Re: Hacktool.Unknown Detected by AV Removed - Returns After Startup
First my apologies if you do not consider this Malware. I personally don't know what classification this file falls into. All I know is it won't go away and I've been dealing with it since May 4th.
Initially on May 4th, Norton 2007 detected this file at startup, logged it simply as "Hacktool" and automatically removed the threat:
C:Windows\Temp\nspc.tmp
Ever since then, a version of the file (name changes slightly each time) returns when I restart. I noted each file was also submitted to Symantec automatically, so I suspected the file was being analyzed. (File variations such as nsj3.tmp, nsn3.tmp, n3l3.tmp, nsc2.tmp, etc.)
As of the May 10th .dat files from Symantec, the file is detected by Norton as "Hacktool.Unknown" and now requires a manual deletion.
http://securityresponse.symantec.com/security_response/detected_writeup.jsp?name=Hacktool.Unknown
Because of the nature of Hacktools, I do not feel comfortable just simply deleting the file. I want to stop the file from being recreated! I have run all kinds of scans, purged everything out of Temp, Prefetch and %Temp%.
I have an open case with Symantec's Virus Removal support, but after 2 tries have gotten nowhere. The Symantec technicians repeated the clearing of the folders I've cleaned up, have run tools to clean anything else they could identify. Yet the file is recreated after startup, always with a new variation in the name.
Add insult to injury - my husband's PC (which he rarely uses) came up with 770 Hacktool.Unknown yesterday. We are not networked; merely share a router for his wireless connection. I now have it to the same point I am now, with 1 file being created after startup.
Symantec has not agreed this could possibly be a false positive. I've Googled for any hint that others have encountered this.
Logs to follow. Please help!
Barb
First my apologies if you do not consider this Malware. I personally don't know what classification this file falls into. All I know is it won't go away and I've been dealing with it since May 4th.
Initially on May 4th, Norton 2007 detected this file at startup, logged it simply as "Hacktool" and automatically removed the threat:
C:Windows\Temp\nspc.tmp
Ever since then, a version of the file (name changes slightly each time) returns when I restart. I noted each file was also submitted to Symantec automatically, so I suspected the file was being analyzed. (File variations such as nsj3.tmp, nsn3.tmp, n3l3.tmp, nsc2.tmp, etc.)
As of the May 10th .dat files from Symantec, the file is detected by Norton as "Hacktool.Unknown" and now requires a manual deletion.
http://securityresponse.symantec.com/security_response/detected_writeup.jsp?name=Hacktool.Unknown
Because of the nature of Hacktools, I do not feel comfortable just simply deleting the file. I want to stop the file from being recreated! I have run all kinds of scans, purged everything out of Temp, Prefetch and %Temp%.
I have an open case with Symantec's Virus Removal support, but after 2 tries have gotten nowhere. The Symantec technicians repeated the clearing of the folders I've cleaned up, have run tools to clean anything else they could identify. Yet the file is recreated after startup, always with a new variation in the name.
Add insult to injury - my husband's PC (which he rarely uses) came up with 770 Hacktool.Unknown yesterday. We are not networked; merely share a router for his wireless connection. I now have it to the same point I am now, with 1 file being created after startup.
Symantec has not agreed this could possibly be a false positive. I've Googled for any hint that others have encountered this.
Logs to follow. Please help!
Barb
