whenU.saveNow Error!

[TCW]

Windows Defender version: 1.1.1051.0
Engine version: 1.1.1186.0
Signature version: 1.13.1282.6

When I do a deep scan, WD finds the "whenU.saveNow" ad generator. When I
tell WD to remove this adware, it fails with error 0x80004005.

Anyone seen this one before?

Tom

 

[Guest]

Hello TCW,

First remove all temporarily junk with CCleaner
http://www.ccleaner.com
Then try Ewido for removal, also to ping point the locations:
http://www.ewido.net/en/download/

http://safety.live.com/site/en-US/default.htm

Submit it via the process noted in Windows Defender Help, or here:
Report a possible spyware problem to Microsoft
http://www.microsoft.com/athome/security/spyware/software/support/reportspyware.mspx

Еиςеl

 

[Bill Sanderson]

Find the system event log message detailing what is found and where.

See if you can remove it by hand, or whether it is in some location such as
an antivirus quarantine, or the system recycler folders, that is not
accessable for deletion by Windows Defender. See if you can delete it
manually, perhaps at a command prompt.

dir /x is useful for dealing with long folder names. For hidden folders,
you just need to do rd thusandsuch, and type the name correctly.

 

[TCW]

Find the system event log message detailing what is found and where.

See if you can remove it by hand, or whether it is in some location such
as an antivirus quarantine, or the system recycler folders, that is not
accessable for deletion by Windows Defender. See if you can delete it
manually, perhaps at a command prompt.

dir /x is useful for dealing with long folder names. For hidden folders,
you just need to do rd thusandsuch, and type the name correctly.

BINGO! The file is on a hidden harddrive partition. It's the Dell "restore"
partition. Since I'll never use this restore, I can just ignore it. I'll get
rid of it when/if I ever do a fresh OS install.

Thanks Bill.

Tom

 

[Bill Sanderson]

Good! I know they hope to refine these error messages further.

I'm slightly intrigued though by that location--probably an accident, rather
than intentional on the part of the spyware.

--