Windows 10: Is Microsoft Taking Stealth Screenshots For 'Feedback' Purposes?

I've just discovered a folder, in the pictures folder, called 'Feedback' which contained a sub-folder with a GUID for a name. This sub-folder contained a screenshot called Capture001.png.

Something like:

C:\Users\\Pictures\Feedback\{B2367SDG-3AF8-84KN-NBUJ-K89W37Y844HJK}\Capture001.png

It was created a week ago and I know exactly what I was doing at the time the folders and screenshot were created: organising files in File Explorer.

I can only find one other occurrence of this in Google search, here. The MS tech gives a generic response about scanning for viruses.

I have all the known MS feedback, spy and telemetry stuff disabled. Which is what makes me think that this is happening on other systems in a stealthy fashion, as part of the 'feedback' programme -- the stealth obviously failed here, perhaps because of my hacks.

No other applications, besides File Explorer, were running at the time; no background apps, no 3rd-party services. System has been scanned with MBAM since and was clean. Pressing WINKEY + PrtScr takes a screenshot that goes in a Pictures\Screenshot folder.

Has this happened to anyone else?

Do you know how this scenario can be recreated?

Any other explanations, theories, thoughts?

:)

 

Mystery update and restart...

Tonight, I experienced a mysterious Win 10 stealth update without warning.

Apparently to update "Microsoft Store" & "Feedback Hub"...

Has this or something like this happened to others?

 

Can't take screenshot on Windows Feedback app?

When reporting problem on Windows Feedback, the button to 'Take Screenshot' does nothing. It used to work in previous build. How to reset or reinstall the Windows Feedback app or to fix the screenshot issue? Please advice.

 

Stealth screen shot that is placed in your user folder in the pictures sub location is not a stealth screenshot. More than likely it is something you initiated yourself.

 

The feedback app can upload screenshots, per your request. You might have accidentally triggered this. If you open the feedback app and click "Add new feedback", there is a link to "take a screenshot". You probably accidentally clicked this.

 

I have never opened the Windows Feedback app. Is there any key combination that could trigger the same behaviour.

 

OK, just opened the Windows Feedback app for the first time. You have to login with a Microsoft account. The machine has only ever had a local account. So, direct interaction with the Windows Feedback app can be discounted.

 

I decided to do a forensic analysis of the USN Journal to see if other file activity, at the time of the screenshot, would shed light on the matter.

Low and behold, all entries prior to the KB3081441 and KB3081444 updates, on 19/08/2015, have been wiped.

 

So, in the absence of any other plausible explanation, I'm holding to the suspicion that stealth screenshots are being taken and uploaded to MS without the users knowledge. The stealth process failed on my machine, due to all the privacy hacks I have made, and dumped the screenshot to disk.

I'm prepared to change my position if anyone has a precise answer.

Otherwise, you have been warned!

 

Depending on your device, there are keystrokes that can take a screenshot and dump it to the drive. My Surface Pro 3 has this "feature". I would think if Microsoft was taking screenshots, it would have been widely publicized by now.

 

I have two, I took them both.

 

Nus and Boozad, please let us know more details. The more details, the better. Maybe you haven't completely turned off error reporting...

It's interesting to see this play out, will M$/W10 get more invasive or less? And as a result, will its users choose another OS? There is Debian+Wine, however in many cases, this OS isn't better than W10...

I don't have the 'Pictures\Feedback' folder...

Thx

 

Mine were taken by me using the Feedback app, they're meant to be there.

 

Yes, that's probably from the feedback app or possibly a program on r computer. Having a visible folder would be a dumb thing to do if were trying to stealthily spy on someone by taking screenshots, and so would taking them at seemingly random times which will most likely be the victim arranging files or something like that, leaving it on the hard drive after taking it and uploading it,or even having the folder in the actual Pictures folder. Some programs have crash reporters that will take a screenshot if allow them to. Maybe a program crashed and dismissed the crash message without unchecking a box or something. It would be way to hard to accidentally leave feedback w/out a Microsoft acct, that's for sure. Are sure that the screenshot was of doing stuff? Perhaps someone else on r computer has a Microsoft account and they took a screenshot using the feedback app.

 

I have given feedback with screenshots and fault re-creation several times, but don't have/can't see the folder with or without hidden files turned on.
I have looked in user folder and my libraries(on a separate drive)