BleepingComputer.com: Unknown Program: Wisecustomcalla.exe

I run Windows XP SP2 on a Dell Dimension 2400 with Intel inside Pentium 4

I just installed ZoneAlarm a few days ago in preparing for a HIjack this log which I'm still working towards getting ready for, and the program page has two entries for WiseCustomCalla.exe .

The file name for both of these are C/:Windows/a large string of numbers and letters.TMPWiseCustomCalla.exe One file name has the part after the TMP all in capital letters. The slashes of course are in the other direction, and the set of numbers and letters between Windows and TMP are different. Both files are 118 KB, and ZoneAlarm states that they were both modified on the 17th of this month with a 4 minute gap between the modifications of the two files.

What does this program do? Is it needed? What is it connected to? I cannot find it in the glossary or file database on this site. Should I get rid of it? If so, how? I cannot find the program using Search, so I do not know what folder it is in or if it is in a folder.

Orange Blossom

p.s. Oh my, I was tired when I first wrote this. I have rearranged the first sentence so it makes sense now.

This post has been edited by Orange Blossom: 19 July 2006 - 09:05 PM

By any chance have you ever had McAfee VirusScan version 4.5.0 by Network Associates, Inc on your machine?

Da Bleepin AniMod, Animal

I don't think so, but there is a slight possibility . I was trying out several different antivirus products last year and I may have forgotten about this one. I've had AVG7, Symantec AntiVirus CE 10.1.0.401 and earlier versions, and Cyberscrub Antivirus which uses the Kaspersky engines. I have uninstalled all of these, the Symantec last week when I installed ZoneAlarm, and all have left bits behind.


I also had PreEmpt put out by PivX and PivX Preview which I just uninstalled. The latter program apparently is no longer supported, and the previous has not had updates for a long time. The company has just changed ownership. These programs probably have bits left over too.

Are there other possibilities of what the WiseCustomCalla may be from or with?

Orange Blossom

Unfortunately all I am able to find is Wisecustomcalla.dll is part of McAfee VirusScan version 4.5.0. I can not find anything about the .exe though. I was hoping that would give us a clue or a trail to follow. But I am not very convinced of that, now. There is so little that I am able to find. Hopefully someone else will have more information for you.

Be (Grasping at Straws) Safe

Da Bleepin AniMod, Animal

Your idea was great, and there is a chance that I had tried out the McAfee for a few days about a year ago, possibly more. I'm not sure - too long ago, and I was focused on student teaching and graduate school.

But it is curious - where did the .exe part come from if indeed it was from McAfee?

Orange Blossom

Hello:

I noticed the same thing this morning - I installed Anonymizer yesterday - and then removed it (I thought!) Obviously, the file(s) your talking about stayed behind - I had three of them!!

Sparky

Bingo! Thanks for posting this! I had installed and removed Anonymizer twice - trying to get it to stop loading every time I started up. I thought maybe it had to do with it being a spy program. Finally discovered why I couldn't was related to my AdWatch settings: I had to disable its protection of the startup menu; otherwise, it kept returning a registry key to the run folder even when the program was uninstalled and deleted. I manually deleted the key, at least 50 times Grrrrr!

Anyway, I just installed it again to see if indeed these programs were related to Anonymizer, this time with the program list on ZoneAlarm opened. I had removed WiseCustomCalla.exe and the WISECUSTOMCALLA.EXE from the program list some days ago.

The Anonymizer version I'm trying out installs in two stages since there are two parts. When the first part - Anonymizer - installs, WISECUSTOMCALLA.EXE appears in the program list, and when the second part - Anonymous Surfing - installs, WiseCustomCalla.exe shows up. I think these two are only used in the installation process. I haven't restarted the computer yet, and right now a search reveals them in prefetch, though oddly there they are both in large caps. It will be interesting to note if they disappear when I restart, and if not if they will disappear when I clean out my temp. files

Note: Programs in ZoneAlarm's program list will not automatically go away from the list when you uninstall and delete them or just uninstall them. You have to manually remove them from the list. Right click on the program name and click on "remove."

Once again, thanks for your post. It's nice to have that mystery solved!
Orange Blossom

The information I google is that wisecustomcalla.exe is part of the MyWebSearch toolbar which is Spyware.

View the following link:
http://fileinfo.prevx.com/QQ3f7219462574-W...MCALLA.EXE.html

I have never had that toolbar on my computer. Note that those files both appeared in my ZoneAlarm program list when I was in the process of installing Anonymizer as you can see from reading post #7.

This is another piece of evidence that malware will have legitimate names but will generally have different file paths. If you compare the file path I listed in the first post, you will see that my files had completely different file paths and had TMP before the WiseCustomCalla.exe part unlike what your link states.

Thanks for the info. about the malware version.

Orange Blossom