Can't delete items found by WD

G

Guest

WD identified some spyware/adware on my machine the other day and when I tell
it to "Remove" or "Quarantine" I get an error message that says:

"Windows encountered an error: 0 x 80501001. One or more actions could be
completed successfully. Do you want details of this error?"

When I click "yes" I get the "history" window opens showing multiple
instances of the offending programs, specifically:
Software Bundler:Win32/KaZaA
TrojanDownloader:Win32/WebP2PInstaller

It has the date and a message in the right hand column that states an error
was encountered. I've gone to the bottom of the "frame" for more details,
clicked on the links that tell you what to do, followed those instructions
and still can't get rid of these messages. Problem this is creating is that
I ALWAYS have an "!" (exclamation point) on my WD icon in the system trary,
which basically makes using WD useless. Any ideas or suggestions would be
greatly appreciated.

Sincerely,

Jeff Bue
Newark, Texas
 
G

Guest

Hello Jeff,

This error will occur if a threat is detected inside of a container such
as a
ZIP file, RAR archive, etc.

The "remove" action cannot (in most cases) be applied to an object inside of
such containers, without deleting the entire container.

The issue is that you may have a ZIP file with tons of non-malicious file
in it, but one or more "bad" files as well that are detected.

For now you can check if the ZIP file has anything else inside of it that
you want to keep. If not, just delete the ZIP file yourself and you will have
removed the threat.

If you really want to keep the ZIP file around but do not want to see this
error gain, you can disable scanning inside archives. Clear the checkbox for
"Scan inside archives" in the Tools section under the Options menu.
Generally, threats inside archives, while good to know about, are not
"active", meaning they can't do anything bad to your system while inside the
archive.

Open Disk Cleanup via Start, Programs, Accessories, System Tººls.
It will scan the system first. Click the More Options tªb.
Now click the Clean up button under System Restºre.
This will remove all but the most recent restore pºint.

For the benefit of the community reading this post, please rate the pºst.

I hope this post is helpful.

Let us know how it works ºut.

Еиçеl
--



LAW
Man do not make laws. They do but dscover them. -----Calving Coolidge
 
G

Guest

Hi Jeff,

FYI

Known issues

Windows Defender might prompt you to remove some peer-to-peer (P2P)
file-sharing programs. If you choose to remove such a program, Windows
Defender deletes all the contents of the Program Files folder associated with
the P2P program. Because some P2P programs store downloaded files in a
default folder under Program Files, this might remove all files you have
downloaded through the file-sharing program. For example, KaZaA stores .exe
and .dll files at C:\Program Files\Kazaa. Downloaded files are stored at
C:\Program Files\Kazaa\My Shared Folder. If you use Windows Defender to
remove KaZaA, all files and folders under C:\Program Files\Kazaa are removed.
If you have installed any P2P file-sharing programs, it is a good idea to
back up your downloaded files before you run Windows Defender.

http://www.microsoft.com/athome/security/spyware/software/about/releasenotes.mspx
-- --

What is Adware?

Adware is software designed to track your usage patterns and display
targeted ads while you are using a free software package or while browsing
the web with a helper application you installed. The ads may appear inside
the application or may pop-up in separate windows. Either way, these ads are
based on information that has been gathered from your usage patterns and sent
to a server for storage and analysis. Typical applications include a program
like Kazaa that many users download and install without really reading the
license agreement (EULA) -- see, for example, Kazaa's Ad Support statement.


Watch what you download!

Many freeware programs, and P2P programs like Grokster, Imesh, LimeWire,
Bearshare, Grokster, KaZaA, and WinMX, Emule, eDonkey, etc. and others are
amongst the most notorious, come with an enormous amount of bundled spyware
that will eat system resources, slow down your system, clash with other
installed software, or just plain crash your browser or even Windows itself.
If you insist on using a P2P program, please read This Article written by
Mike Healan of Spywareinfo.com fame.

http://www.spywareinfo.com/articles/p2p/

It is an updated and comprehensive article that gives in-depth detail about
which P2P programs are "safe" to use.

File-Swapping - Another common security breach is the practice of P2P file
swapping. Basically, people could connect to a special network and swap
files with each other.
Music files in the popular mp3 format are the most commonly traded, but any
file can be swapped, such as movies and pirated commercial software.

You should know that if you are file-swapping, your computer's security is
breached. File-swapping programs create a "Shared Folder" on your hard drive
where you put the files you wish to make available to others. If you enable
file sharing of one folder, your entire hard drive is open to the world. If
you use your computer for business or have important personal information on
it, those files are potentially compromised, along with all your passwords.
Additionally, you take the chance of downloading some sort of malware with
your mp3's. Trojan horses and viruses have already been found in the KaZaA
and LimeWire programs. If you decide to participate in file-swapping, be
aware of the risks. You are basically bringing a file into your computer and
you have no idea whether the computer it came from is clean (virus-free),
whether the file-swapper you got it from is malicious or not. The best thing,
aside from refraining from file-swapping, is to use a separate dedicated
computer containing no important data. A separate hard drive is not a good
solution, because it is vulnerable to infection from the main drive. There
are now many legitimate places to download music, such as iTunes, Real's
Rhapsody, and even Napster which has reinvented itself as a legal download
service.
-- --

Please check Windows Defender's quarantine area to see whether the songs
have been quarantined.

If they have, you can restore them from the quarantine. Tools, quarantined
items.
--


Tools, spyware scan, manage spyware quarantine.

If this reads "there are currently no spyware threats in your spyware"

you are probably out of luck.

If it shows what you want, check off the items, and choose to unquarantine.

There are several processes here which may take a long time--perhaps hours:
One is the appearance of the list of items in the quarantine management
screen. If this screen is completely blank, leave it up there--go away, do
something fun--and check back on it later--maybe even overnight.

If the stuff appears, I'm unclear how long the unquarantine process takes,
once checked and initiated.

Once you've unquarantined the music, I STRONGLY recommend moving it to a
non-standard location--maybe under My Music, for example. We haven't seen
these reports for awhile, but there have been regular reports in the past of
loss of the files after the next reboot, in this kind of situation. So move
it before rebooting.

There have definitely been reports of success in removing large volumes of
music from quarantine, and quarantine is now the default action for these
files--so I believe you have a good chance. Folks who have interrupted the
process of moving the files INTO quarantine, and thus preventing creation of
the index for these files, have had no success.

The files are in a quarantine subfolder of \program files\microsoft
antispyware, and are renamed--i.e. if you name them back xxx.mp3, they will
play. However, although in theory there are command line apps to extract
the titles from the files, and allow you to use that info to rename the
files, I've not heard from anyone who succeeded in going that route.

Good luck

Watch what you download! and from where.
--


LAW
Man became free when he recognized that he was subject to law. -----Will
Durant
 
G

Guest

Hi Engel,
I have the same problem as Jeff, i tried all the the items you listed but it
keeps coming back. I do not have a file or used Kaza or have any peer to peer
software. I also do not have any zipped files i deleted them all.
The only way i can get the WD icon out of my system tray is tell WD to
ignore the items. But then they come back on the next boot up. This is
driving me nuts.

Pedro, Canada.
 
G

Guest

Hi Pedro,

It seems possible that your Windows installation has been deliberately
damaged by the trojan so as to prevent you removing the trojan.

Your first priority must be to cleanse your PC of all malware. as it is
being subverted by malware.
--

Update both Windows Defender and your anti virus applicªtion.
--

In safe mode, some of the protective services which these programs use to
ensure that they aren't removed, are not running, so they are easier to
remºve.

Getting into Windows Safe Mode.

http://www.computerhope.com/issues/chsafe.htm

Shut down the computer and turn off the power.

Wait for at least 30 seconds, and then restart the computer in Safe mode or
VGA mºde.
--

Enable Hidden Files and folder's.

To enable hidden files and folders Go to task bar, click Start > My Computer.
On the Tools menu, click Folder Options.
On the View tab, uncheck Hide file extensions for known file types.
Make sure that 'Show hidden files and folders' is enabled.
Display the contents of system folders' is checked & 'Hide extentions for
known file types' is not checked then press ªpply.

You can set this back later by opening the same page and pressing 'restore
defaults' then pressing ªpply,

HOW TO Enable Hidden Files:
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339
--

In Safe Mode
You can clear prefetch files by going to Start menu and Run and typing

prefetch

and then click OK.

Remove the content of the folder Prefetch

The problem is that many spyware/malware/virus/Trojan (you get the idea)
writers use it to cause their programs to get respawned the moment you launch
the app whose prefetch data is linked to the code placed there by the
infection.
--

Open a Internet window and go to Internet Options, Delete Cookies and Temp
Files, and included all off line content.

Then also go to Start menu and Run and type (with %)

%temp%

and clear the files in that fºlder. Also go to Start menu and Run and type:

%windir%\temp

and clear the files in that fºlder.
--

Empty your IE cache and your other temporary file folders, eg: c:\temp,
c:\windows\temp or C:\Documents and Settings\<name>\Local Settings\Temp (the
path to your temp folder will change depending on your name) - sometimes
programmes can be hidden in there - watch out for mysterious *.exe files or
*.dll files in those fºlders; and
c:\Documents and Settings\username\local settings\Temporary Internet
Files\Content.IE5 and delete all the files in those directories and
subdirectºries).
http://www.mvps.org/winhelp2002/delcache.htm
--

After the cleaning, run Windows Defender and your anti virus applicªtion,
also any other anti spyware program like Ad-Aware http://www.lavasoftusa.com
, Spybot Search & Destroy http://www.safer-networking.org/ , etc. etc.
--

CCleaner - http://www.ccleaner.com
Note, uncheck Yahoos toolbar during install.

The first time you run CCleaner's Issues scanner you'll have to keep
running it back-to-back until it finds nothing. One scenario is a registry
key may only be a reference pointing to a completely different location in
the registry and when it's removed then that reference link is also noticed
as being invalid on a subsequent scan. It's generally a good idea to keep
running the Issues scan until nothing is listed.
--
Reboot
--

Go to Ewido
http://www.ewido.net/en
run a online scanner
--

Good luck Pedro.
--


DAY
The first hour of the morning is the rudder of the day. -----H. W. Beecher
 
G

Guest

Thanks Engel,
Do i do all this in safe mode??

Engel said:
Hi Pedro,

It seems possible that your Windows installation has been deliberately
damaged by the trojan so as to prevent you removing the trojan.

Your first priority must be to cleanse your PC of all malware. as it is
being subverted by malware.
--

Update both Windows Defender and your anti virus applicªtion.
--

In safe mode, some of the protective services which these programs use to
ensure that they aren't removed, are not running, so they are easier to
remºve.

Getting into Windows Safe Mode.

http://www.computerhope.com/issues/chsafe.htm

Shut down the computer and turn off the power.

Wait for at least 30 seconds, and then restart the computer in Safe mode or
VGA mºde.
--

Enable Hidden Files and folder's.

To enable hidden files and folders Go to task bar, click Start > My Computer.
On the Tools menu, click Folder Options.
On the View tab, uncheck Hide file extensions for known file types.
Make sure that 'Show hidden files and folders' is enabled.
Display the contents of system folders' is checked & 'Hide extentions for
known file types' is not checked then press ªpply.

You can set this back later by opening the same page and pressing 'restore
defaults' then pressing ªpply,

HOW TO Enable Hidden Files:
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339
--

In Safe Mode
You can clear prefetch files by going to Start menu and Run and typing

prefetch

and then click OK.

Remove the content of the folder Prefetch

The problem is that many spyware/malware/virus/Trojan (you get the idea)
writers use it to cause their programs to get respawned the moment you launch
the app whose prefetch data is linked to the code placed there by the
infection.
--

Open a Internet window and go to Internet Options, Delete Cookies and Temp
Files, and included all off line content.

Then also go to Start menu and Run and type (with %)

%temp%

and clear the files in that fºlder. Also go to Start menu and Run and type:

%windir%\temp

and clear the files in that fºlder.
--

Empty your IE cache and your other temporary file folders, eg: c:\temp,
c:\windows\temp or C:\Documents and Settings\<name>\Local Settings\Temp (the
path to your temp folder will change depending on your name) - sometimes
programmes can be hidden in there - watch out for mysterious *.exe files or
*.dll files in those fºlders; and
c:\Documents and Settings\username\local settings\Temporary Internet
Files\Content.IE5 and delete all the files in those directories and
subdirectºries).
http://www.mvps.org/winhelp2002/delcache.htm
--

After the cleaning, run Windows Defender and your anti virus applicªtion,
also any other anti spyware program like Ad-Aware http://www.lavasoftusa.com
, Spybot Search & Destroy http://www.safer-networking.org/ , etc. etc.
--

CCleaner - http://www.ccleaner.com
Note, uncheck Yahoos toolbar during install.

The first time you run CCleaner's Issues scanner you'll have to keep
running it back-to-back until it finds nothing. One scenario is a registry
key may only be a reference pointing to a completely different location in
the registry and when it's removed then that reference link is also noticed
as being invalid on a subsequent scan. It's generally a good idea to keep
running the Issues scan until nothing is listed.
--
Reboot
--

Go to Ewido
http://www.ewido.net/en
run a online scanner
 
G

Guest

Hi Pedro,

YES, The cleaning is better in safe mode.

DANGER
In great straits and when hope is small, the boldest counsels are the safes.
-----Livy
--

Pedro said:
Thanks Engel,
Do i do all this in safe mode??
 
G

Guest

I had a similar problem. See below. My question is, should I remove the
various files listed under "resources"?

Error encountered:
Code 0x80508017. Some actions couldn't be applied to potentially harmful
items. The items might be stored in a read-only location. Delete the files or
folders that contains the items or, for information on removing read-only
permissions from files and folders, see Help and Support.

Category:
Trojan

Description:
This program has potentially unwanted behavior.

Advice:
Remove this software immediately.

Resources:
file:
C:\WINDOWS\system32\oqdijyfu.exe->(Upack)->[RSRCEmb]

file:
C:\WINDOWS\system32\hvgovmit.exe->(Upack)->[RSRCEmb]

file:
C:\WINDOWS\system32\qedvuhqu.exe->(Upack)->[RSRCEmb]

file:
C:\WINDOWS\system32\ktvocbly.exe->(Upack)->[RSRCEmb]

file:
C:\WINDOWS\system32\qqmpvcsw.exe->(Upack)->[RSRCEmb]

containerfile:
C:\WINDOWS\system32\qqmpvcsw.exe

containerfile:
C:\WINDOWS\system32\qedvuhqu.exe

containerfile:
C:\WINDOWS\system32\oqdijyfu.exe

containerfile:
C:\WINDOWS\system32\ktvocbly.exe

containerfile:
C:\WINDOWS\system32\hvgovmit.exe
 
G

Guest

Hi Engel,
It did not help WD still finds the same items.
I give up, everything works fine and Spybot-Search & Destroy, SpywareBlaster
& Norton AntiVirus do not find any problems. I also tried PC Doctor for
Windows and it could not find anything.

Thank's for the help, much appreciated.
Pedro.

Engel said:
Hi Pedro,

YES, The cleaning is better in safe mode.

DANGER
In great straits and when hope is small, the boldest counsels are the safes.
-----Livy
--
 
G

Guest

Hi Pedro,

Windows Defender records, in the System event log, at the time of the scan,
the precise path and filename of each detection.

So--right click My Computer, choose Manage.
Click on the plus sign in front of Event Viewer.
Click on the System events log, in the left column.
Click on View (top menu), filter.
Click the down-arrow at the right of Event Source, and choose "WinDefend."
Click apply, click OK.

Now--in the right window, scroll back to the time of the original detection,
and look for yellow-triangle marked records for those original detections.
Double-click a record in the right window to open it and see the full
detail. You can cut and paste, via a button--back to this thread.
 
G

Guest

Hi Engel,
Here is the log of the first detection, Following WD update of that date.
Event Type: Warning
Event Source: WinDefend
Event Category: None
Event ID: 1006
Date: 6/27/2007
Time: 5:33:29 PM
User: N/A
Computer: OUR-COMPUTER
Description:
Windows Defender scan has detected spyware or other potentially unwanted
software.
For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=SoftwareBundler:Win32/KaZaA&threatid=7631
Scan ID: {E240D92A-5E28-4E32-A40D-E6155196A0CF}
Scan Type: AntiSpyware
Scan Parameters: Full Scan
User: NT AUTHORITY\NETWORK SERVICE
Name: SoftwareBundler:Win32/KaZaA
ID: 7631
Severity: Medium
Category: Software Bundler
Path Found: file:C:\Documents and Settings\Peter Richardson\Local
Settings\Temp\p2psetup.exe->(UPX)->[RSRCEmb];containerfile:C:\Documents and
Settings\Peter Richardson\Local Settings\Temp\p2psetup.exe
Detection Type: Concrete

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

And

Event Type: Warning
Event Source: WinDefend
Event Category: None
Event ID: 1006
Date: 6/27/2007
Time: 5:33:29 PM
User: N/A
Computer: OUR-COMPUTER
Description:
Windows Defender scan has detected spyware or other potentially unwanted
software.
For more information please see the following:
http://go.microsoft.com/fwlink/?lin...wnloader:Win32/WebP2PInstaller&threatid=14108
Scan ID: {E240D92A-5E28-4E32-A40D-E6155196A0CF}
Scan Type: AntiSpyware
Scan Parameters: Full Scan
User: NT AUTHORITY\NETWORK SERVICE
Name: TrojanDownloader:Win32/WebP2PInstaller
ID: 14108
Severity: Medium
Category: Trojan Downloader
Path Found: file:C:\Documents and Settings\Peter Richardson\Local
Settings\Temp\p2psetup.exe->(UPX)->[RSRCEmb];containerfile:C:\Documents and
Settings\Peter Richardson\Local Settings\Temp\p2psetup.exe
Detection Type: Concrete

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
 
T

Tom Emmelot

Hi Pedro,

Do you have some kids around the house, i think that they try to install
Kazaa (popular download P2P program) Or is it already on you PC?
Look under Program's or Config Software.
You can uninstal it also from there.
Like to here the result of your investigation and taken action.

Regards >*< TOM >*<

Pedro schreef:
Hi Engel,
Here is the log of the first detection, Following WD update of that date.
Event Type: Warning
Event Source: WinDefend
Event Category: None
Event ID: 1006
Date: 6/27/2007
Time: 5:33:29 PM
User: N/A
Computer: OUR-COMPUTER
Description:
Windows Defender scan has detected spyware or other potentially unwanted
software.
For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=SoftwareBundler:Win32/KaZaA&threatid=7631
Scan ID: {E240D92A-5E28-4E32-A40D-E6155196A0CF}
Scan Type: AntiSpyware
Scan Parameters: Full Scan
User: NT AUTHORITY\NETWORK SERVICE
Name: SoftwareBundler:Win32/KaZaA
ID: 7631
Severity: Medium
Category: Software Bundler
Path Found: file:C:\Documents and Settings\Peter Richardson\Local
Settings\Temp\p2psetup.exe->(UPX)->[RSRCEmb];containerfile:C:\Documents and
Settings\Peter Richardson\Local Settings\Temp\p2psetup.exe
Detection Type: Concrete

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

And

Event Type: Warning
Event Source: WinDefend
Event Category: None
Event ID: 1006
Date: 6/27/2007
Time: 5:33:29 PM
User: N/A
Computer: OUR-COMPUTER
Description:
Windows Defender scan has detected spyware or other potentially unwanted
software.
For more information please see the following:
http://go.microsoft.com/fwlink/?lin...wnloader:Win32/WebP2PInstaller&threatid=14108
Scan ID: {E240D92A-5E28-4E32-A40D-E6155196A0CF}
Scan Type: AntiSpyware
Scan Parameters: Full Scan
User: NT AUTHORITY\NETWORK SERVICE
Name: TrojanDownloader:Win32/WebP2PInstaller
ID: 14108
Severity: Medium
Category: Trojan Downloader
Path Found: file:C:\Documents and Settings\Peter Richardson\Local
Settings\Temp\p2psetup.exe->(UPX)->[RSRCEmb];containerfile:C:\Documents and
Settings\Peter Richardson\Local Settings\Temp\p2psetup.exe
Detection Type: Concrete

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Engel said:
Hi Pedro,

Windows Defender records, in the System event log, at the time of the scan,
the precise path and filename of each detection.

So--right click My Computer, choose Manage.
Click on the plus sign in front of Event Viewer.
Click on the System events log, in the left column.
Click on View (top menu), filter.
Click the down-arrow at the right of Event Source, and choose "WinDefend."
Click apply, click OK.

Now--in the right window, scroll back to the time of the original detection,
and look for yellow-triangle marked records for those original detections.
Double-click a record in the right window to open it and see the full
detail. You can cut and paste, via a button--back to this thread.
--
 
G

Guest

Hi Tom,

I was waiting for your solution.

Is the same give by me to Pedro. I went to the cleaning manual in safe mode,
to uncover any malicius hidden file, and end with CCleaner for the links in
the registry.
If after all the cleaning, WD is detecting the program file. He is result to
live with that, well is up to the user. Unless they know something new, and
we don't know ;-)

Do you need any more music ? I have few songs (less than 20 ;-) those are
Jazz and dont like it. Let me now.

Cheeers Tom
 
T

Tom Emmelot

Hi Engel,

Then Pedro did not use the CrapCleaner, because the items he was
suffering from, where in the Temp folders! ;)
No Engel I download a lot, i am on Broadband ;)
I purchase also a lot Of CD's on the internet, 1 Click and the next day
the postman is bringing the stuff
Jazz is also not my music, like some old stuff, like Dave Brubeck's
"Take Five"
Hope Pedro let us know how he is doing. :)
Must I send you a Camera ? ;)

Regards >*< TOM >*<

Engel schreef:
 
G

Guest

Hi Engel & Tom.
WD scaned today and found the same 2 items, but this time it says it is in
Restore file. Is there a way to delete it now???

Pedro, Canada.

Event Type: Warning
Event Source: WinDefend
Event Category: None
Event ID: 1006
Date: 7/7/2007
Time: 5:06:27 PM
User: N/A
Computer: OUR-COMPUTER
Description:
Windows Defender scan has detected spyware or other potentially unwanted
software.
For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=SoftwareBundler:Win32/KaZaA&threatid=7631
Scan ID: {A3BA372E-A8AD-401D-86A0-E11EAE9638EB}
Scan Type: AntiSpyware
Scan Parameters: Full Scan
User: NT AUTHORITY\NETWORK SERVICE
Name: SoftwareBundler:Win32/KaZaA
ID: 7631
Severity: Medium
Category: Software Bundler
Path Found: file:C:\System Volume
Information\_restore{18F60102-FF40-44FE-8031-7E8117B2DA5B}\RP1324\A0109394.exe->(UPX)->[RSRCEmb];containerfile:C:\System
Volume
Information\_restore{18F60102-FF40-44FE-8031-7E8117B2DA5B}\RP1324\A0109394.exe
Detection Type: Concrete

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

And

Event Type: Warning
Event Source: WinDefend
Event Category: None
Event ID: 1006
Date: 7/7/2007
Time: 5:06:27 PM
User: N/A
Computer: OUR-COMPUTER
Description:
Windows Defender scan has detected spyware or other potentially unwanted
software.
For more information please see the following:
http://go.microsoft.com/fwlink/?lin...wnloader:Win32/WebP2PInstaller&threatid=14108
Scan ID: {A3BA372E-A8AD-401D-86A0-E11EAE9638EB}
Scan Type: AntiSpyware
Scan Parameters: Full Scan
User: NT AUTHORITY\NETWORK SERVICE
Name: TrojanDownloader:Win32/WebP2PInstaller
ID: 14108
Severity: Medium
Category: Trojan Downloader
Path Found: file:C:\System Volume
Information\_restore{18F60102-FF40-44FE-8031-7E8117B2DA5B}\RP1324\A0109394.exe->(UPX)->[RSRCEmb];containerfile:C:\System
Volume
Information\_restore{18F60102-FF40-44FE-8031-7E8117B2DA5B}\RP1324\A0109394.exe
Detection Type: Concrete

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
 
G

Guest

Hi Pedro,
Open Disk Cleanup via Start, Programs, Accessories, System Tººls.
It will scan the system first. Click the More Options tªb.
Now click the Clean up button under System Restºre.
This will remove all but the most recent restore pºint.

--


Pedro said:
Hi Engel & Tom.
WD scaned today and found the same 2 items, but this time it says it is in
Restore file. Is there a way to delete it now???

Pedro, Canada.

Event Type: Warning
Event Source: WinDefend
Event Category: None
Event ID: 1006
Date: 7/7/2007
Time: 5:06:27 PM
User: N/A
Computer: OUR-COMPUTER
Description:
Windows Defender scan has detected spyware or other potentially unwanted
software.
For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=SoftwareBundler:Win32/KaZaA&threatid=7631
Scan ID: {A3BA372E-A8AD-401D-86A0-E11EAE9638EB}
Scan Type: AntiSpyware
Scan Parameters: Full Scan
User: NT AUTHORITY\NETWORK SERVICE
Name: SoftwareBundler:Win32/KaZaA
ID: 7631
Severity: Medium
Category: Software Bundler
Path Found: file:C:\System Volume
Information\_restore{18F60102-FF40-44FE-8031-7E8117B2DA5B}\RP1324\A0109394.exe->(UPX)->[RSRCEmb];containerfile:C:\System
Volume
Information\_restore{18F60102-FF40-44FE-8031-7E8117B2DA5B}\RP1324\A0109394.exe
Detection Type: Concrete

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

And

Event Type: Warning
Event Source: WinDefend
Event Category: None
Event ID: 1006
Date: 7/7/2007
Time: 5:06:27 PM
User: N/A
Computer: OUR-COMPUTER
Description:
Windows Defender scan has detected spyware or other potentially unwanted
software.
For more information please see the following:
http://go.microsoft.com/fwlink/?lin...wnloader:Win32/WebP2PInstaller&threatid=14108
Scan ID: {A3BA372E-A8AD-401D-86A0-E11EAE9638EB}
Scan Type: AntiSpyware
Scan Parameters: Full Scan
User: NT AUTHORITY\NETWORK SERVICE
Name: TrojanDownloader:Win32/WebP2PInstaller
ID: 14108
Severity: Medium
Category: Trojan Downloader
Path Found: file:C:\System Volume
Information\_restore{18F60102-FF40-44FE-8031-7E8117B2DA5B}\RP1324\A0109394.exe->(UPX)->[RSRCEmb];containerfile:C:\System
Volume
Information\_restore{18F60102-FF40-44FE-8031-7E8117B2DA5B}\RP1324\A0109394.exe
Detection Type: Concrete

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Engel said:
Hi Tom,


Better send a female nordic pothografer ;-)

Do you check today in Signatures for my last post.
 
G

Guest

Hi Engel,
Your first dx was right, i spent most of Saturday going through my doument
file one by one. It turned out that there was a zip folder in a doucment that
had been restored from a backed up copy of a previous document files during
what tured out to be a mother board problem back in 2004. Once found and
deleted all is well againWD scans are clean. Thank you again for all your
help, i have learned a lot more about my system which is a good thing. It
also shows that WD is doing a very good job of ferreting out potential
problems.

Pedro, Canada.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top