{"id":1405,"date":"2014-08-12T18:13:42","date_gmt":"2014-08-12T18:13:42","guid":{"rendered":"http:\/\/www.freefixer.com\/b\/?p=1405"},"modified":"2018-05-29T12:02:47","modified_gmt":"2018-05-29T12:02:47","slug":"kernelscreenshotwin32-exe-malware","status":"publish","type":"post","link":"https:\/\/www.freefixer.com\/b\/kernelscreenshotwin32-exe-malware\/","title":{"rendered":"KernelScreenshotWin32.exe &#8211; Looks like malware to me"},"content":{"rendered":"<p>Just a quick note on a file called\u00a0<a href=\"http:\/\/www.freefixer.com\/library\/file\/KernelScreenshotWin32.exe-137042\/\">KernelScreenshotWin32.exe<\/a> that I found earlier today. The file uses typical malware behaviour, that is, it has no version information, no digital signature, no entry in the Add\/Remove programs dialog, runs in an unusual folder, called C:\\Windows\\SysWOW64\\KernelScreenshotWin32\\ instead of c:\\Program Files, bundled with a file <a title=\"Smart Secure Software S.l \u2013 Bundling and VirusTotal Report\" href=\"http:\/\/www.freefixer.com\/b\/smart-secure-software-s-l\/\">signed by Smart Secure Software<\/a>,\u00a0no visible GUI, runs in the background, etc, etc.<\/p>\n<p><a href=\"http:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/08\/KernelScreenshotWin32.exe-file.png\"><img loading=\"lazy\" class=\"alignnone size-full wp-image-1406\" src=\"http:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/08\/KernelScreenshotWin32.exe-file.png\" alt=\"KernelScreenshotWin32.exe file\" width=\"707\" height=\"193\" srcset=\"https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/08\/KernelScreenshotWin32.exe-file.png 707w, https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/08\/KernelScreenshotWin32.exe-file-300x81.png 300w\" sizes=\"(max-width: 707px) 100vw, 707px\" \/><\/a><\/p>\n<p>However, when I uploaded the file to VirusTotal, none of the 50+ anti-virus programs detected it. Maybe I&#8217;m incorrectly calling this malware? It will be interesting to see if some of the scanners start to pick up the\u00a0KernelScreenshotWin32.exe file in the future.<\/p>\n<p>Anyway, if you&#8217;d like to remove the\u00a0KernelScreenshotWin32.exe file you can do so with FreeFixer. Just select the\u00a0KernelScreenshotWin32.exe process and service:<\/p>\n<p><a href=\"http:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/08\/KernelScreenshotWin32.exe-process.png\"><img loading=\"lazy\" class=\"alignnone size-full wp-image-1407\" src=\"http:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/08\/KernelScreenshotWin32.exe-process.png\" alt=\"KernelScreenshotWin32.exe process\" width=\"788\" height=\"281\" srcset=\"https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/08\/KernelScreenshotWin32.exe-process.png 788w, https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/08\/KernelScreenshotWin32.exe-process-300x106.png 300w\" sizes=\"(max-width: 788px) 100vw, 788px\" \/><\/a> <a href=\"http:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/08\/KernelScreenshotWin32.exe-service.png\"><img loading=\"lazy\" class=\"alignnone size-full wp-image-1408\" src=\"http:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/08\/KernelScreenshotWin32.exe-service.png\" alt=\"KernelScreenshotWin32.exe service\" width=\"786\" height=\"331\" srcset=\"https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/08\/KernelScreenshotWin32.exe-service.png 786w, https:\/\/www.freefixer.com\/b\/wp-content\/uploads\/2014\/08\/KernelScreenshotWin32.exe-service-300x126.png 300w\" sizes=\"(max-width: 786px) 100vw, 786px\" \/><\/a><\/p>\n<p>Did you also find\u00a0KernelScreenshotWin32.exe on your machine? Any idea how it was installed? Please share by posting a comment.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Just a quick note on a file called\u00a0KernelScreenshotWin32.exe that I found earlier today. The file uses typical malware behaviour, that is, it has no version information, no digital signature, no entry in the Add\/Remove programs dialog, runs in an unusual folder, called C:\\Windows\\SysWOW64\\KernelScreenshotWin32\\ instead of c:\\Program Files, bundled with a file signed by Smart Secure &hellip; <a href=\"https:\/\/www.freefixer.com\/b\/kernelscreenshotwin32-exe-malware\/\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">KernelScreenshotWin32.exe &#8211; Looks like malware to me<\/span> <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[16],"tags":[],"_links":{"self":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/1405"}],"collection":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/comments?post=1405"}],"version-history":[{"count":2,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/1405\/revisions"}],"predecessor-version":[{"id":1410,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/1405\/revisions\/1410"}],"wp:attachment":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/media?parent=1405"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/categories?post=1405"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/tags?post=1405"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}