kernl32.exe

Last Updated on Wednesday, 29 August 2012 11:43 Saturday, 22 October 2011 17:40

Trojan - Generic

A file by the name kernl32.exe is created by a computer virus program that affects the computers running on the Microsoft windows operating systems. It's analysis report is given below

kernl32.exe is not a Microsoft windows system file/ process for sure. Such a name could have been used in some legitimate program somewhere, but in this case here is a virus that enters the computer as a Flash download, it is in Portugese language. It creates files named flash.exe, winsys.dll in Temp folder 

Files found - view
%Temp%\flash.exe
%Temp%\winsys.dll
C:\Windows\system32\kernl32.exe

There may be more files created by this virus program. You can find them out. First locate and note down the "date of creation" of kernl32.exe and after that, search the hard disk for other files created on that date or onward. See image

Necessary steps required to remove this virus program

• To remove processes created by the virus program from the Task Manager
• To search and delete files created by the virus program from the hard disk. Enable to view "hidden files and folders" before you search. Otherwise files created by the virus program inside the hidden folders will not be found
• To remove obsolete registry keys using CCleaner