Error 0x80501001 or 0x80508206 when deleting a harmful item

[Guest]

Windws Defender found out the following item: name: RealVNC - Alert level:
medium in file:
C:\IBMTOOLS\APPS\RRPC\DATA1.CAB->(ishld#0002)->(ZipSfx)->VNCHOOKS.DLL

After running the deletion action, I got the following message: "Windows
Defender encountered an error: 0x80501001. One or more actions could not be
completed succesfully."

In the status column I got the following message: Remove failed, 0x80508026.
Windows Defender cannot remove a potentially harmful item from the contents
of an archived file."

What do I do?

 

[Guest]

Windws Defender found out the following item: name: RealVNC - Alert level:
medium in file:
C:\IBMTOOLS\APPS\RRPC\DATA1.CAB->(ishld#0002)->(ZipSfx)->VNCHOOKS.DLL

After running the deletion action, I got the following message: "Windows
Defender encountered an error: 0x80501001. One or more actions could not be
completed succesfully."

In the status column I got the following message: Remove failed, 0x80508026.
Windows Defender cannot remove a potentially harmful item from the contents
of an archived file."

What do I do?

I have the same error....can anyone help??

 

[Mike Chan [MSFT]]

This is a known issue... We have fixed this in future builds.

We try to remove these files w/o completely deleting the archive. In your
case, you should probably allow it. It looks like it detected VNC which IBM
uses. You probably want to just "always ignore"

--
Mike Chan [MSFT]
Technical Product Manager
Windows Defender

This posting provided "AS IS" with no warranties, and confers no rights.

 

[Bill Sanderson]

I agree with Mike Chan: On this specific detection, I would do an always
allow.

This is problematic in some ways: VNC is a valuable commercial (a good many
variants are free) remote control tool. In this case, it is part of a set
of tools IBM has in place on your machine for support purposes.

However, suppose you set this to always ignore?

Does that mean that some other installation of RealVNC--perhaps done by
another user of your machine for malicious purposes--might be missed?

Security is always a process--there are often not easy answers.

I'd set this to always ignore and not worry about it. If you became
paranoid at some point, you could remove it from the allowed list, and run a
scan, and see whether only this one instance was detected--and then choose.

If you never expect to need remote IBM support, you could remove it, or
leave it in quarantine, perhaps.

 

[Guest]

Hi Mike:
If this is a valid tool of IBM why Windows Defender defines it as an harmful
item?

This is a known issue... We have fixed this in future builds.

We try to remove these files w/o completely deleting the archive. In your
case, you should probably allow it. It looks like it detected VNC which IBM
uses. You probably want to just "always ignore"

--
Mike Chan [MSFT]
Technical Product Manager
Windows Defender

This posting provided "AS IS" with no warranties, and confers no rights.
--

Windws Defender found out the following item: name: RealVNC - Alert level:
medium in file:
C:\IBMTOOLS\APPS\RRPC\DATA1.CAB->(ishld#0002)->(ZipSfx)->VNCHOOKS.DLL

After running the deletion action, I got the following message: "Windows
Defender encountered an error: 0x80501001. One or more actions could not
be
completed succesfully."

In the status column I got the following message: Remove failed,
0x80508026.
Windows Defender cannot remove a potentially harmful item from the
contents
of an archived file."

What do I do?

 

[Mike Chan [MSFT]]

I should be more specific and say that we are planning to fix this in a
future release.

--
Mike Chan [MSFT]
Technical Product Manager
Windows Defender

This posting provided "AS IS" with no warranties, and confers no rights.
--

This is a known issue... We have fixed this in future builds.

We try to remove these files w/o completely deleting the archive. In your
case, you should probably allow it. It looks like it detected VNC which
IBM uses. You probably want to just "always ignore"

--
Mike Chan [MSFT]
Technical Product Manager
Windows Defender

This posting provided "AS IS" with no warranties, and confers no rights.
--

Windws Defender found out the following item: name: RealVNC - Alert
level:
medium in file:
C:\IBMTOOLS\APPS\RRPC\DATA1.CAB->(ishld#0002)->(ZipSfx)->VNCHOOKS.DLL

After running the deletion action, I got the following message: "Windows
Defender encountered an error: 0x80501001. One or more actions could not
be
completed succesfully."

In the status column I got the following message: Remove failed,
0x80508026.
Windows Defender cannot remove a potentially harmful item from the
contents
of an archived file."

What do I do?

--
Mike Chan [MSFT]
Technical Product Manager
Windows Defender

This posting provided "AS IS" with no warranties, and confers no rights.
--

 

[Mike Chan [MSFT]]

VNC is a special case - it is one of those gery area applications. It is
open source, so it is freely available. Imagine this valid scenario. A
company uses VNC to do remote administration as a part of an IT App Suite.

Imagine this invalid scenario. A spyware vendor uses VNC components to
remotely control an infected machine. Both would contain VNC components that
for the most part would be exactly the same, so the question is not "is the
software bad?" the question is, "Did you know that VNC is on your machine"
or "Do you trust IBM?"

That's the difference between spyware and viruses/worms - it's all about
intent, and programatically, you can't necessarily tell intent in all cases.

Mike

Hi Mike:
If this is a valid tool of IBM why Windows Defender defines it as an
harmful
item?

This is a known issue... We have fixed this in future builds.

We try to remove these files w/o completely deleting the archive. In your
case, you should probably allow it. It looks like it detected VNC which
IBM
uses. You probably want to just "always ignore"

--
Mike Chan [MSFT]
Technical Product Manager
Windows Defender

This posting provided "AS IS" with no warranties, and confers no rights.
--

Windws Defender found out the following item: name: RealVNC - Alert
level:
medium in file:
C:\IBMTOOLS\APPS\RRPC\DATA1.CAB->(ishld#0002)->(ZipSfx)->VNCHOOKS.DLL

After running the deletion action, I got the following message:
"Windows
Defender encountered an error: 0x80501001. One or more actions could
not
be
completed succesfully."

In the status column I got the following message: Remove failed,
0x80508026.
Windows Defender cannot remove a potentially harmful item from the
contents
of an archived file."

What do I do?

--
Mike Chan [MSFT]
Technical Product Manager
Windows Defender

This posting provided "AS IS" with no warranties, and confers no rights.
--