webcheck.exe - Dangerous
webcheck.exe
Jeff's Story:
My PC had gotten a bad rootkit that my ISP antivirus software (powered by McAfee) could not detect, nor could fix.
I sought a solution on the Internet and discovered your product and tried out the trial.
You quickly found the rootkit and SAVED my PC!
I haven't had any problems since, and I'm extremely grateful.
Manual removal instructions:
In order to run automatically when Windows starts up the Trojan copies itself to one of the following filenames in the Windows system folder:
update.exe; explorer.exe; winlogon.exe; system.exe; taskman.exe; taskmon.exe; svchost.exe; services.exe; wupdmgr.exe; winspool.exe; webcheck.exe; wininet.exe
Troj/Soromo-A periodically starts up a browser and directs it to a URL chosen randomly from a list of websites configured by the author.
Manual removal:
Locate the HKEY_LOCAL_MACHINE entries:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\System Update
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\System Update
and delete them if they exist.