Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Unknown Program: Wisecustomcalla.exe


  • Please log in to reply
8 replies to this topic

#1 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 32,873 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:12:37 AM

Posted 19 July 2006 - 04:28 AM

I run Windows XP SP2 on a Dell Dimension 2400 with Intel inside Pentium 4

I just installed ZoneAlarm a few days ago in preparing for a HIjack this log which I'm still working towards getting ready for, and the program page has two entries for WiseCustomCalla.exe .

The file name for both of these are C/:Windows/a large string of numbers and letters.TMPWiseCustomCalla.exe One file name has the part after the TMP all in capital letters. The slashes of course are in the other direction, and the set of numbers and letters between Windows and TMP are different. Both files are 118 KB, and ZoneAlarm states that they were both modified on the 17th of this month with a 4 minute gap between the modifications of the two files.

:thumbsup: What does this program do? Is it needed? What is it connected to? I cannot find it in the glossary or file database on this site. Should I get rid of it? :flowers: If so, how? I cannot find the program using Search, so I do not know what folder it is in or if it is in a folder.

Orange Blossom

p.s. Oh my, I was tired when I first wrote this. I have rearranged the first sentence so it makes sense now.

Edited by Orange Blossom, 19 July 2006 - 09:05 PM.

Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SuperAntiSpyware, SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript


BC AdBot (Login to Remove)

 


#2 Animal

Animal

    Bleepin' Animinion


  • Site Admin
  • 25,926 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Where You Least Expect Me To Be
  • Local time:09:37 PM

Posted 19 July 2006 - 05:42 PM

By any chance have you ever had McAfee VirusScan version 4.5.0 by Network Associates, Inc on your machine?

Da Bleepin AniMod, Animal

The Internet is so big, so powerful and pointless that for some people it is a complete substitute for life.
Andrew Brown


Posted Image


A learning experience is one of those things that say, "You know that thing you just did? Don't do that." Douglas Adams.


"Imagination is more important than knowledge. Knowledge is limited. Imagination circles the world." Albert Einstein (1879-1955)


Follow BleepingComputer on: Facebook | Twitter | Google+


#3 Orange Blossom

Orange Blossom

    OBleepin Investigator

  • Topic Starter

  • Moderator
  • 32,873 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:12:37 AM

Posted 19 July 2006 - 09:02 PM

I don't think so, but there is a slight possibility :thumbsup: . I was trying out several different antivirus products last year and I may have forgotten about this one. I've had AVG7, Symantec AntiVirus CE 10.1.0.401 and earlier versions, and Cyberscrub Antivirus which uses the Kaspersky engines. I have uninstalled all of these, the Symantec last week when I installed ZoneAlarm, and all have left bits behind. :flowers: :trumpet:


I also had PreEmpt put out by PivX and PivX Preview which I just uninstalled. The latter program apparently is no longer supported, and the previous has not had updates for a long time. The company has just changed ownership. These programs probably have bits left over too.

Are there other possibilities of what the WiseCustomCalla may be from or with?

Orange Blossom

Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SuperAntiSpyware, SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript


#4 Animal

Animal

    Bleepin' Animinion


  • Site Admin
  • 25,926 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Where You Least Expect Me To Be
  • Local time:09:37 PM

Posted 19 July 2006 - 10:42 PM

Unfortunately all I am able to find is Wisecustomcalla.dll is part of McAfee VirusScan version 4.5.0. I can not find anything about the .exe though. I was hoping that would give us a clue or a trail to follow. But I am not very convinced of that, now. There is so little that I am able to find. Hopefully someone else will have more information for you.

Be (Grasping at Straws) Safe

Da Bleepin AniMod, Animal

The Internet is so big, so powerful and pointless that for some people it is a complete substitute for life.
Andrew Brown


Posted Image


A learning experience is one of those things that say, "You know that thing you just did? Don't do that." Douglas Adams.


"Imagination is more important than knowledge. Knowledge is limited. Imagination circles the world." Albert Einstein (1879-1955)


Follow BleepingComputer on: Facebook | Twitter | Google+


#5 Orange Blossom

Orange Blossom

    OBleepin Investigator

  • Topic Starter

  • Moderator
  • 32,873 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:12:37 AM

Posted 20 July 2006 - 09:17 PM

Your idea was great, and there is a chance that I had tried out the McAfee for a few days about a year ago, possibly more. I'm not sure - too long ago, and I was focused on student teaching and graduate school.

But it is curious - where did the .exe part come from if indeed it was from McAfee?

Orange Blossom

Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SuperAntiSpyware, SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript


#6 TheArtfulDodger

TheArtfulDodger

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:05:37 AM

Posted 30 July 2006 - 06:33 AM

Hello:

I noticed the same thing this morning - I installed Anonymizer yesterday - and then removed it (I thought!) Obviously, the file(s) your talking about stayed behind - I had three of them!!

Sparky

#7 Orange Blossom

Orange Blossom

    OBleepin Investigator

  • Topic Starter

  • Moderator
  • 32,873 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:12:37 AM

Posted 30 July 2006 - 08:39 AM

Bingo! :thumbsup: Thanks for posting this! :cool: I had installed and removed Anonymizer twice - trying to get it to stop loading every time I started up. I thought maybe it had to do with it being a spy program. Finally discovered why I couldn't was related to my AdWatch settings: I had to disable its protection of the startup menu; otherwise, it kept returning a registry key to the run folder even when the program was uninstalled and deleted. I manually deleted the key, at least 50 times Grrrrr! :flowers:

Anyway, I just installed it again to see if indeed these programs were related to Anonymizer, this time with the program list on ZoneAlarm opened. I had removed WiseCustomCalla.exe and the WISECUSTOMCALLA.EXE from the program list some days ago.

The Anonymizer version I'm trying out installs in two stages since there are two parts. When the first part - Anonymizer - installs, WISECUSTOMCALLA.EXE appears in the program list, and when the second part - Anonymous Surfing - installs, WiseCustomCalla.exe shows up. I think these two are only used in the installation process. I haven't restarted the computer yet, and right now a search reveals them in prefetch, though oddly there they are both in large caps. It will be interesting to note if they disappear when I restart, and if not if they will disappear when I clean out my temp. files

Note: Programs in ZoneAlarm's program list will not automatically go away from the list when you uninstall and delete them or just uninstall them. You have to manually remove them from the list. Right click on the program name and click on "remove."

Once again, thanks for your post. It's nice to have that mystery solved! :trumpet:
Orange Blossom :inlove:

Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SuperAntiSpyware, SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript


#8 weatherman

weatherman

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:11:37 PM

Posted 16 November 2006 - 09:43 AM

The information I google is that wisecustomcalla.exe is part of the MyWebSearch toolbar which is Spyware.

View the following link:
http://fileinfo.prevx.com/QQ3f7219462574-W...MCALLA.EXE.html

#9 Orange Blossom

Orange Blossom

    OBleepin Investigator

  • Topic Starter

  • Moderator
  • 32,873 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:12:37 AM

Posted 23 November 2006 - 12:57 PM

I have never had that toolbar on my computer. Note that those files both appeared in my ZoneAlarm program list when I was in the process of installing Anonymizer as you can see from reading post #7.

This is another piece of evidence that malware will have legitimate names but will generally have different file paths. If you compare the file path I listed in the first post, you will see that my files had completely different file paths and had TMP before the WiseCustomCalla.exe part unlike what your link states.

Thanks for the info. about the malware version.

Orange Blossom :thumbsup:

Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SuperAntiSpyware, SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users