Broadband Tech > Security > Security > knlwrap.exe AVG freaking

knlwrap.exe AVG freaking

So, did you let AVG fix it? I did a quick Google search and found indications that it is probably a trojan, just as AVG is saying.

reply to nvnvnvvnv
knlwrap.exe description: knlwrap.exe is an process which belongs to an unclassified keylogger and should be treat with caution. This process can log keystrokes which may allow a malicious user to gather passwords, credit cards or personal information from your computer. This is a non-essential process. Disabling or enabling this is down to user preference.
»www.processlibrary.com/directory···/knlwrap

reply to nvnvnvvnv
»discussions.virtualdr.com/showth···t=232995

reply to nvnvnvvnv
I see lots of people with this.

»forums.cnet.com/5208-6132_102-0.···=2839881

That's a lot of people. After seeing these posts, it does seem likely that it is a false positive. Still, what application installs this? I don't run AVG, but I don't have this file (knlwrap.exe) on my system, either, so I can't test using any other AV or anti-spyware.

reply to nvnvnvvnv
My system [WinXPSP3] shows %programfiles%\Common Files\InstallShield\engine\6\Intel32\knlwrap.exe. It was installed in late 2002, possibly in connection with Roxio ECDC 5. I submitted it to VirusTotal: the SHA1 hash there is the same as on my file; the scan shows that AVG thinks it is a trojan, but no one else dislikes it at all. My Avira AntiVir 8 does not complain. Surely an AVG false positive!

reply to Kayrac
I had already done that search, but I did look at a link and found a post within the link in which the poster said that he had webtrends on his system and when he removed that, the knlwrap.exe file went away, as well. A keylogger associated with webtrends makes sense. However, the next post by pudelein suggests that the file could be installed with Roxio's CD creator (early version). I did not reinstall that software when I had a hard drive failure last year. I did get a new Roxio product, RecordNow 9, but that does not install knlwrap.exe, it seems.

Anyway, since there seems to be no use for the file, why not just remove it?

reply to nvnvnvvnv
AVG are big-time jerks on their forum.
Just asking a question, and they jump down your throat about including all the rule requirements before posting and your thread locked or deleted....I'd say ask there but I'd rather not.

reply to nvnvnvvnv
AVG just updated and the file(s) are no longer flagged.

False positive......

reply to nvnvnvvnv
FYI: I removed the file in question with no problems that I can see. My PC is running perfectly. (I'll let you know if anything changes.)

reply to nvnvnvvnv
Here's something interesting, I'm running 64 Bits Vista Business Edition, and about two weeks ago I started experiencing something weird: I lost the ability to multi-select files on Explorer using the Shift or the Control keys. I searched the net looking for an explanation to my problem, and found some page at Microsoft that stated that this was an issue with Vista x64, and that it was under study. Then, after my AVG quarantined the knlwrap.exe file, I regained the multi-select capability on Explorer. This makes me suspect that the file "knlwrap.exe" is indeed a Keylogger.