» ptclpvue-setup.exe
Overview
Analysis
File Details
Programs (1)
Downloads (1)

ptclpvue-setup.exe

Karen's Power Tools

KarenWare.com

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. This file is installed with the program Karen's Clipboard Viewer. The file has been seen being downloaded from www.karenware.com.

File name:

ptclpvue-setup.exe

Publisher:

Karen Kenworthy (signed by KarenWare.com)

Product:

Karen's Power Tools

Description:

Karen's Clipboard Viewer Installer

Version:

2.2.0.0

MD5:

7eb05bb29bb9e625d7574e7686411d7e

SHA-1:

e6f1face1278ed2570ed861b355298a3c43a355f

SHA-256:

d01655ffc856eeee9367bf2665ac4d76e4596128d100484d11c1846640033ecb

Scanner detections:

1 / 68

Status:

Clean (1 probable false positive detection)

Explanation:

This is mosty likely a false positive detection, the file is probably clean.

Analysis date:

2/25/2025 3:49:21 AM UTC (today)

Scan engine

Detection

Engine version

Vba32 AntiVirus

suspected of Trojan.Downloader.gen.h

3.12.24.3

File size:

657.3 KB (673,048 bytes)

Trademarks:

'Karen's Power Tools' and 'Karen's Clipboard Viewer' are trademarks of Karen Kenworthy

File type:

Executable application (Win32 EXE)

Installer:

NSIS (Nullsoft Scriptable Install System)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\ptclpvue-setup.exe

Digital Signature

Signed by:

KarenWare.com

Authority:

Thawte Consulting (Pty) Ltd.

Valid from:

2/23/2009 9:25:37 PM

Valid to:

2/26/2011 8:55:48 PM

Subject:

CN=KarenWare.com, OU=Secure Application Development, O=KarenWare.com, L=Broken Arrow, S=Oklahoma, C=US

Issuer:

CN=Thawte Code Signing CA, O=Thawte Consulting (Pty) Ltd., C=ZA

Serial number:

69B55624150D51731C244B8B6581680E

File PE Metadata

Compilation timestamp:

10/10/2008 4:49:01 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

12288:pckNw6efL3YWWPwi0jDJt4DyJNWF8En3WaP6mKX8KWTlbDgthb7r//U9nfOV:pLwtTtiyDEDyHWeE3VP7KX/WTlbDqvUS

Entry address:

0x30E3

Entry point:

81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 58, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, 23, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 90, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 4C, 91, 40, 00, 68, 60, E3, 42, 00, E8, DA, 27, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, C8, 27, 00, 00... 
[+]

Entropy:

7.9702

Packer / compiler:

Nullsoft install system v2.x

Code size:

23 KB (23,552 bytes)

The file ptclpvue-setup.exe has been discovered within the following program.

Karen's Clipboard Viewer by Karen Kenworthy

Publisher's description - “Peek inside your Windows clipboard. See what's waiting for your favorite application, in any of four different data formats (TXT, BMP, WMF and DIB). This handy tool can also erase the clipboard. New with version 2.0: Now runs from the Windows System Tray!”

www.karenware.com

3% remove it

The file ptclpvue-setup.exe has been seen being distributed by the following URL.

http://www.karenware.com/.../ptclpvue-setup.exe

Scan ptclpvue-setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.