Is Microsoft Taking Stealth Screenshots For 'Feedback' Purposes?

I've just discovered a folder, in the pictures folder, called 'Feedback' which contained a sub-folder with a GUID for a name. This sub-folder contained a screenshot called Capture001.png.

Something like:

C:\Users\Nus\Pictures\Feedback\{B2367SDG-3AF8-84KN-NBUJ-K89W37Y844HJK}\Capture001.png

It was created a week ago and I know exactly what I was doing at the time the folders and screenshot were created: organising files in File Explorer.

I can only find one other occurrence of this in Google search, here. The MS tech gives a generic response about scanning for viruses.

I have all the known MS feedback, spy and telemetry stuff disabled. Which is what makes me think that this is happening on other systems in a stealthy fashion, as part of the 'feedback' programme -- the stealth obviously failed here, perhaps because of my hacks.

No other applications, besides File Explorer, were running at the time; no background apps, no 3rd-party services. System has been scanned with MBAM since and was clean. Pressing WINKEY + PrtScr takes a screenshot that goes in a Pictures\Screenshot folder.

Has this happened to anyone else?

Do you know how this scenario can be recreated?

Any other explanations, theories, thoughts?

Stealth screen shot that is placed in your user folder in the pictures sub location is not a stealth screenshot. More than likely it is something you initiated yourself.

The feedback app can upload screenshots, per your request. You might have accidentally triggered this. If you open the feedback app and click "Add new feedback", there is a link to "take a screenshot". You probably accidentally clicked this.

Mystere said:

The feedback app can upload screenshots, per your request. You might have accidentally triggered this. If you open the feedback app and click "Add new feedback", there is a link to "take a screenshot". You probably accidentally clicked this.

I have never opened the Windows Feedback app. Is there any key combination that could trigger the same behaviour.

OK, just opened the Windows Feedback app for the first time. You have to login with a Microsoft account. The machine has only ever had a local account. So, direct interaction with the Windows Feedback app can be discounted.

I decided to do a forensic analysis of the USN Journal to see if other file activity, at the time of the screenshot, would shed light on the matter.

Low and behold, all entries prior to the KB3081441 and KB3081444 updates, on 19/08/2015, have been wiped.

So, in the absence of any other plausible explanation, I'm holding to the suspicion that stealth screenshots are being taken and uploaded to MS without the users knowledge. The stealth process failed on my machine, due to all the privacy hacks I have made, and dumped the screenshot to disk.

I'm prepared to change my position if anyone has a precise answer.

Otherwise, you have been warned!

Depending on your device, there are keystrokes that can take a screenshot and dump it to the drive. My Surface Pro 3 has this "feature". I would think if Microsoft was taking screenshots, it would have been widely publicized by now.

Nus and Boozad, please let us know more details. The more details, the better. Maybe you haven't completely turned off error reporting...

It's interesting to see this play out, will M$/W10 get more invasive or less? And as a result, will its users choose another OS? There is Debian+Wine, however in many cases, this OS isn't better than W10...

I don't have the 'Pictures\Feedback' folder...

Thx