calc.exe / packager.exe WORM???

Latest Articles

calc.exe / packager.exe WORM???
Page 1, 2 Next

Downsizer Forum Index -> IT Matters

Author

Message

Blue Sky

Joined: 30 Jan 2005
Posts: 7658
Location: France

Posted: Sat May 28, 05 7:16 am Post subject: calc.exe / packager.exe WORM???

Has anybody had problems with these two instances running in task manager? I have tried a search and cannot come up with much in the way of results. Calc.exe is obviousely windows, calculator but apparently it can be hijacked and used to hide spyware. When I kill "end task" one the other one re-appears.

Somebody HELP please.

I will post again if I find a removal procedure. In the mean time - be warned.

footprints

Joined: 26 May 2005
Posts: 234
Location: North Wales

Posted: Sat May 28, 05 7:29 am Post subject: Calc spyware.
To remove spyware I would recomend using something like adaware. This software scans EVERYTHING for spyware etc and I have always found it to be the business. If you are running a popup stopper like Stopzilla it will also spot and give you the option to remove unwanted spyware.

jema
Downsizer Moderator

Joined: 28 Oct 2004
Posts: 28143
Location: escaped from Swindon

Posted: Sat May 28, 05 7:37 am Post subject:
There is also "spybot search and destroy" This does seem to be a bit better than adaware last time I was cleaning a system. Frankly if you are infected I would not try and economise on cleaning. I would use both of these to be doubly sure.

footprints

Joined: 26 May 2005
Posts: 234
Location: North Wales

Posted: Sat May 28, 05 7:48 am Post subject: Spybot s&d
Thanks for the link to spybot.

Blue Sky

Joined: 30 Jan 2005
Posts: 7658
Location: France

Posted: Sat May 28, 05 9:11 am Post subject:
Yes, thanks also for the advice both of you. Much appreciated. Just found another one on my system called "ceres". Pain in the butt they are!

jema
Downsizer Moderator

Joined: 28 Oct 2004
Posts: 28143
Location: escaped from Swindon

Posted: Sat May 28, 05 6:37 pm Post subject:
Coincidentally I tried to sert an infected PC today and niether adaware or SpyBot got rid of a bit of malware attached to interent explorer. So the system only stays clean if you do not run explorer Installed Firefox as a replacement, don't know what else I could do

alison
Downsizer Moderator

Joined: 29 Oct 2004
Posts: 12918
Location: North Devon

Posted: Sat May 28, 05 7:40 pm Post subject:
I have been getting a lot of german e mails recently. Is there any thing in these that will be a virus, as I just dump them.

jema
Downsizer Moderator

Joined: 28 Oct 2004
Posts: 28143
Location: escaped from Swindon

Posted: Sat May 28, 05 8:02 pm Post subject:

alison wrote:

I have been getting a lot of german e mails recently. Is there any thing in these that will be a virus, as I just dump them.

Just delete them, probably just spam.

footprints

Joined: 26 May 2005
Posts: 234
Location: North Wales

Posted: Sat May 28, 05 8:22 pm Post subject: Malware

jema wrote:

Coincidentally I tried to sert an infected PC today and niether adaware or SpyBot got rid of a bit of malware attached to interent explorer.

So the system only stays clean if you do not run explorer

Installed Firefox as a replacement, don't know what else I could do

I too dumped IE quite a while ago. I did read somewhere that a lot of malicious garbage is written and targeted at microsofts browser. The advice which I found to be good was to not use IE and avoid all the hassle. ( when I signed for broadband IE was hijacked by the ISP!)

I too loaded firefox, but before I had chance to get to know it, I was completely seduced by Opera. If you haven't yet had a play with Opera and its integrated mail client, you could be missing something.
It is very customisable, and has an army of fans that design skins etc My favourite skin is currently Neo.

Though a complete tart for a tasty bit of software, I am pretty sure that it will be a while before another browser will catch my eye like Opera did

Blue Sky

Joined: 30 Jan 2005
Posts: 7658
Location: France

Posted: Sat May 28, 05 8:49 pm Post subject:

Yes, good old Opera.

I remember now that some years ago (when I had my business in the UK) we had a similar sort of problem with IE and I opted to use Opera instead. What a wonderful browser it was (and I'm sure it still is). I used it until I replaced my main PC and then - as Windows XP was just out I reverted to IE 'cos it was pre-loaded and easier.

Opera is good tho' and I would highly recommend it to anyone suffering the hassle that we are currently on with.

I, myself will persevere with sorting out my IE problem tho' before I will give in to these "adware hackers". There has to be a way to deal with it and stubborn troll that I am I will find it!

Nobody tampers with my system and gets away with it

frostfyre
Guest

Posted: Mon Jun 13, 05 11:50 am Post subject: A fix for this problem

You can fix it yourself by following these steps.

1. Under internet options, clear your cookies, temp files, and history.

2. calc.exe and packager.exe are not spyware. find the filename in your process list and do a search for it. if you get a windows explorer crash warning, ignore it.

3. the file will be in c:\windows\system32

4. delete the Prefetch call for it. this will be in the results. then highlight the offender and rename it. it will appear to have not changed names. ignore this. re-search for what you've named the file to.

5. highlight the file, and delete it. then, under your process manager, kill the process. it will sucessfully shut down and not restart because its going to try to restart a non-existant file.

6. problem solved.

Visit www.frostmud.com for more spyware help.

Blue Sky

Joined: 30 Jan 2005
Posts: 7658
Location: France

Posted: Tue Jun 14, 05 4:02 am Post subject:

Thanks for the advice Frostfyre.

Your suggestion was very welcome but the files "calc.exe" and "packager.exe" (although windows system files) can be hyjacked by adware/spyware which seems to be what has happened here. I am still working on removing them but recently they are not the worst of our worries.

We now have a file running in task manager called "crsreco" which shuts my browser down every few minutes. This is very annoying indeed. Any ideas???

No hits on google as yet.

tawny owl

Joined: 29 Apr 2005
Posts: 563
Location: Hampshire

Posted: Tue Jun 14, 05 9:04 pm Post subject: Re: Malware

Footprints wrote:

I too loaded firefox, but before I had chance to get to know it, I was completely seduced by Opera. If you haven't yet had a play with Opera and its integrated mail client, you could be missing something.

I tried both, and I must admit, I prefer Firefox. Each to their own, eh? I run both Adaware and Spybot, as often one will pick up something the other doesn't. Spybot also 'immunizes' your PC against any known ones coming in. I also run Microsoft Antispyware. It's only a beta version at them mo, but is free from the M$ website. If you have real problems with spyware, it would be worth looking at the paid-for ones such as Spydoctor, which often have a time-limited free version available. Obviously, none of these will be of any use if not updated and run regularly (I run them at least once a week, and the M$ one every day because it's got an automatic scheduler), and of course, you need to make sure your firewall (something other than just the XP one) is updated and stopping them getting onto the PC in the first place.

Blue Sky

Joined: 30 Jan 2005
Posts: 7658
Location: France

Posted: Fri Jun 17, 05 9:01 pm Post subject:

Problem solved at last! ..... we hope

I was directed towards a free download by a friend:

https://www.grisoft.com/doc/1

AVG antivirus software by Grisoft. Well worth the download. It is free for 30 days and then costs about 30 dollars (US) which I am sure I will be investing in. The software found three "Trojan" viruses on my system and has cleared them all. Computer now seems to be running as normal again (he says - touching wood). No pop-up ads, no unexpected shut-downs and no adware so far.

I can highly recommend this software to anyone who is suffering the problems that we have been in the last few weeks.

Simon

culpepper

Joined: 16 Dec 2004
Posts: 638
Location: Kent

Posted: Sat Jun 18, 05 4:49 pm Post subject:

I had AVG on mine a while back.It was excellent.
There is a web site run by trend micro which will scan your PC and tell you of problems aswell.Useful if you are connecting to the web just to download a free virus scanner and your running IE.When I first got mine running I did this and got 3 virii immediately.
I now have my firewall and virus scanner backed up to disc so I dont have to download them to a clean install.

	Downsizer Forum Index -> IT Matters	All times are GMT Page 1, 2 Next
Page 1 of 2

View Latest Posts