Removing Rake Back Calculator Trojan

Email Address:

In December 2005 a rake back website (we wont mention any names) cut corners and used an underhanded programmer to create a rake tracker. The rake calculator (known as rbcalc, rbcalc.exe) was an executable file that a player would run on his machine to calculate rake from hands he previously played (stored in hand history files or a poker tracker database).

It has recently come to light that early versions of this program contained a virus that installs itself every time the user runs rbcalc. The virus goes undetected by Norton AntiVirus and Microsoft Defender, even to this day. If you have ever used rbcalc please read the following to check if the malicious software is on your machine and how to remove it. This virus could also come bundled with other poker applications, so please read the following even if you have never heard of rbcalc.

Open up your C:\Windows\System32\ directory. Look for the following files…

\WINDOWS\system32\d3dclsrv.dll

\WINDOWS\system32\ndsdavsrv.sys

\WINDOWS\system32\comclg32.dll

\WINDOWS\system32\utlsrv.exe

Please note that these files have VERY similar names to system files needed by Windows. This is because they want you to believe these files are important. You are only infected if these file names are EXACTLY the same as above.

If you notice these files then it is safe to assume you are infected. To remove these please delete the following:

\WINDOWS\system32\d3dclsrv.dll

\WINDOWS\system32\ndsdavsrv.sys

\WINDOWS\system32\comclg32.dll

Then open the registry (START > RUN > type ‘regedit’). In the folder view on the right please open up the following path:

HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ndsdavsrv

In that folder you will see the following:

ImagePath=\??\C:\WINDOWS\System32\ndsdavsrv.sys – Delete this entry.

Reboot your machine.

Go back to the registry (START > RUN > type ‘regedit’) and open the following path:

HKEY_LOCAL_MACHINE\ Software\Microsoft\Windows\CurrentVersion\Run

You will see the following key.

Comclg32=C:\WINDOWS\System32\utlsrv.exe /Comclg32.dll – Delete that entry.

Now bring up your Task Manager (CTRL+ALT+DEL, click the Processes tab). Look for the program utlsrv.exe and right click on it and select End Process.

Open the C:\Windows\System32 folder and find the file utlsrv.exe. Delete it.

CHANGE ALL OF YOUR POKER SITE PASSWORDS!

Delete all instances of rbcalc (RBCalc.exe)

Your machine should now be rid of this malicious software!