Has anyone heard of this?

donnier · ‎03-07-2011

Have you heard of a trojan virus called "killap3"? Experienced problems with a new laptop and the folks we bought it from say that they ran diagnostics on the hardware and it checks out o.k. They say the computer has a "trojan virus called killap3 (a generic)" and that it will cost us $130.00 to remove it and also to optimize the computer. We've been careful with this computer since purchased and immediately installed NIS when we got it. Live updates, scans, full system scans with NIS have never shown a problem but computer has had some difficulties following an initial full backup that crashed (was attempting to do a full backup to dvds when it failed to complete the backup about 2/3-3.4 of the way through). Because of the way the store talked in a derogitory manner about Norton, I wanted to hear what others had to say and see if we can get some help via Norton rather than give another $130 to a store that won't fix our problems after having this new laptop for only 3-4 months. Given the kind of service they give, I'm not so sure they are the best buy, if you get my drift. Help with "killap3" (if there really is such a thing!)? Computorer was bogging down and internet explorer sometimes crashed or wouldn't close and the only way to close it was through task manager with repeated attempts to close down. Norton scans show no problems. Any thoughts or help?

delphinium · ‎11-21-2008

There is some discussion about killapps.exe on various forums. It should belong to a Creative Labs Soundcard. Its purpose to close down any open applications prior to uninstalling the sound card. Kaspersky identifies it as a worm, and ASquared identifies it as a trojan.

I would suggest that the best way to ensure that your machine is clean is to visit one of these free malware removal forums for a check. They are all very experienced and very good at what they do. Bleeping may have a longer wait time than the others. If it turns out to be a Windows error problem, they will assist you with that as well.

www.bleepingcomputer.com

http://www.geekstogo.com/forum/

http://www.cybertechhelp.com/forums/

http://forums.whatthetech.com/

Under certain circumstances profanity provides relief denied even to prayer.
Mark Twain

donnier · ‎03-07-2011

Thanks for the suggestion at these other locations. I guess I was expecting to hear of some help available directly through Norton for this, so I'm surprised at being directed to these other locations? I'll try to do some research on killapps.exe - the exact name "killap3" was the one writeen down and given us by the store geek where we bought the laptop. I've attempted to look it up here on the Norton site and couldn't find any reference to "killap3".

delphinium · ‎11-21-2008

I don't find it on Google, which makes one wonder where the repair guys found it. The removal forums use special tools that are not safe to use on an open forum like this one. On the four forums suggested, only qualified people are allowed to assist users with problems.

This is a user to user forum rather than support, so the kind of help that you were hoping for is not readily available here. Rather, we send users to where the best help is available. Symantec also has a virus removal service, but it is also a fee-based service, and we do not know if you are infected or not.

Under certain circumstances profanity provides relief denied even to prayer.
Mark Twain

donnier · ‎03-07-2011

Thanks delphenium for your replies. I'm trying tDo find out if we are really infected/have a problem or not after being told what we were. Repeated scans with Norton show no problem. I've not done a system restore yet but somehow suspect a problem with the OS after having a full system backup crash (that was when problems started seemingly or about that time). Tempted to do a system restore to an older restore point and see if we still have problems, but have never done before. I was hoping to see if there was somewhere I could go on Norton and get some support assistance, especially since we were told that this was a trojan virus and the name of it was "killap3". As you said, there is no other mention of it anywhere. The store where we bought this laptop said that they wanted $130 to remove any infection, restore OS, and "optimize" the laptop. I want to be sure I'm not being fleeced by a store for services not needed.

huwyngr · ‎04-13-2008

donnier,

delphinium has explained why we do refer people elsewhere ....

Please do not attempt a system restore without getting help here since we know from user experience that system restore can actually break Norton (and probably other applications) by restoring some files back to a date and condition that other parts of Norton does not expect since it has more recent data! It can be dealt with but I'd rather you knew before than after!

Let's see if there are any indications of infection by having you run at least one free application that is good at detecting malware that may get past the security net -- that can happen because sometimes it is unwittingly invited in by the user trying to say No Thanks!

Download and install the free version of Malwarebytes [Make sure you click on that Download Free Version on the left] -- it will take you to a third party site like MajorGeeks but that is OK and safe to use], click on its Update button to make sure it is fully uptodate in its definitions and then run it for a full system scan which may take some time. When finished have a look at the log which you can access through it's menu bar and it will indicate possible malware situations although there is some malware that cannot be detected except by the sort of people delphinium first referred you to -- they will work with you on the basis that only they do so at that time and that you do exactly what they say, not taking any shortcuts (something we all love to do ....).

You can post a copy of the log here in the forum if you wish.

Check to see if anyone has more detailed instructions or other suggestions for you but since apparently noone can find internet references to it as a dubuious file I'd follow your instinct and not pay a third party (not even Norton) to try to remove it.

Hugh

donnier · ‎03-07-2011

Thanks, Hugh! I've downloaded and ran Malwarebytes and first did a "quick scan". Here's the log of that below. I'm going to run a full scan since the quick scan came back with a clean report. Any other thoughts at this point are welcome!

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5990

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

3/8/2011 12:54:23 PM
mbam-log-2011-03-08 (12-54-22).txt

Scan type: Quick scan
Objects scanned: 167770
Time elapsed: 9 minute(s), 29 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

donnier · ‎03-07-2011

Next did the full scan as was suggested - also came back clean. Here's the log file from Malwarebytes:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5990

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

3/8/2011 2:51:39 PM
mbam-log-2011-03-08 (14-51-39).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 317108
Time elapsed: 1 hour(s), 41 minute(s), 42 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

huwyngr · ‎04-13-2008

That's encouraging ....

Given that no-one has heard of malware with the name you quote -- and the nearest Norotn can come is:

http://www.symantec.com/security_response/writeup.jsp?docid=2002-071813-0943-99

Trojan.KillAV is a Trojan horse that tries to terminate and/or remove any antivirus software that is running on the computer.

I would have thought you could rule out infection.

Maybe if you amplified a bit about << Experienced problems with a new laptop [ ... ] but computer has had some difficulties following an initial full backup that crashed (was attempting to do a full backup to dvds when it failed to complete the backup about 2/3-3.4 of the way through).>> plus give us some information about the computer and system:

Here's my boilerplate ....

To get you the best advice, would you give us some more information about your system:

What version of Windows are you using including Service Packs and whether 32 bit or 64 bit as well as the Name and Version ID of the Norton product that you are using -- Help or Support / About is where that is, in the format of nn.nn.nn.nnn

If you have the COMCAST version of Norton 360 / Security Suite and not the normal commercial version please be sure to tell us.

If you get any error messages please give the exact wording of them as well as any other background that could be helpful.

Please tell us what security software came pre-installed on the computer and how you obtained and installed the "Norton" that is now there -- did you buy it from the Norton OnLine Store or from a store or ......

What are the problems that you see at present apart from the crash while making the recovery media?

Can you give me the exact make and model of the computer -- not the serial number but the bunch of letters and numbers that go with the name and narrow down which one it is. I can then look up some background.

Hugh

delphinium · ‎11-21-2008

Part of the problem is that we don't know what scanner the repair guys used to identify the evil "killap3." It could still easily be a false postive particularly with both MBAM and Norton not reacting to it.

Under certain circumstances profanity provides relief denied even to prayer.
Mark Twain