calc.exe

[bucksmann]

can anyone help. I have calc.exe repeatadly ececuting. I
have tried everything I know to remove this virus.
Symantec Norton does not remove. I have disabled system
restore and run total system scan to no avail. I have
tried starting in safe mode and running hijack,
spysweeper, a squared, norton anti virus but its still
there. I am getting ready to reformat hard drive if it
goes on. Program can execute 100 times withing seconds
and makes it impossible to use the PC.

 

[Dusty Harper {MS}]

Sounds like a script is executing it. check the registry under
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Also check MSConfig for anything that may be launchin it ( batch files,
scripts etc .bat, .cmd, .js, .vbs )

Look in TaskMgr for any processes that don't look familiar.

Additionally, you may want to rename calc.exe to calc.org. This may hinder
whatever is launching it.

 

[Dave]

if you have one of those fancy ms keyboards, check to see that you haven't
spilled a soda on the calc button and that it isn't stuck.

 

[Karl Levinson [x y] mvp]

I would try a second opinion virus scan by going to
http://housecall.antivirus.com Filemon from www.sysinternals.com may also
be useful.

Also, see here:

http://www.securityadmin.info/faq.asp#startup
http://www.securityadmin.info/faq.asp#hacked
http://www.securityadmin.info/faq.asp#harden

 

[Steven L Umbach]

Were you able to identify the virus? Make sure that your Norton definitions are up to
date via Live Update. If so search Google for a removal tool for that particular
virus. Trend Micro has a free tool called sysclean that you can download and try at
the links below that detects and removes many common malwares. You need to download
the executable and the definitions file to the same folder to execute them from. ---
Steve

http://www.trendmicro.com/download/dcs.asp -- download sysclean package
http://www.trendmicro.com/download/pattern.asp -- download lpt168.zip [as of
09/04/04]
http://www.microsoft.com/athome/security/protect/default.aspx