killapps.exe

For several months, I have been getting false reports on a file:

Positive identification: Riskware.Proxy.Hltv
File: c:\sierra\half-life\hltv.exe

I sent the files and posted here on it, and was told they are legitimate and that an update would soon take care of them.

Now, as of April 1, 2005, I'm getting a hit on this file:

Positive identification: Riskware.Tool.KillApp.b
File: c:\windows\system32\killapps.exe

Manual scans with NAV do not detect anything wrong with this file, killapps.exe. It's been on my system for awhile, and I have a CREATIVE sound card. Right-clicking the file does not reveal any specifics on the author.

Anybody know about this one? And will a future update remove the alarm if it is a legitimate file? And how about the one about htlv.exe?

Regards,

Phil

 

Hi there, you might like tyo submit that file too, just in case! Thanks a lot!
Looking forward to the results!

 

I'm also getting the same file...I've tried to read up on it. There seems to be some confusion about whether this is a legit file that has the potential to be used in a harmful way, or if it is ok, or if it is a nasty. I have some more reading to do, but my intuition tells me that it is a false positive. I hope someone with specific knowledge will comment on this soon.

 

https://www.wilderssecurity.com/showthread.php?t=59067
http://www.techsupportforum.com/showthread.php?t=38329
http://www.soundcard-drivers.com/drivers/58/58954.htm <<see it here in their original software
166 07-19-01 16:15 2K_XP/Drivers/COMMON/kill.ini
36864 03-23-01 14:09 2K_XP/Drivers/COMMON/killapps.exe

Killapps.exe is used by Creative setup to terminate active applications before installing/uninstalling Creative software.
The problem is that the same application is used by several scripts and trojans to terminate anti-virus software and firewalls.
Therefore detection for it is added as "Riskware" which means: "This program alone is harmless and might have some applications where its used in a legal way but there are several malcious porgrams out there that use that program to do evil things."

Both those location would seem legit:
C:\OEMDRVRS\COMMON\KILLAPPS.EXE <------- Driver location
C:\WINDOWS\system32\killapps.exe <-------System32 location

 

Jooske,
Make it simple for a simple mind like mine. What do I do about this potential threat? It is installed in the location C:/windows/system32/killapps.exe and I do have a Creative sound card. Should I ignore it every time? Or should I delete the file?

 

Hi Dallen, At a guess If you have ProcessGuard it will alert you firstly if the .exe is changed and secondly what command instigated the process to start.
As a second line of defence you could add the .exe to TDS3's CRC checkist which would also alert on a change.

The other part is that if you are changing or updating you soundcard configuration you might expect the .exe to be started but if not then this may be cause for concern.

HTH Pilli.

 

Hi dallen,

Deleting killapps.exe will cause no problems. It is included in the Creative driver installers and will be placed in \system32 again if missing.

Nick

 

I just zipped the file and sent it in. Hopefully it will yield something and perhaps if it is a legitimate file we will know.

Phil

 

Gavin explained in the General forum at DiamondCS some about it.
Best ignore if for the moment.

 

I think it´s a false positive, isn´t it ?

 

Thanks for help.

I have a Creative card installed in my computer, and I´m sure I don´t have any kind of malware or something.My computer was scanned with Spy Bot, Microsoft AntiSpyware, TDS-3, Trojan Hunter 4.2 and NOD32 2.5 beta.

Best Regards,

DonKid.

 

So...Are you saying that if I elect to fix it, there will be no ill side effects?

 

I ditched mine about 2 weeks ago and have had no problems. Sound still works fine and there are no event log/application errors surrounding this .exe

Maybe it will rear it's head if i ever try to update the drivers but i seriously doubt it.

 

Just on a side note ... I don't trust Creative as far as i could throw them - and thats why i was all to happy to delete this killapps.exe.
All Creative install drivers stick free.aol.com links and cookies into numerous areas of the users PC - including one into the IE safe zones. As well as about 5 autostart entry's complete with the un-needed running processes into the registry.

 

killapps.exe is a trojan & a hacking tool. I do have a Creative 5.1 sound, sound works fine. Yesterday switched the PC off normally and everything was well, CPU running low, fast PC etc. Switched on today, getting Windows Logon errors, tried to see what is it, nothing, did a Panda Software scan, found killapps.exe and have deleted, did a restart and had problems when loading up due of not finding boot.ini in c:\windows\setup32\*, have talked with a mate and have cleared everything up, done a repair via the winXP and everything works fine.

 

if you have a creative audigy card and you're careful about security killapps.exe is likely part of the creative setup. if you're still bugged by it either add it to an exclusion list or just rename it to killapps.exe.disabled

 

From KAV support:

From BitDefender:

 

On my PC killapps appeared in ...\Windows\system32\ when I installed Audigy 2 ZS (it's on the installation CD). I renamed it to see what happened. Nothing happened, and everything has been running smoothly for a couple of months now, with TDS-3 calling the renamed file riskware at every scan. So I'd say ignore it, if it came with your Audigy card.

 

Strange because it never happended to me. No warning at all from TDS only from KAV. Then I add it to my exclusion list.

 

I deleted Killapps a long time ago. It has had no ill effects on my system at all.

bigc