Remove WinRecon. Description and removal instructions

 
Title: WinRecon

Type: Keyloggers
Severity scale:WinRecon severity is 67  (67 / 100)
 
WinRecon is a commercial keylogger that tracks user Internet activity, logs all keystrokes, takes screenshots and records passwords. It saves gathered data into encrypted file or sends it out to a predefined e-mail address. WinRecon must be manually installed.


WinRecon properties:
• Takes and sends out screenshots of user activity
• Sends out logs by FTP or email
• Logs keystrokes
• Hides from the user
• Stays resident in background

Automatic WinRecon removal:

remover for WinRecon

WinRecon manual removal:

Kill processes:
dataview.exe, codex.exe, condex.exe, sp5.exe, winrecon.exe
Delete registry values:
HKEY_LOCAL_MACHINE\SOFTWARE\Arboc
HKEY_LOCAL_MACHINE\SOFTWARE\Gentee\Paths\WinRecon [XVS]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\kpsc.kpscEnc
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\kpview1.kpview
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3B7C8860-D78F-101B-B9B5-04021C009402}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3EDF892D-D60F-4E94-83BC-A93BC4C91D1D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{78E5A540-1850-11CF-9D53-00AA003C9CB6}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AFC634B0-4B8B-11CF-8989-00AA00688B10}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B617B991-A767-4F05-99BA-AC6FCABB102E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3065315-1D2C-4992-8F24-57FEF0E1DCB5}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{09D14D02-1C28-4EA5-9D34-101E6A1C688F}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3B7C8862-D78F-101B-B9B5-04021C009402}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4008A442-D2E8-4A64-8BBA-F145CA9D60C9}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{859321D0-3FD1-11CF-8981-00AA00688B10}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D0E090C1-F267-4152-B718-EFB01B139522}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3DE1EFF-67BA-4317-89D7-BB60FC26E414}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E9A5593C-CAB0-11D1-8C0B-0000F8754DA1}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{ED117630-4090-11CF-8981-00AA00688B10}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{1CA5F9A1-DA0A-4C31-8C7F-81B497EAD912}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3B7C8863-D78F-101B-B9B5-04021C009402}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F2DDA1D5-C5A2-4149-9D82-3B7ABE4CB411}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\TypeLib\(Default)={BDC217C8-ED16-11CD-956C-0000C04E4C0A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\TypeLib\(Default)={BDC217C8-ED16-11CD-956C-0000C04E4C0A}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinRecon
Delete files:
dataview.exe, codex.exe, condex.exe, sp5.exe, winrecon.exe, kpaccess.dll, kpsc.ocx, kpview.ocx
Misc:
[XVS] is the version number or name.

Exact file location:
dataview.exe, codex.exe, condex.exe, sp5.exe, winrecon.exe - C:\Program Files\WinRecon
kpaccess.dll, kpsc.ocx, kpview.ocx - C:\Windows\System, C:\Windows\System32 or C:\Winnt\System32

Other programs to remove WinRecon:

• Malwarebytes Anti Malware - Review - Download
• Malwarebytes Anti Malware - Review - Download
• Windows Defender - Review - Download

Information added: 19/03/04
Information updated: 17/09/05

Additional resources related to WinRecon:

Attention: If you know or you have a website or page about WinRecon removal, feel free to add a link to this list: add url




more resources

Post Comment:

Attention: Use this form only if you have additional information about WinRecon parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.



Enter security code:

Latest spyware news:
Similar parasites: