wincalc.exe - Dangerous

wincalc.exe

Jeff's Story:

My PC had gotten a bad rootkit that my ISP antivirus software (powered by McAfee) could not detect, nor could fix.

I sought a solution on the Internet and discovered your product and tried out the trial.

You quickly found the rootkit and SAVED my PC!

I haven't had any problems since, and I'm extremely grateful.

Free Download

Manual removal instructions:

wincalc.exe
Backdoor.Paproxy is a Backdoor Trojan horse that allows the infected computer to be used as a network proxy.
Opens a backdoor onto the computer.

Copies itself to %System%\Wincalc.exe.
Attempts to connect to http:/ /www.yahoo.com on port 80 using a POST method.
Attempts to connect to smtp.westcowboy.com on port 80.

Manual removal:
Navigate to the keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunService
and delete the value: "LogService"="%System%\Wincalc.exe"

Navigate to the key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
and delete the values:
"ProxyServer" = ";"
"ProxyEnable" = "1"

Navigate to the key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
and change the value: "Shell"="Explorer.exe %System%\Wincalc.exe"
to "Shell"="Explorer.exe"

Remove wincalc.exe now!