HackTool:Win32/AutoKMS

Remove the AutoKMS activation software first, then run a Microsoft Safety Scanner Full scan, because AutoKMS can create a scheduled task that runs daily and may recreate the detection after Defender’s quarantine attempt.^1^

Remove AutoKMS and rescan

1. Open Start → Settings → Apps → Installed apps.
2. Look for and uninstall anything named AutoKMS, KMSPico, KMS, or the activation/crack package that installed it:
   • Select More (…) → Uninstall.
   • Also uninstall any recently installed program associated with that package.
   Windows supports removing unwanted software through Settings → Apps, although not every unwanted component necessarily appears there.^2^
3. Restart Windows.
4. Download the current 64-bit Microsoft Safety Scanner from Microsoft, unless Windows 11 is unusually installed as 32-bit. Open msert.exe, accept the terms, choose Full scan, and allow it to remove everything detected. Safety Scanner is intended to find and remove malware and attempt to reverse changes made by detected threats.^3^
5. When it finishes, review:
   • The result displayed by Safety Scanner.
   • %SYSTEMROOT%\debug\msert.log for detailed detections.
6. Open Windows Security → Virus & threat protection → Protection history as an administrator. Expand the latest AutoKMS card and inspect Affected items and its current status.

Interpreting the Defender message

• Threat blocked means Defender blocked and removed the item; no additional action is required for that specific event.
• Threat quarantined means it is harmless but still stored in quarantine; select Remove.
• Remediation incomplete or Quarantine failed means Defender could not finish cleaning it. Expanding the card should show any additional action and affected file locations.^4^

Do not choose Allow on device, add an exclusion, or disable Defender for AutoKMS. Keep Real-time protection, Cloud-delivered protection, and Automatic sample submission enabled.^5^

Protection History retains old entries for approximately two weeks, so an old failed card may remain even after the underlying file has been removed. The important test is whether a newly updated Full scan detects AutoKMS again.^4^

If AutoKMS is detected again

Since the Defender Offline scan has already been tried, do not simply repeat it. Instead:

1. Note the exact Affected items paths in the newest Protection History event.
2. Confirm Safety Scanner was freshly downloaded; it expires ten days after download and should be downloaded again for current definitions.^3^
3. If AutoKMS still returns after the activator is uninstalled and Safety Scanner completes, back up personal documents and perform a clean Windows reinstall. Microsoft recommends reinstalling from installation media when a suspected infection continues; a clean installation removes files, applications, and settings from the selected drive.^6^

After removal, activate Windows and Office only with a genuine product key or the digital licence associated with the device/account.

References

1. HackTool:Win32/AutoKMS threat description - Microsoft Security Intelligence
2. Unwanted software
3. Microsoft Safety Scanner Download
4. Protection History in the Windows Security App | Microsoft Support
5. Antivirus and antimalware software: FAQ | Microsoft Support
6. Recovery options in Windows | Microsoft Support