winkkc.exe, is this a virus?

[zzyzzx]

I found it in my Windows/system directory and it was automatically running at startup. I could not find any reference to it anywhere (I checked Yahoo, Usenet, and McAfee and Symantec websites.)

[devinemi83]

Try to right click it and see if it has properties, I searched and found nothing, its not on my machine. It may come from a piece of software you have. Try to shut it off and see if everything works. If suddenly one thing stops working, it was probably using it.

[ChrisX]

I don't think this is a virus. I've checked this out on my Norton AntiVirus' alpha list of all known virus. Not there, no winkkc.exe.

[jeex]

it must be some program you installed. its not on google, the microsoft knowledgebase, or on my computer (xp pro).

[zzyzzx]

I didn't get a new "system" file by NOT installing new software. Plus it was always starting up on startup (I always check what's running in background before I do a vidcap, and that's how I keep finding these things). I'm more inclined to think it's a new virus. I'm thinking of emailing it so some of the virus scan manufacturers and see if they respond.

[devinemi83]

Like I said, shut it down. See if all goes well.

[ataraxia]

Yes, it is the trojan app loaded by the W32.Klez.E@mm. I just happen to remember this since I had to remove it from a client's PC the other day.
Just another variant.. sends out forged emails using the smtp server, etc, etc...

It actually can be wink???.exe since the ??? are rancom characters.

I know that you searched on symantec's site. I did too when I ran across it. No, I don't know why it doesn't substring search and catch the wink part. You can do the search again there for wink and you will see.

Or, here is the link:

http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.e@mm.html

There are instructions there for cleanup, as well as a removal tool. Best of luck!

-ataraxia

[zzyzzx]

Thanks! That certainly explains why I got no hits for winkkc.exe