is-7GVQA.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\OneNote\is-9HDSO.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\OneNote\is-06RM7.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\OneNote\is-P7DNP.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\OneNote\is-FVHAS.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\OneNote\is-ALQ2G.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\OneNote\is-FPVHV.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\OneNote\is-EO3TG.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\OneNote\is-F3EEG.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\OneNote\is-D2INL.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\OneNote\is-NQUAL.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\OneNote\is-5HF40.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\OneNote\is-MJT5U.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Outlook\is-S4DVU.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Outlook\is-74UJ2.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Outlook\is-D6890.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Outlook\is-74I5V.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Outlook\is-GAB33.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Outlook\is-R2KHT.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Outlook\is-VACE9.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Outlook\is-RIMNB.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Outlook\is-E7GCT.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Outlook\is-ONO1V.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Outlook\is-K3API.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Outlook\is-TNEMP.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Outlook\is-JE9D4.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Outlook\is-B7QI0.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\PowerPoint\is-F9IKK.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\PowerPoint\is-LEUL2.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\PowerPoint\is-8K4NE.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\PowerPoint\is-S9T4M.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\PowerPoint\is-HB1D6.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\PowerPoint\is-C4HMT.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\PowerPoint\is-OEI3M.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\PowerPoint\is-4P6GS.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\PowerPoint\is-VUGL1.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\PowerPoint\is-5JVL2.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\PowerPoint\is-IP0DI.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\PowerPoint\is-QIP18.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\PowerPoint\is-1O41S.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\PowerPoint\is-OFISA.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectPro\is-BJRKQ.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectPro\is-9G8KI.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectPro\is-GENDG.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectPro\is-MREDD.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectPro\is-DCAT7.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectPro\is-CFGTJ.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectPro\is-D2CLK.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectPro\is-1DJT2.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectPro\is-TTEEH.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectPro\is-4NB32.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectPro\is-9JPS1.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectPro\is-639K2.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectPro\is-TPTKF.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectPro\is-K93VO.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectStd\is-3SN6E.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectStd\is-JR0F4.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectStd\is-HF4UP.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectStd\is-9FI2C.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectStd\is-KPCUK.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectStd\is-L3PV0.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectStd\is-BH418.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectStd\is-GQBDN.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectStd\is-VJ1IA.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectStd\is-AHE8G.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectStd\is-NVBJK.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectStd\is-AMROH.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectStd\is-KR7J9.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectStd\is-75I49.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProPlus\is-FIRHK.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProPlus\is-ALQDG.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProPlus\is-48BN8.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProPlus\is-NTSV5.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProPlus\is-350R0.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProPlus\is-DE0BF.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProPlus\is-132O0.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProPlus\is-7NEPS.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProPlus\is-LVJJH.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProPlus\is-RBU54.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProPlus\is-4KNJ8.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProPlus\is-PMM95.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProPlus\is-75L2V.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProPlus\is-KUI17.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProPlus\is-26PAP.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Publisher\is-R4MLP.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Publisher\is-H5DL1.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Publisher\is-EGTQH.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Publisher\is-8394A.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Publisher\is-MHDSF.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Publisher\is-F3APF.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Publisher\is-90SVP.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Publisher\is-H689J.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Publisher\is-PAQDV.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Publisher\is-VDT42.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Publisher\is-T2QJO.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Publisher\is-IG68E.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Publisher\is-5P1F2.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Publisher\is-3AMCH.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Standard\is-M27D5.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Standard\is-O9EIG.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Standard\is-IFKOG.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Standard\is-2C7EL.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Standard\is-2FFMP.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Standard\is-E6MTK.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Standard\is-13ON0.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Standard\is-20UA6.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Standard\is-7AHFB.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Standard\is-LUD3F.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Standard\is-TNABB.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Standard\is-8B42R.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Standard\is-BQI9K.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Standard\is-NV51S.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioPro\is-095A8.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioPro\is-9HR0C.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioPro\is-R2LCC.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioPro\is-1N6QG.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioPro\is-HQ9SF.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioPro\is-7QSEI.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioPro\is-13HI9.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioPro\is-CSSJ5.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioPro\is-UO2UP.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioPro\is-KTMT5.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioPro\is-GQ7A6.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioPro\is-J80LJ.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioPro\is-7RC1U.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioPro\is-CVBVS.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioPro\is-8BMMP.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioStd\is-QCBFH.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioStd\is-BCNAL.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioStd\is-A7EEF.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioStd\is-HDLEQ.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioStd\is-B51IO.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioStd\is-7TJHN.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioStd\is-OU04N.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioStd\is-2S4T2.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioStd\is-G11KV.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioStd\is-26I3R.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioStd\is-R2G2C.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioStd\is-HC808.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioStd\is-U0IFV.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioStd\is-VQD1P.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Word\is-JBOB5.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Word\is-4BPB5.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Word\is-JJH1F.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Word\is-FUD0A.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Word\is-N0S6Q.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Word\is-CU14G.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Word\is-18UB8.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Word\is-3NF86.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Word\is-DR614.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Word\is-45B72.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Word\is-MVDJ1.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Word\is-VSBM4.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Word\is-G159R.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Word\is-U9T1J.tmp
  • %Program Files%\KMSpico\scripts\is-Q6I2J.tmp
  • %Program Files%\KMSpico\scripts\is-OSQQT.tmp
  • %Program Files%\KMSpico\driver\is-PACKL.tmp
  • %Start Menu%\Programs\KMSpico\KMSpico.lnk
  • %Start Menu%\Programs\KMSpico\Log KMSpico.lnk
  • %Start Menu%\Programs\KMSpico\AutoPico.lnk
  • %Start Menu%\Programs\KMSpico\Uninstall KMSpico.lnk
  • %User Temp%\is-scg0r.tmp\{malware file name}.tmp
  • %User Temp%\Setup Log 2014-06-23 #001.txt
  • %User Temp%\is-7LLRS.tmp\_isetup\_shfoldr.dll
  • %Program Files%\KMSpico\unins000.dat
  • %Program Files%\KMSpico\is-LJ8B8.tmp
  • %Program Files%\KMSpico\driver\is-K2L0C.tmp
  • %Program Files%\KMSpico\driver\is-59DJ8.tmp
  • %Program Files%\KMSpico\is-DTEVT.tmp
  • %Program Files%\KMSpico\is-EIU6E.tmp
  • %Program Files%\KMSpico\is-13RBA.tmp
  • %Program Files%\KMSpico\is-30AP0.tmp
  • %Program Files%\KMSpico\is-DJK7M.tmp
  • %Program Files%\KMSpico\icons\is-IUP4E.tmp
  • %Program Files%\KMSpico\icons\is-S75KD.tmp
  • %Program Files%\KMSpico\icons\is-BCG5F.tmp
  • %Program Files%\KMSpico\icons\is-SP911.tmp
  • %Program Files%\KMSpico\logs\is-U22A1.tmp
  • %Program Files%\KMSpico\logs\is-81PJC.tmp
  • %Program Files%\KMSpico\logs\is-57IFC.tmp
  • %Program Files%\KMSpico\scripts\is-KTCTJ.tmp
  • %Program Files%\KMSpico\scripts\is-SHFFV.tmp
  • %Program Files%\KMSpico\scripts\is-UBS40.tmp
  • %Program Files%\KMSpico\scripts\is-DU21G.tmp
  • %Program Files%\KMSpico\scripts\is-G19J7.tmp
  • %Program Files%\KMSpico\sounds\is-C192V.tmp
  • %Program Files%\KMSpico\sounds\is-KFF61.tmp
  • %Program Files%\KMSpico\sounds\is-DQ0QI.tmp
  • %Program Files%\KMSpico\sounds\is-4E0RI.tmp
  • %Program Files%\KMSpico\sounds\is-JGG3Q.tmp
  • %Program Files%\KMSpico\sounds\is-R0FT6.tmp
  • %Program Files%\KMSpico\sounds\is-KQODB.tmp
  • %Program Files%\KMSpico\sounds\is-AAQKF.tmp
  • %Program Files%\KMSpico\sounds\is-DP477.tmp
  • %Program Files%\KMSpico\sounds\is-ODKH7.tmp
  • %Program Files%\KMSpico\sounds\is-T9G0J.tmp
  • %Program Files%\KMSpico\sounds\is-V4IVJ.tmp
  • %Program Files%\KMSpico\cert\is-7L9LU.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Access\is-5QADT.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Access\is-PR2F0.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Access\is-1M82O.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Access\is-R9FCO.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Access\is-THK30.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Access\is-SEK7D.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Access\is-B287M.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Access\is-Q3KSD.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Access\is-J2747.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Access\is-BP9CG.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Access\is-FCVS4.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Access\is-UVG9K.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Excel\is-JJA9A.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Excel\is-4ERL1.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Excel\is-Q87HR.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Excel\is-9VKD6.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Excel\is-N2JE2.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Excel\is-BNGBP.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Excel\is-1VHUI.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Excel\is-FBMJQ.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Excel\is-GR5I7.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Excel\is-12EFF.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Excel\is-LLPS2.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Excel\is-B3KU8.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Groove\is-NLEPG.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Groove\is-45KIS.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Groove\is-H3G82.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Groove\is-INS19.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Groove\is-4G6BL.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Groove\is-CQESN.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Groove\is-A6A4B.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Groove\is-6MD5L.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Groove\is-FIAKF.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Groove\is-Q7D7P.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Groove\is-JHEMK.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Groove\is-CT483.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\InfoPath\is-R5V3M.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\InfoPath\is-76P2Q.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\InfoPath\is-NF58M.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\InfoPath\is-60TPC.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\InfoPath\is-3SAD0.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\InfoPath\is-OQBGG.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\InfoPath\is-N3388.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\InfoPath\is-MPSU7.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\InfoPath\is-LAK88.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\InfoPath\is-4S37M.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\InfoPath\is-0TQ73.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\InfoPath\is-74HFC.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\OneNote\is-BG3H4.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\OneNote\is-LRQJ2.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\OneNote\is-QH5QU.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\OneNote\is-07TPK.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\OneNote\is-FKS7C.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\OneNote\is-PPTHC.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\OneNote\is-0LPTI.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\OneNote\is-RGSTN.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\OneNote\is-8HTEP.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\OneNote\is-HEVLD.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\OneNote\is-9HGCM.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\OneNote\is-RI8GC.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Outlook\is-THVF3.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Outlook\is-TGI5S.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Outlook\is-SENA3.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Outlook\is-GPUQC.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Outlook\is-JRHK1.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Outlook\is-F2PTI.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Outlook\is-QKURG.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Outlook\is-JB8OE.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Outlook\is-LJODB.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Outlook\is-975B6.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Outlook\is-SI7AM.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Outlook\is-3DVRA.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\PowerPoint\is-QABEQ.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\PowerPoint\is-8O2HH.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\PowerPoint\is-F5F5C.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\PowerPoint\is-A2K7Q.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\PowerPoint\is-FUJG6.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\PowerPoint\is-G1L7B.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\PowerPoint\is-4Q0TB.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\PowerPoint\is-RBIMJ.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\PowerPoint\is-CD8D6.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\PowerPoint\is-S7CNA.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\PowerPoint\is-L418A.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\PowerPoint\is-3RAKF.tmp

(註：%Program Files%フォルダは、プログラムファイルのフォルダで、いずれのオペレーティングシステム(OS)でも通常、 "C:\Program Files"、64bitのOS上で32bitのアプリケーションを実行している場合、 "C:\Program Files (x86)" です。.. %Start Menu%フォルダは、Windows 2000、XP および Server 2003 の場合、通常、"C:\Windows\Start Menu" または "C:\Documents and Settings\＜ユーザ名＞\Start Menu"、Windows Vista 、 7 、8、8.1 、Server 2008 および Server 2012の場合、"C:\Users\＜ユーザ名＞\AppData\Roaming\Microsoft\Windows\Start Menu" です。.. %User Temp%フォルダは、ユーザの一時フォルダで、Windows 2000、XP および Server 2003 の場合、通常、"C:\Documents and Settings\＜ユーザー名＞\Local Settings\Temp"、Windows Vista 、 7 、8、8.1 、Server 2008 および Server 2012の場合、"C:\Users\＜ユーザ名＞\AppData\Local\Temp" です。.)

その他

プログラムは、以下の不正なWebサイトにアクセスします。

  • {BLOCKED}8.192.69

このウイルス情報は、自動解析システムにより作成されました。

  対応方法

対応検索エンジン: 9.750

手順 1

Windows XP、Windows Vista および Windows 7 のユーザは、コンピュータからマルウェアもしくはアドウェア等を完全に削除するために、ウイルス検索の実行前には必ず「システムの復元」を無効にしてください。

手順 2

不明なレジストリ値を削除します。

[ 詳細 ]

警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。

  • In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows
    • System
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer
    • PhishingFilter
  • In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
    • KMSpico_is1
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process
    • KMSELDI
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\KMSELDI
    • DEBUG

手順 3

このレジストリ値を削除します。

[ 詳細 ]

警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
レジストリの編集はお客様の責任で行っていただくようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。

  • In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
    • EnableSmartScreen = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
    • SmartScreenEnabled = "Off"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter
    • EnabledV9 = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KMSpico_is1
    • Inno Setup: Setup Version = "5.5.3 (a)"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KMSpico_is1
    • Inno Setup: App Path = "%Program Files%\KMSpico"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KMSpico_is1
    • InstallLocation = "%Program Files%\KMSpico"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KMSpico_is1
    • Inno Setup: Icon Group = "KMSpico"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KMSpico_is1
    • Inno Setup: User = "Wilbert"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KMSpico_is1
    • Inno Setup: Language = "default"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KMSpico_is1
    • DisplayName = "KMSpico v9.3"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KMSpico_is1
    • DisplayIcon = "%Program Files%\KMSpico\KMSELDI.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KMSpico_is1
    • UninstallString = "%Program Files%\KMSpico\unins000.exe "
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KMSpico_is1
    • QuietUninstallString = "%Program Files%\KMSpico\unins000.exe /SILENT"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KMSpico_is1
    • DisplayVersion = "9.3"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KMSpico_is1
    • ModifyPath = "%Program Files%\KMSpico\UninsHs.exe /m0=AppId"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KMSpico_is1
    • NoRepair = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KMSpico_is1
    • InstallDate = "20140623"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KMSpico_is1
    • MajorVersion = "9"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KMSpico_is1
    • MinorVersion = "3"

手順 4

変更されたレジストリ値を修正します。

[ 詳細 ]

警告：レジストリはWindowsの構成情報が格納されているデータベースであり、レジストリの編集内容に問題があると、システムが正常に動作しなくなる場合があります。
事前に意図的に対象の設定を変更していた場合は、意図するオリジナルの設定に戻してください。変更する値が分からない場合は、システム管理者にお尋ねいただき、レジストリの編集はお客様の責任として行なって頂くようお願いいたします。弊社ではレジストリの編集による如何なる問題に対しても補償いたしかねます。
レジストリの編集前にこちらをご参照ください。

  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\ESENT
    • From: EventMessageFile = "%System%\ESENT.dll"
      To: EventMessageFile = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\ESENT
    • From: CategoryMessageFile = "%System%\ESENT.dll"
      To: CategoryMessageFile = ""{random values}""
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\ESENT
    • From: CategoryCount = "1"
      To: CategoryCount = ""10""
  • In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\ESENT
    • From: TypesSupported = "7"
      To: TypesSupported = ""7""

手順 5

以下のファイルを検索し削除します。

[ 詳細 ]
コンポーネントファイルが隠しファイル属性の場合があります。[詳細設定オプション]をクリックし、[隠しファイルとフォルダの検索]のチェックボックスをオンにし、検索結果に隠しファイルとフォルダが含まれるようにしてください。
  • %User Temp%\is-scg0r.tmp\{malware file name}.tmp
  • %User Temp%\Setup Log 2014-06-23 #001.txt
  • %User Temp%\is-7LLRS.tmp\_isetup\_shfoldr.dll
  • %Program Files%\KMSpico\unins000.dat
  • %Program Files%\KMSpico\is-LJ8B8.tmp
  • %Program Files%\KMSpico\driver\is-K2L0C.tmp
  • %Program Files%\KMSpico\driver\is-59DJ8.tmp
  • %Program Files%\KMSpico\is-DTEVT.tmp
  • %Program Files%\KMSpico\is-EIU6E.tmp
  • %Program Files%\KMSpico\is-13RBA.tmp
  • %Program Files%\KMSpico\is-30AP0.tmp
  • %Program Files%\KMSpico\is-DJK7M.tmp
  • %Program Files%\KMSpico\icons\is-IUP4E.tmp
  • %Program Files%\KMSpico\icons\is-S75KD.tmp
  • %Program Files%\KMSpico\icons\is-BCG5F.tmp
  • %Program Files%\KMSpico\icons\is-SP911.tmp
  • %Program Files%\KMSpico\logs\is-U22A1.tmp
  • %Program Files%\KMSpico\logs\is-81PJC.tmp
  • %Program Files%\KMSpico\logs\is-57IFC.tmp
  • %Program Files%\KMSpico\scripts\is-KTCTJ.tmp
  • %Program Files%\KMSpico\scripts\is-SHFFV.tmp
  • %Program Files%\KMSpico\scripts\is-UBS40.tmp
  • %Program Files%\KMSpico\scripts\is-DU21G.tmp
  • %Program Files%\KMSpico\scripts\is-G19J7.tmp
  • %Program Files%\KMSpico\sounds\is-C192V.tmp
  • %Program Files%\KMSpico\sounds\is-KFF61.tmp
  • %Program Files%\KMSpico\sounds\is-DQ0QI.tmp
  • %Program Files%\KMSpico\sounds\is-4E0RI.tmp
  • %Program Files%\KMSpico\sounds\is-JGG3Q.tmp
  • %Program Files%\KMSpico\sounds\is-R0FT6.tmp
  • %Program Files%\KMSpico\sounds\is-KQODB.tmp
  • %Program Files%\KMSpico\sounds\is-AAQKF.tmp
  • %Program Files%\KMSpico\sounds\is-DP477.tmp
  • %Program Files%\KMSpico\sounds\is-ODKH7.tmp
  • %Program Files%\KMSpico\sounds\is-T9G0J.tmp
  • %Program Files%\KMSpico\sounds\is-V4IVJ.tmp
  • %Program Files%\KMSpico\cert\is-7L9LU.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Access\is-5QADT.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Access\is-PR2F0.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Access\is-1M82O.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Access\is-R9FCO.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Access\is-THK30.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Access\is-SEK7D.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Access\is-B287M.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Access\is-Q3KSD.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Access\is-J2747.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Access\is-BP9CG.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Access\is-FCVS4.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Access\is-UVG9K.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Excel\is-JJA9A.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Excel\is-4ERL1.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Excel\is-Q87HR.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Excel\is-9VKD6.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Excel\is-N2JE2.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Excel\is-BNGBP.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Excel\is-1VHUI.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Excel\is-FBMJQ.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Excel\is-GR5I7.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Excel\is-12EFF.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Excel\is-LLPS2.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Excel\is-B3KU8.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Groove\is-NLEPG.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Groove\is-45KIS.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Groove\is-H3G82.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Groove\is-INS19.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Groove\is-4G6BL.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Groove\is-CQESN.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Groove\is-A6A4B.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Groove\is-6MD5L.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Groove\is-FIAKF.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Groove\is-Q7D7P.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Groove\is-JHEMK.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Groove\is-CT483.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\InfoPath\is-R5V3M.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\InfoPath\is-76P2Q.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\InfoPath\is-NF58M.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\InfoPath\is-60TPC.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\InfoPath\is-3SAD0.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\InfoPath\is-OQBGG.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\InfoPath\is-N3388.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\InfoPath\is-MPSU7.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\InfoPath\is-LAK88.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\InfoPath\is-4S37M.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\InfoPath\is-0TQ73.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\InfoPath\is-74HFC.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\OneNote\is-BG3H4.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\OneNote\is-LRQJ2.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\OneNote\is-QH5QU.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\OneNote\is-07TPK.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\OneNote\is-FKS7C.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\OneNote\is-PPTHC.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\OneNote\is-0LPTI.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\OneNote\is-RGSTN.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\OneNote\is-8HTEP.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\OneNote\is-HEVLD.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\OneNote\is-9HGCM.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\OneNote\is-RI8GC.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Outlook\is-THVF3.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Outlook\is-TGI5S.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Outlook\is-SENA3.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Outlook\is-GPUQC.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Outlook\is-JRHK1.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Outlook\is-F2PTI.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Outlook\is-QKURG.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Outlook\is-JB8OE.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Outlook\is-LJODB.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Outlook\is-975B6.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Outlook\is-SI7AM.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Outlook\is-3DVRA.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\PowerPoint\is-QABEQ.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\PowerPoint\is-8O2HH.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\PowerPoint\is-F5F5C.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\PowerPoint\is-A2K7Q.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\PowerPoint\is-FUJG6.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\PowerPoint\is-G1L7B.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\PowerPoint\is-4Q0TB.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\PowerPoint\is-RBIMJ.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\PowerPoint\is-CD8D6.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\PowerPoint\is-S7CNA.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\PowerPoint\is-L418A.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\PowerPoint\is-3RAKF.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectPro\is-MNF5I.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectPro\is-H6Q09.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectPro\is-FDT02.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectPro\is-INK26.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectPro\is-VINT3.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectPro\is-I75KU.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectPro\is-B6N2A.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectPro\is-Q1LKF.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectPro\is-8HRRH.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectPro\is-465S1.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectPro\is-A1MGR.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectPro\is-6JAK3.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectStd\is-1MRCJ.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectStd\is-VHKGB.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectStd\is-6MKHC.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectStd\is-P18TP.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectStd\is-CTS01.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectStd\is-UU50J.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectStd\is-KJADL.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectStd\is-HI729.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectStd\is-UH69K.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectStd\is-0AQFI.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectStd\is-RDVJG.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectStd\is-7R26C.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectStd\is-QM413.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectStd\is-M1TJV.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectStd\is-28NKI.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectStd\is-GG42Q.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProPlus\is-N2U27.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProPlus\is-D6IOJ.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProPlus\is-5M06M.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProPlus\is-PR94A.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProPlus\is-GDQCO.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProPlus\is-MVFS5.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProPlus\is-SDV3H.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProPlus\is-H76BL.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProPlus\is-B4Q4D.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProPlus\is-AEIHE.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProPlus\is-M508U.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProPlus\is-AFFDI.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProPlus\is-UUNGU.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProPlus\is-S5LV6.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProPlus\is-7J3OI.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\ProPlus\is-B5SIP.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Publisher\is-KL3U4.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Publisher\is-H8903.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Publisher\is-VSBO7.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Publisher\is-2SGO3.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Publisher\is-5N5RN.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Publisher\is-RA430.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Publisher\is-AAAHL.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Publisher\is-24VE8.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Publisher\is-L5MTE.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Publisher\is-IQVAJ.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Publisher\is-86GIJ.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Publisher\is-9KIPV.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\SmallBusBasics\is-181R1.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\SmallBusBasics\is-DF8DK.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\SmallBusBasics\is-M5QCQ.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\SmallBusBasics\is-ITHK1.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\SmallBusBasics\is-LA0G9.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\SmallBusBasics\is-LLOMS.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\SmallBusBasics\is-OKUM1.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\SmallBusBasics\is-SD595.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\SmallBusBasics\is-BIPSU.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\SmallBusBasics\is-HAB52.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\SmallBusBasics\is-ILS81.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\SmallBusBasics\is-9UVQ3.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Standard\is-M504N.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Standard\is-CLIAV.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Standard\is-IU80H.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Standard\is-JL1RK.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Standard\is-ENEFC.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Standard\is-79EFA.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Standard\is-A6R1A.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Standard\is-450MG.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Standard\is-KN78M.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Standard\is-8B3CS.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Standard\is-6S0G3.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Standard\is-GAC7E.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Standard\is-92I0D.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Standard\is-7PEID.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Standard\is-OV3ML.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Standard\is-PDKV7.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-VCPA7.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-20T2J.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-A8U2N.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-JGI2I.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-3R8TV.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-JC1K9.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-TT562.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-HF7A7.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-TBBNB.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-11AI5.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-IUOMD.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-06B2V.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-RH9M3.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-STNQV.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-DLGDH.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-2ECDI.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-805U0.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-PSH1G.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-IKA95.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-6ROUN.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-QASMQ.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-DRRCF.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-7GOB2.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-PK2V7.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-ME1C8.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-7EFML.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-KREOV.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-R87BP.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-4ISE2.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Visio\is-4AGEP.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Word\is-C9HSL.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Word\is-E3JL5.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Word\is-QR9G1.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Word\is-U4VNK.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Word\is-UV43R.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Word\is-K0C05.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Word\is-N6L9T.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Word\is-BAL7U.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Word\is-NAK0A.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Word\is-TGH5E.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Word\is-HVRND.tmp
  • %Program Files%\KMSpico\cert\kmscert2010\Word\is-P5KAD.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Access\is-I1A7P.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Access\is-KC6HQ.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Access\is-O45O9.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Access\is-D01TS.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Access\is-PCNK1.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Access\is-IKO61.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Access\is-4J7GA.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Access\is-1JQL1.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Access\is-EP32P.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Access\is-VT0MQ.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Access\is-ONU78.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Access\is-UN8MK.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Access\is-LKNLQ.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Access\is-M6FCU.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Excel\is-QQE8Q.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Excel\is-FMPTE.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Excel\is-RGIIR.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Excel\is-O3E54.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Excel\is-AB14O.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Excel\is-7BLO6.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Excel\is-0HH3K.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Excel\is-9E7G4.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Excel\is-1M3ER.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Excel\is-5VJ9L.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Excel\is-C2ULV.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Excel\is-45CIN.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Excel\is-4H2UQ.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Excel\is-VDF8I.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\InfoPath\is-0Q2RH.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\InfoPath\is-ASR5L.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\InfoPath\is-2GCGE.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\InfoPath\is-6F1VM.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\InfoPath\is-BQFA5.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\InfoPath\is-2K3LL.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\InfoPath\is-TMA3F.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\InfoPath\is-B7LDO.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\InfoPath\is-IBDRG.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\InfoPath\is-51F3G.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\InfoPath\is-CB0RK.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\InfoPath\is-1RR5H.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\InfoPath\is-9EEDD.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\InfoPath\is-5253T.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Lync\is-LDF0L.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Lync\is-F62DP.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Lync\is-B6L1H.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Lync\is-6VHVK.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Lync\is-FD9UB.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Lync\is-0OE16.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Lync\is-517TM.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Lync\is-LPCJE.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Lync\is-GTS4E.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Lync\is-TRAEJ.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Lync\is-2ETBK.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Lync\is-74SG3.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Lync\is-AI36L.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Lync\is-6P3OM.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\OneNote\is-VU9P2.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\OneNote\is-7GVQA.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\OneNote\is-9HDSO.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\OneNote\is-06RM7.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\OneNote\is-P7DNP.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\OneNote\is-FVHAS.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\OneNote\is-ALQ2G.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\OneNote\is-FPVHV.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\OneNote\is-EO3TG.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\OneNote\is-F3EEG.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\OneNote\is-D2INL.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\OneNote\is-NQUAL.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\OneNote\is-5HF40.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\OneNote\is-MJT5U.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Outlook\is-S4DVU.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Outlook\is-74UJ2.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Outlook\is-D6890.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Outlook\is-74I5V.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Outlook\is-GAB33.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Outlook\is-R2KHT.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Outlook\is-VACE9.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Outlook\is-RIMNB.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Outlook\is-E7GCT.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Outlook\is-ONO1V.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Outlook\is-K3API.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Outlook\is-TNEMP.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Outlook\is-JE9D4.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Outlook\is-B7QI0.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\PowerPoint\is-F9IKK.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\PowerPoint\is-LEUL2.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\PowerPoint\is-8K4NE.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\PowerPoint\is-S9T4M.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\PowerPoint\is-HB1D6.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\PowerPoint\is-C4HMT.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\PowerPoint\is-OEI3M.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\PowerPoint\is-4P6GS.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\PowerPoint\is-VUGL1.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\PowerPoint\is-5JVL2.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\PowerPoint\is-IP0DI.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\PowerPoint\is-QIP18.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\PowerPoint\is-1O41S.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\PowerPoint\is-OFISA.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectPro\is-BJRKQ.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectPro\is-9G8KI.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectPro\is-GENDG.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectPro\is-MREDD.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectPro\is-DCAT7.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectPro\is-CFGTJ.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectPro\is-D2CLK.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectPro\is-1DJT2.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectPro\is-TTEEH.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectPro\is-4NB32.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectPro\is-9JPS1.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectPro\is-639K2.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectPro\is-TPTKF.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectPro\is-K93VO.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectStd\is-3SN6E.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectStd\is-JR0F4.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectStd\is-HF4UP.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectStd\is-9FI2C.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectStd\is-KPCUK.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectStd\is-L3PV0.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectStd\is-BH418.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectStd\is-GQBDN.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectStd\is-VJ1IA.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectStd\is-AHE8G.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectStd\is-NVBJK.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectStd\is-AMROH.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectStd\is-KR7J9.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectStd\is-75I49.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProPlus\is-FIRHK.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProPlus\is-ALQDG.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProPlus\is-48BN8.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProPlus\is-NTSV5.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProPlus\is-350R0.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProPlus\is-DE0BF.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProPlus\is-132O0.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProPlus\is-7NEPS.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProPlus\is-LVJJH.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProPlus\is-RBU54.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProPlus\is-4KNJ8.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProPlus\is-PMM95.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProPlus\is-75L2V.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProPlus\is-KUI17.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\ProPlus\is-26PAP.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Publisher\is-R4MLP.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Publisher\is-H5DL1.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Publisher\is-EGTQH.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Publisher\is-8394A.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Publisher\is-MHDSF.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Publisher\is-F3APF.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Publisher\is-90SVP.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Publisher\is-H689J.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Publisher\is-PAQDV.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Publisher\is-VDT42.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Publisher\is-T2QJO.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Publisher\is-IG68E.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Publisher\is-5P1F2.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Publisher\is-3AMCH.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Standard\is-M27D5.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Standard\is-O9EIG.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Standard\is-IFKOG.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Standard\is-2C7EL.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Standard\is-2FFMP.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Standard\is-E6MTK.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Standard\is-13ON0.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Standard\is-20UA6.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Standard\is-7AHFB.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Standard\is-LUD3F.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Standard\is-TNABB.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Standard\is-8B42R.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Standard\is-BQI9K.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Standard\is-NV51S.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioPro\is-095A8.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioPro\is-9HR0C.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioPro\is-R2LCC.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioPro\is-1N6QG.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioPro\is-HQ9SF.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioPro\is-7QSEI.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioPro\is-13HI9.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioPro\is-CSSJ5.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioPro\is-UO2UP.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioPro\is-KTMT5.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioPro\is-GQ7A6.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioPro\is-J80LJ.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioPro\is-7RC1U.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioPro\is-CVBVS.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioPro\is-8BMMP.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioStd\is-QCBFH.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioStd\is-BCNAL.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioStd\is-A7EEF.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioStd\is-HDLEQ.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioStd\is-B51IO.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioStd\is-7TJHN.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioStd\is-OU04N.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioStd\is-2S4T2.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioStd\is-G11KV.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioStd\is-26I3R.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioStd\is-R2G2C.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioStd\is-HC808.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioStd\is-U0IFV.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\VisioStd\is-VQD1P.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Word\is-JBOB5.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Word\is-4BPB5.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Word\is-JJH1F.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Word\is-FUD0A.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Word\is-N0S6Q.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Word\is-CU14G.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Word\is-18UB8.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Word\is-3NF86.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Word\is-DR614.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Word\is-45B72.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Word\is-MVDJ1.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Word\is-VSBM4.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Word\is-G159R.tmp
  • %Program Files%\KMSpico\cert\kmscert2013\Word\is-U9T1J.tmp
  • %Program Files%\KMSpico\scripts\is-Q6I2J.tmp
  • %Program Files%\KMSpico\scripts\is-OSQQT.tmp
  • %Program Files%\KMSpico\driver\is-PACKL.tmp
  • %Start Menu%\Programs\KMSpico\KMSpico.lnk
  • %Start Menu%\Programs\KMSpico\Log KMSpico.lnk
  • %Start Menu%\Programs\KMSpico\AutoPico.lnk
  • %Start Menu%\Programs\KMSpico\Uninstall KMSpico.lnk

手順 6

以下のフォルダを検索し削除します。

[ 詳細 ]
フォルダが隠しフォルダ属性に設定されている場合があります。[詳細設定オプション]をクリックし、[隠しファイルとフォルダの検索]のチェックボックスをオンにし、検索結果に隠しファイルとフォルダが含まれるようにしてください。
  • %User Temp%\is-SCG0R.tmp
  • %User Temp%\is-7LLRS.tmp
  • %User Temp%\is-7LLRS.tmp\_isetup
  • %Program Files%\KMSpico
  • %Program Files%\KMSpico\sounds
  • %Program Files%\KMSpico\cert
  • %Program Files%\KMSpico\icons
  • %Program Files%\KMSpico\cert\kmscert2010
  • %Program Files%\KMSpico\cert\kmscert2010\Access
  • %Program Files%\KMSpico\cert\kmscert2010\Excel
  • %Program Files%\KMSpico\cert\kmscert2010\Groove
  • %Program Files%\KMSpico\cert\kmscert2010\InfoPath
  • %Program Files%\KMSpico\cert\kmscert2010\OneNote
  • %Program Files%\KMSpico\cert\kmscert2010\Outlook
  • %Program Files%\KMSpico\cert\kmscert2010\PowerPoint
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectPro
  • %Program Files%\KMSpico\cert\kmscert2010\ProjectStd
  • %Program Files%\KMSpico\cert\kmscert2010\ProPlus
  • %Program Files%\KMSpico\cert\kmscert2010\Publisher
  • %Program Files%\KMSpico\cert\kmscert2010\SmallBusBasics
  • %Program Files%\KMSpico\cert\kmscert2010\Standard
  • %Program Files%\KMSpico\cert\kmscert2010\Visio
  • %Program Files%\KMSpico\cert\kmscert2010\Word
  • %Program Files%\KMSpico\cert\kmscert2013
  • %Program Files%\KMSpico\cert\kmscert2013\Access
  • %Program Files%\KMSpico\cert\kmscert2013\Excel
  • %Program Files%\KMSpico\cert\kmscert2013\InfoPath
  • %Program Files%\KMSpico\cert\kmscert2013\Lync
  • %Program Files%\KMSpico\cert\kmscert2013\OneNote
  • %Program Files%\KMSpico\cert\kmscert2013\Outlook
  • %Program Files%\KMSpico\cert\kmscert2013\PowerPoint
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectPro
  • %Program Files%\KMSpico\cert\kmscert2013\ProjectStd
  • %Program Files%\KMSpico\cert\kmscert2013\ProPlus
  • %Program Files%\KMSpico\cert\kmscert2013\Publisher
  • %Program Files%\KMSpico\cert\kmscert2013\Standard
  • %Program Files%\KMSpico\cert\kmscert2013\VisioPro
  • %Program Files%\KMSpico\cert\kmscert2013\VisioStd
  • %Program Files%\KMSpico\cert\kmscert2013\Word
  • %Program Files%\KMSpico\cert\kmscertw6
  • %Program Files%\KMSpico\cert\kmscertw6\Business
  • %Program Files%\KMSpico\cert\kmscertw6\Enterprise
  • %Program Files%\KMSpico\cert\kmscertw7
  • %Program Files%\KMSpico\cert\kmscertw7\Enterprise
  • %Program Files%\KMSpico\cert\kmscertw7\Professional
  • %Program Files%\KMSpico\cert\kmscertw8
  • %Program Files%\KMSpico\cert\kmscertw8\Enterprise
  • %Program Files%\KMSpico\cert\kmscertw8\Enterprise\plugin-manifests-signed
  • %Program Files%\KMSpico\cert\kmscertw8\Enterprise\tokens
  • %Program Files%\KMSpico\cert\kmscertw8\Enterprise\tokens\addons
  • %Program Files%\KMSpico\cert\kmscertw8\Enterprise\tokens\addons\APPXLOB-Client
  • %Program Files%\KMSpico\cert\kmscertw8\Enterprise\tokens\addons\OCUR
  • %Program Files%\KMSpico\cert\kmscertw8\Enterprise\tokens\issuance
  • %Program Files%\KMSpico\cert\kmscertw8\Enterprise\tokens\legacy
  • %Program Files%\KMSpico\cert\kmscertw8\Enterprise\tokens\pkeyconfig
  • %Program Files%\KMSpico\cert\kmscertw8\Enterprise\tokens\ppdlic
  • %Program Files%\KMSpico\cert\kmscertw8\Enterprise\tokens\rules
  • %Program Files%\KMSpico\cert\kmscertw8\Enterprise\tokens\skus
  • %Program Files%\KMSpico\cert\kmscertw8\Enterprise\tokens\skus\csvlk-pack
  • %Program Files%\KMSpico\cert\kmscertw8\Enterprise\tokens\skus\Enterprise
  • %Program Files%\KMSpico\cert\kmscertw8\Professional
  • %Program Files%\KMSpico\cert\kmscertw81
  • %Program Files%\KMSpico\cert\kmscertw81\Professional
  • %Program Files%\KMSpico\logs
  • %Program Files%\KMSpico\scripts
  • %Program Files%\KMSpico\driver
  • %Program Files%\KMSpico\x64
  • %Program Files%\KMSpico\x86
  • %Start Menu%\Programs\KMSpico

手順 7

最新のバージョン（エンジン、パターンファイル）を導入したウイルス対策製品を用い、ウイルス検索を実行してください。「CRCK_ACTVTOR」と検出したファイルはすべて削除してください。 検出されたファイルが、弊社ウイルス対策製品により既に駆除、隔離またはファイル削除の処理が実行された場合、ウイルスの処理は完了しており、他の削除手順は特にありません。

手順 8

以下のファイルをバックアップを用いて修復します。なお、マイクロソフト製品に関連したファイルのみ修復されます。このマルウェア／グレイウェア／スパイウェアが同社製品以外のプログラムをも削除した場合には、該当プログラムを再度インストールする必要があります。

  • %Start Menu%\Programs\KMSpico\KMSpico.pif
  • %Start Menu%\Programs\KMSpico\KMSpico.url
  • %Start Menu%\Programs\KMSpico\Log KMSpico.pif
  • %Start Menu%\Programs\KMSpico\Log KMSpico.url
  • %Start Menu%\Programs\KMSpico\AutoPico.pif
  • %Start Menu%\Programs\KMSpico\AutoPico.url
  • %Start Menu%\Programs\KMSpico\Uninstall KMSpico.pif
  • %Start Menu%\Programs\KMSpico\Uninstall KMSpico.url
  • %Program Files%\KMSpico\logs\KMSELDI.log

手順 9

以下の削除されたレジストリキーまたはレジストリ値をバックアップを用いて修復します。

※註：マイクロソフト製品に関連したレジストリキーおよびレジストリ値のみが修復されます。このマルウェアもしくはアドウェア等が同社製品以外のプログラムも削除した場合には、該当プログラムを再度インストールする必要があります。

  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall
    • KMSpico_is1


ご利用はいかがでしたか？　アンケートにご協力ください