Pocket Killbox complications?

craigcomputer · Aug 9, 2006

Edit: chaslang I appreciate your support and don't mean to second-guess you but I'm seeing if others might notice this and have input.

Anyone able to help me understand this? I was given these instructions in another thread:

Now run Pocket Killbox by doubleclicking on killbox.exe
Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
Then after it deletes the files click the Exit (Save Settings) button.
NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue.

Select:
Delete on Reboot
then Click on the All Files button.
Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
C:\Program Files\Uninstall My Web Search.dll
F:\CDS300\__CDS2.dll
C:\windows\system32\rlvknlg.exe
C:\WINDOWS\pornaccess.exe
C:\WINDOWS\NDNuninstall6_90.exe
c:\windows\system32\rk.bin
c:\windows\downloaded program files\HDPlugin1101.dll
c:\windows\inf\biini.inf
c:\windows\ss3unstl.exe
Return to Killbox, go to the File menu, and choose Paste from Clipboard.
Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).
If Killbox does not reboot just reboot your PC yourself.
Click to expand...

OK, now for the complications; after running this, other malware scanners (Kaspersky Internet Security 6, Panda activescan, possibly XCleaner, too) find files matching those last 4 in the C:\!Killbox\ folder. I look in the folder and two of them, rk.bin, HDPlugin1101.dl I can't delete (don't have permission). I had Kaspersky delete those that it found, and deleted the other two manually.

Now I thought Process Killbox was supposed to get rid of them but good. Can anyone tell me please does this mean I have a replicating infection?

craigcomputer · Aug 9, 2006

Hmmmmm, I checked out the helpfile on Process Killbox and partially found out rightaway.

File > Open !KillBox Backups:
This opens the backup folder, which strategically named, should be located as the first directory on the root drive of where Windows is installed, (ie: if Windows is installed on a C: drive (C:\Windows), the !KillBox backup folder will be place on C: as well (C:\!KillBox), or if Windows is on a D: (D:\WINNT) then the !KillBox backup folder will be placed on D: (D:\!KillBox), etc.
Click to expand...

But does that somewhat defeat the purpose of deleting? Or is the backup folder a fairly safe place for those malicious files to sit?

chaslang · Aug 9, 2006

You should only be running what we ask you to run. C:\!Killbox is where Pocket Killbox save backups of things it deletes. They are saved just in case a mistake is made. Part of our final steps would be to cleanup the folder (which can be done from Killbox's File Menu). We only do this after we know we don't need them.

Log in or Sign up

Pocket Killbox complications?

craigcomputer Private E-2

craigcomputer Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member