Multiple Programs – WINSHELL.DAT, WINSHELL.EXE

Winshell.dat AntiCrash/SpeedUpMyPC by UniBlue. You can find more information on that at: http://www.liutilities.com/products/speedupmypc/whitepapers/paper3/ If you have this software installed and if you run WinPatrol 10.x or later, it's normal to have winshell.dat in your list of Hidden Files.

Winshell.exe is the executable for a telnet server by Janker.org. It includes password protection, and multi-user login. In most cases, it installs with the Backdoor.WinSHell.50 Trojan. It can run in the background without calling attention to itself. It has a built-in installer and remover. It can reboot/shutdown your system and can download/execute files. And it can be terminated remotely.

Unless you installed this file intentionally, we'd recommend removing it using WinPatrol. First, kill it under Active Tasks then remove it from your Startup Programs. If running WinPatrol 8.x or later, right click each file then select "Delete file on Reboot".

More information can be found at http://securityresponse.symantec.com/avcenter/venc/data/backdoor.winshell.50.html.

A removal tool can be found at http://securityresponse.symantec.com/avcenter/venc/data/backdoor.winshell.50.removal.tool.html.

Virus

Remove