winstat.exe

[Guest]

It is in "Add/Remove Programs."
Ad-Aware did not remove it when run in safe mode, nor in normal mode, but
Ad-Aware says it will remove it upon reboot.

Symantec has no mention of it; microsoft.com has no mention anywhere; it is
not mentioned here. I found a few hits on google:
www.greatis.com/appdata/d/w/winstat.exe.htm , says it is "dangerous" and it
"steals passwords"...it is "ICQ trojan."

Wassup wit dis? TIA g.

 

[Laura E. Hunter \(MVP\)]

Try downloading the Anti-spyware tool from www.microsoft.com/spyware. Even
though it's still in beta, it tends to be able to remove spyware items that
some of the other scanners can miss.

 

[Guest]

Hi Laura,
Thanks for the reply.
It is, however, an answer to a question that was not asked.

I stopped the process in task manager, then deleted the .exe at "search"
results window. It has not returned.

I am suspicious of anything Microsoft publishes. I want to wait until
results and studies of the MS antisypware appear before I install it. I'm
curious if MS has included backdoors and monitoring functions of its own. I
have nothing to hide; it's simply that the Constitution of the United States
protects my privacy despite the actions of the U.S. Congress, activist judges
in this country, and America's police (oh yeah...and Microsoft.)

 

[IVL]

Hi Laura,

Just thought you would like to know that your not the
only one with this problem but Norton Antivirus 2005 has
identified it as a threat to the system, and seems to be
able to remove it successfully, but that was not your
original question.

History:
Winstat is an add-on for Microsoft Excel giving you extra
statistical codes at your disposal. It is as you have
also mentioned a ICQ trojan. Effectively it is a back-
door program as you said.

Truthfully I agree, I don't trust MS programs, because
they seem to think, yes you can download this and your
information will not be shared, but we are not going to
tell you that we have allowed a back-door for ourselves
to monitor what you are doing, that way we can know what
you are doing, where you are doing it, heck, we will even
know how fast your heart is pumping when you are doing it.

I have done exactly as you have done yourself, but here
is a little problem, because it was not removed the way
MS would have liked it, it corrupted the TCP/IP handler
in the process of deletetion and had something to do with
the LSP (Layered Service Provider). There is more
information and a fix for the LSP errors that pop up at
www.cexx.org/lspfix.htm

Also, just now, we have found the program resides in the
directory Windows/Ad Status, so you also need to remove
that program for your add/remove programs list. Funny
thing is, it is labelled as an Adware monitor
(supposedly), it acts more like an Adware access point

If we have more problems, I will reply back to this, but
at the moment we think we have gotten rid of it finally.