Malicious file
secoh-qad.exe: a file of the KMSpico activator
secoh-qad.exe is not part of Windows. The old report linked it to KMSpico, an activator that pretends to be a genuine Windows tool and lets Windows or Office 2010 run without a licence. Security programs flag it, and the tool that installed it can bring other malware.
Prefer to do it yourself? The manual steps follow.
A secoh-qad.exe in the Windows folder means a KMSpico-style activator was run on the PC. Treat the file and the tool that installed it as malicious: activators are unlicensed cracks, and their installers are a common way to deliver Trojans, ransomware and unwanted programs.
If you never ran an activator and still see the file, the same filename may be used by other malware, so the file still needs inspecting and removing. The old report gave no detection names, so none are listed here.
- Type
- Executable (.exe) component of the KMSpico activator; a hack tool, not a Windows file
- Companion file
- secoh-qad.dll, used by the same program
- Folder
- C:\Windows
- Size
- The old report gave 4,096 to 4,608 bytes, depending on the Windows version
- Windows versions
- Reported on Windows 10, 8, 7 and XP
- Window
- None: it runs in the background
- Old page
- Published 2018-10-18 in the System files category, verdict malicious
What secoh-qad.exe is
secoh-qad.exe is an executable related to KMSpico, malware that pretends to be a legitimate Windows activator. The tool allows activating Windows or Office 2010 without buying the licence. The program also uses a file named secoh-qad.dll, which can be found on an infected system alongside the .exe.
The file has no visible window and runs only in the background. It might monitor other programs or change their behaviour. Neither file is a legitimate Windows file, and the old report said all major antivirus programs marked the executable as dangerous.
The name itself proves nothing about the tool: the same filename might be used by other malware. A secoh-qad.exe on a PC where no activator was ever run is therefore a reason to inspect it, not to ignore it.
About .exe files. An .exe file is a program. It runs as a process you can see in Task Manager, so its name, folder and publisher are what to check.
How it arrives and what the risk is
The usual route is running an activator on purpose. Trying to get an illegal copy of Windows or Microsoft Office can end in a virus attack, and using such tools is not legal. Never use them to save the price of a licence.
KMSpico and similar tools can be exploited by cybercriminals. Malicious components may be injected into the system, including Trojans, ransomware and less dangerous threats such as potentially unwanted programs (PUPs).
The virus might install more malicious programs and cause further problems, for instance making your files unreadable or deleting them. It can also endanger your privacy.
Use genuine licences and download software only from its publisher.
How to find it
Look at the Windows folder, the running processes, startup entries and scheduled tasks. The file may be listed under the name secoh-qad.exe or together with secoh-qad.dll.
- Look in Task Manager. Press Ctrl+Shift+Esc and open the Details tab. Look for secoh-qad.exe. The file has no window, so it appears only in the list. Right-click it and choose Open file location to see the path.
- Check the folder. Open C:\Windows and look for secoh-qad.exe and secoh-qad.dll. Neither belongs to Windows. Do not delete them yet: stop the process and the startup entry first.
Get-ChildItem C:\Windows -Filter 'secoh-qad*' -Force | Format-List Name, Length, CreationTime - Find the DLL in memory. Open Process Explorer from Microsoft Sysinternals, press Ctrl+F (Find > Find Handle or DLL) and search for secoh-qad. A result is a process that has the file loaded.
- Look at startup entries and tasks. Open Autoruns, press Ctrl+F and search for secoh and for KMS. Check the Services and Scheduled Tasks tabs for entries that start the activator.
- Look for the activator itself. Open Settings > Apps > Installed apps and search for KMS. Check the Downloads folder for the activator you ran.
- Scan the PC. Run a Microsoft Defender full scan, then the offline scan (Windows Security > Virus and threat protection > Scan options).
These checks show that the file and its start-up entries exist. They do not show what else the activator installed; a clean scan does not prove that nothing else is present.
How to remove it
Remove the activator that installed the file, not only secoh-qad.exe. Deleting the file by itself leaves the program and its start-up entries in place.
- Stop the process. In Task Manager, on the Details tab, select secoh-qad.exe and choose End task.
- Remove startup entries. In Autoruns, clear and then delete the entries that start secoh-qad.exe or the activator, on the Services and Scheduled Tasks tabs. If you are unsure what an entry is, clear its checkbox first.
- Uninstall the activator. Remove the Windows activator program from Settings > Apps if it is listed, and delete its folder from where you ran it.
- Delete the files. Delete secoh-qad.exe and secoh-qad.dll from C:\Windows. If Windows refuses, restart in Safe Mode (hold Shift, choose Restart, then Troubleshoot > Advanced options > Startup Settings) and delete them there.
- Scan again. Run a Microsoft Defender offline scan from Windows Security, and check that other malicious files were not installed as well. Registry changes made by the tool should also be checked in Autoruns.
- Fix the licence and passwords. Activate Windows and Office with a genuine licence. If the tool brought other malware, change your important passwords from a clean device and turn on two-step verification.
Warning signs and what they mean
| What you see | What it means |
|---|---|
| secoh-qad.exe in the Task Manager details list | It is not a Windows process. It points to a KMSpico-style activator, or to other malware using the same name. |
| secoh-qad.exe or secoh-qad.dll in C:\Windows | Neither file ships with Windows. A tool placed them there. |
| Security software reports the file as dangerous | The old report said all major antivirus programs marked it. Treat the alert as real and remove the activator. |
| Programs behave differently or are monitored | The file might monitor programs or change their behaviour. Run a Defender offline scan. |
| Files unreadable or missing | Bundled malware may be damaging your files. Disconnect from the network and scan from a clean state. |
| You never ran an activator but the file is present | The same filename might be used by other malware. Inspect the file and remove it. |
Questions people ask
Is secoh-qad.exe a virus?
Yes, treat it as malware. It is a component of KMSpico, an activator that pretends to be a legitimate Windows tool, and it is not a Windows file. The tool may install Trojans, ransomware or unwanted programs, so remove the file together with the activator that installed it.
Is secoh-qad.exe a Windows file?
No. Microsoft does not ship it with any Windows version, and Winbindex, the index of Microsoft builds, has no record of it. If it is in the C:\Windows folder, a tool such as an activator placed it there.
What is secoh-qad.dll?
It is the companion file used by the same program. It can be found on a system infected with this activator, and like the executable it is not a legitimate Windows file. Remove both together with the activator.
What if I never installed an activator?
Do not ignore the file. The same filename might be used by other malware, so check its folder, scan with Microsoft Defender, including the offline scan, and look in Autoruns for the entry that starts it. Remove it if it is not from a program you know.
Can I delete secoh-qad.exe by hand?
Deleting only the file is not enough. The activator and its start-up entries can remain and may add other components. End the process, remove startup entries, uninstall the activator, delete the files, and run an offline Defender scan to check that nothing else was installed.
Is using KMSpico legal?
No. It allows activating Windows or Office 2010 without buying a licence, which breaches licensing terms. Besides being unlawful, it is risky for your privacy and files, because such tools can be used to bring in Trojans, ransomware and unwanted programs.
Sources
- Microsoft Security Intelligence: HackTool:Win32/AutoKMS
- Microsoft Learn: Process Explorer
- Microsoft Learn: Autoruns
Version data read on Oct 6, 2026.
Questions and experiences
Ask about this page: members and our editors answer. Reading is open; writing needs a free account.
…