Unknown Trojan Help - calco.exe[inactive]

[lchazl]

Hi there,

I just recently formatted my computer and put back on XP Pro SP2, and I noticed that I have a process running called calco.exe in my C:\WINDOWS\system32\DirectX folder. It is 68.5 KB and it gives no information in the properties box.

I have NOD32 and it detected it as a "Operating memory - probably unknown NewHeur_PE virus [7]" and it quarantines it and then it will come back on the process list in a few minutes.

I try deleting the file and it just comes back again. I have searched for it in regedit and there are no entries. And I try and Goodgle it and getting nothing helpful either.

Thanks,

Charles

[jmoney3457]

hi chaz welcome to smf to get a better look on your computer please do this:Create a directory on your hardrive to save HijackThis.exe. A directory like c:\hijackthis. If you do not do this, you will not be able to use the backup/restore features.

Download HijackThis from:

HijackThis Download Site (http://www.bleepingcomputer.com/files/hijackthis.php)

Save this file into the directory you made previously and then run the program named hijackthis.exe. When the program opens click on the Config button, then click on the Misc Tools button, and click on the Check for update online button. When it completes checking/applying updates press the back button.

Now click on the Scan button and when it is finished click on the Save Log button. A Notepad window will open with the contents of this log. Click on Edit then click on Select all. Then click on Edit and then Click on Copy.

Create a reply to this post here and right click in message area and select paste to paste the log into the post.

Someone will reply to you after reading this post. DO NOT fix any entries unless you understand what you are doing.

To see a tutorial with screenshots on using HijackThis you can click on the link below:

How to use HijackThis to remove Browser Hijackers, Malware, & Spyware (http://www.bleepingcomputer.com/tutorials/tutorial42.html)