0

Today I have a firewall rule allowing incoming traffic for a program called kmss.exe in Windows Firewall on one of my computers and I'm 100% sure that I didn't add it, neither was I ever asked to allow that program to connect to the internet through Windows Firewall.

So, the firewall rule says that the program must be in C:/Windows/Temp/Files/Bin/kmss.exe but when I opened C:/Windows/Temp/ in file explorer, there was no directory named "Files". I tried to use command prompt to find it, I failed again. And my settings already allow for hidden folders to be shown in file explorer.

So, I suspect that C:/Windows/Temp/Files/Bin/kmss.exe does exist, but somehow it has managed to modify or fool Windows into thinking that it does not. Is that possible? If yes, what can I do to access that file and remove it?

12
  • 1
    I don't see how my question is relevant to Super User and why my question was migrated from the security subdomain. Nov 4, 2019 at 23:59
  • Sounds like a case where an rule was created then the folder, since it’s designed to be temporary, was cleaned out. Since the mechanic to wipe the folder doesn’t know or care about Windows Firewall the rule was left to exist. “Is that possible?” - a file can be shown as being hidden for a specific user but there is always absolutely a way to unhide it. There is absolutely no way to hide a file where it’s impossible to view it.
    – Ramhound
    Nov 4, 2019 at 23:59
  • @Ramhound That's what I thought too. But then I googled kmss.exe and I realized that it could act like a rootkit sometimes, modifying Windows and leaving a backdoor open in the client's system to regularly update the pirated license which may also include potentially dangerous behavior like sending keystrokes and mouse inputs. This is why I asked my question in security.stackexchange.com. So, I'm worried that maybe it has modified Windows kernel in some way that Windows deliberately ignores it. Is that possible? Are there known malwares capable of doing that? Nov 5, 2019 at 0:03
  • No; Malware isn’t modifying the Windows kernel, the kernel, has specific protections against that.
    – Ramhound
    Nov 5, 2019 at 0:05
  • 2
    If you want to determine whether the file exists but Windows isn't telling you, simply boot from another OS and use it to inspect the filesystem. While it's possible for a rootkit to make a running instance of Windows unable to report the existence of an object, it cannot make a completely separate OS participate in the deception. Nov 5, 2019 at 0:14

2 Answers 2

1

Yes it's possible to hide files from windows with a root kit. You can use RootkitRevealer to try and figure out if that's happening. It scans your system and tries to find discrepancies between what the kernel apis report and what the windows apis report. That link has a much better explanation of how root kits work.

2
  • 1
    Thanks. This was exactly the kind of thing I was looking for. However, when I downloaded it and tried to run it as an administrator, a box appeared that asked me to accept the ToS or something but then nothing happened after that. And when I click to run it again, nothing happens. It doesn't run at all. I just read the page again and it says that it works on Windows XP and Windows 2003. I'm running Windows 10. Maybe that's why? Nov 5, 2019 at 12:38
  • I don't know, I haven't actually used that program in years, and it may be out of date.
    – Blake
    Nov 5, 2019 at 12:50
1

That file, kmss.exe, appears to be part of a hack tool, AutoKMS, used to bypass Windows or Microsoft Office activation. It could be that someone tried to install that hack, and an antimalware application has moved the file to quarantine or has deleted it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .