These threats appeared in Windows Defender, something about KMSautoS. What are they, and what should I do?

Do not select Allow; remove KMSAutoS and its Defender exclusions, then run Microsoft Defender Offline because the screenshots show severe Trojan detections and commands attempting to exempt KMSAutoS from antivirus scanning.

What the entries mean

• Defender reports the detected items as Severe, category Trojan, with status Removed. “Removed” means Defender remediated those particular detections; it does not prove that every related component has been removed.
• The command lines show KMSAutoS attempting to add antivirus exclusions for:
  • C:\Windows\KMSAutoS\KMSAuto x64.exe
  • C:\Windows\KMSAutoS\KMSAuto_File
  • C:\Windows\KMSAutoS\KMSAuto_Files
• An exclusion prevents Defender’s real-time protection from scanning the excluded item, potentially leaving the computer vulnerable.^1^
• KMS is a legitimate Microsoft volume-activation technology used by organizations, but Microsoft’s supported management tool is the Volume Activation Management Tool (VAMT). The Microsoft documentation does not identify KMSAutoS as a Microsoft component.^2^

Port 1688 can be associated with legitimate organizational KMS activation, but that does not make the detected KMSAutoS executable safe.

Remove it completely

1. Do not click “Allow” on any KMSAutoS detection.
2. If KMSAutoS is currently running or the alerts continue appearing, disconnect the PC from the Internet during cleanup.
3. Open Settings → Apps → Installed apps. Uninstall KMSAutoS or any activation/crack utility associated with it.
4. Open Windows Security → Virus & threat protection → Manage settings → Exclusions → Add or remove exclusions.
5. Remove every exclusion referring to KMSAutoS, KMSAuto_File, or KMSAuto_Files. Microsoft documents that an exclusion can be removed by selecting it and choosing Remove.^1^
6. In Windows Security → Virus & threat protection, check Allowed threats. If any related item was previously permitted, select it and choose Don’t allow.
7. If it still exists after uninstalling, delete C:\Windows\KMSAutoS, then empty the Recycle Bin. Do not manually delete unrelated files under C:\Windows.
8. Under Virus & threat protection updates, select Protection updates → Check for updates.
9. Save open work, then go to Virus & threat protection → Scan options → Microsoft Defender Antivirus (offline scan) → Scan now. The computer restarts and scans before normal Windows loads, making persistent malware more difficult to hide.^3^
10. After Windows restarts, open Protection history and review the Offline scan results. Then run a Full scan.

If detections return

A detection that reappears after restarting can indicate that another component is reinstalling it. Microsoft specifically recommends Defender Offline for recurring malware.^4^

If KMSAutoS returns after the Offline and Full scans:

• Run Windows Update and install all security updates.
• Run Microsoft Safety Scanner as a second Microsoft scan; Microsoft recommends it when infection is suspected.^5^
• If the program was run with administrator privileges, change important passwords from a different, known-clean device and review account sign-in activity.
• If scans cannot remove it or it repeatedly recreates exclusions, back up personal documents—but not executables, scripts, or cracked installers—and use Reset this PC or reinstall Windows. Microsoft lists reset or reinstall as the recovery path when malware has caused changes that cannot be reversed.^4^

After cleanup, activate Windows or Office only with a valid retail/digital license or an organization-provided KMS service. Do not reinstall KMSAutoS or add an antivirus exclusion for it.

References

1. Virus and Threat Protection in the Windows Security App | Microsoft Support
2. Use the Volume Activation Management Tool
3. Three easy steps to improve your cybersecurity | Microsoft Support
4. Troubleshoot problems with detecting and removing malware | Microsoft Support
5. Microsoft resources and guidance for removal of malware and viruses | Microsoft Support