Is KernelDriversDownload.dll a virus?

[Hisyam PI]

Hi,

Recently there is notification from Kaspersky regarding KernelDriversDownload.dll in System32. I upload this file to virustotal and the result is 35/71 flagged as a threat. I had try to disinfect my computer several times but the file keep recreated.

Is this false positive or not?

[harlan4096]

Welcome to Kaspersky Community.

 

That file looks quite suspicious, 35 detections at VT, and not digitally signed by Microsoft 🤔🙄

[Hisyam PI]

As additional information, this warning start appearing after I install Safing Portmaster and activating Windows Sandbox. Both are already uninstalled, but, the warning and files still persist.

[Berny]

@Hisyam PI

Also →  Kaspersky Open Tip report

[Hisyam PI]

So, is this an adware? Miner? Should I be concern?

Could I remove it? Because I've tried different ways, but it still persist.

OpenTip Reupload

Edited October 25, 2023 by Hisyam PI

[harlan4096]

I think you can remove it manually, or with the detection via Your Kaspersky, since that file does not belong to Windows system...

[Hisyam PI]

I've tried to remove it, but it keep getting recreated for some reason. Disinfecting with kaspersky also unable to permanently delete, it just keep re-created.

[Berny]

@Hisyam PI

In the meantime [25/10/2023-18:48] i got this information from Kaspersky Virus Lab :

Quote

Hello,

The notifications displayed to the user are informative and correct:
KernelDriversDownload.dll_ - not-a-virus:HEUR:RiskTool.Win32.BitMiner.gen

Kaspersky Lab applications classify the specified objects as legitimate software and do not identify them as malicious.
You can learn more about enabling / disabling display of notifications by clicking the following link:
http://support.kaspersky.com/viruses/general/664#block3

Best regards, Xxxxxxxxxxx Xxxxxxxxxxx, Malware Analyst
39A/3 Leningradskoe Shosse, Moscow, 125212, Russia Tel./Fax: + 7 (495) 797 8700

http://www.kaspersky.com
https://securelist.com
https://opentip.kaspersky.com/ - get insights about suspicious files, hashes, URLs, IP addresses or domain names

 

[harlan4096]

Also, check any recent suspicious app installed in the system, and uninstall it.

[Hisyam PI]

Thanks for the suggestion @harlan4096 and @Berny.