KillBox - go get !Submit

dmacp · 10-16-2005, 11:35 AM

Dear Tech Support Forum -

I can't seem to get rid of a persistent pain in the neck called !Submit which also conceals plugin131_04.trace and is somehow tied to sp2 and d27d3de02806b631fad60.

When I search it shows up in C:/RECYCLERS and program files. It does not get recognized by Ewido and other scanners. I have repeatedly deleted it as a regular user and administrator in safe mode.

It bothers the heck out of me that I don't know all the places where it is living. How can it be assasinated once and for all, not only that, but also blocked in the future.......forever?

Here is a HJT analyzer summary if that helps.

Thanks,

dmacp

====================================================================
Log was analyzed using KRC HijackThis Analyzer - Updated on 2/10/05
Get updates at http://www.greyknight17.com/download.htm#programs

***Security Programs Detected***

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Logfile of HijackThis v1.99.1

sUBs · 10-16-2005, 12:02 PM

LOL..stop using Killbox then.

!Submit is the backup folder created by Killbox. Everytime you use it, it will create that folder to annoy the hell out of you

dmacp · 10-17-2005, 03:56 AM

HAH! Thanks. I'm just glad to have an answer. It was driving me up the wall.

Have a great day,

Debbie

10-16-2005, 11:35 AM	#1 (permalink)
dmacp Member Join Date: Feb 2005 Posts: 27 OS: XP	KillBox - go get !Submit Dear Tech Support Forum - I can't seem to get rid of a persistent pain in the neck called !Submit which also conceals plugin131_04.trace and is somehow tied to sp2 and d27d3de02806b631fad60. When I search it shows up in C:/RECYCLERS and program files. It does not get recognized by Ewido and other scanners. I have repeatedly deleted it as a regular user and administrator in safe mode. It bothers the heck out of me that I don't know all the places where it is living. How can it be assasinated once and for all, not only that, but also blocked in the future.......forever? Here is a HJT analyzer summary if that helps. Thanks, dmacp ==================================================================== Log was analyzed using KRC HijackThis Analyzer - Updated on 2/10/05 Get updates at http://www.greyknight17.com/download.htm#programs *Security Programs Detected* C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Logfile of HijackThis v1.99.1 __________________ Deborah MacPherson, Projects Director Accuracy&Aesthetics, A Nonprofit Organization for the Advancement of Education, Cultural Heritage, and Science

10-16-2005, 12:02 PM	#2 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 23,238 OS: N/A	LOL..stop using Killbox then. !Submit is the backup folder created by Killbox. Everytime you use it, it will create that folder to annoy the hell out of you __________________ Last edited by sUBs; 10-16-2005 at 12:52 PM.

10-17-2005, 03:56 AM	#3 (permalink)
dmacp Member Join Date: Feb 2005 Posts: 27 OS: XP	HAH! I see the connection now HAH! Thanks. I'm just glad to have an answer. It was driving me up the wall. Have a great day, Debbie __________________ Deborah MacPherson, Projects Director Accuracy&Aesthetics, A Nonprofit Organization for the Advancement of Education, Cultural Heritage, and Science