>Microsoft provides guidance on deleting and managing certificates in the Windows certificate store

Microsoft should mark these as malicious and quarantine them using their built-in AV. If the end user needs them he can remove them from quarantine. Posting advisories no end user will ever see isn't helping much.