Multiple restore points update

[Guest]

I discovered what had been causing (for me) the numerous Windows Defender
restore points each day ... Webshots!

I'm still not sure exactly which of its operations causes it, but I found an
exact correlation between the times System Restore created a WD restore
point, and the times WD recorded an allowed "Unknown" action in its History
pane, which reads as follows:

-----
Description:
This program has potentially unwanted behavior.

Advice:
Allow this detected item only if you trust the program or the software
publisher.

Resources:
file:
C:\Documents and Settings\galanb\Start Menu\Programs\StartUp\Webshots.lnk

file:
C:\Program Files\Webshots\Launcher.exe

startup:
C:\Documents and Settings\galanb\Start Menu\Programs\StartUp\Webshots.lnk

Category:
Not Yet Classified
-----

It's interesting that it says it's "Not Yet Classified", yet Software
Explorer says it's classified as "Allowed", and perhaps stranger still that
it doesn't show up in the "Allowed items" pane. (Perhaps there's a bug
there?)

Anyway, does anyone else on this newsgroup that's been seeing all these WD
restore points have Webshots running?

Thanks,
Galan

 

[Robin]

I do not run Webshots and I see WD restore points- but this is old story
robin
"Galan Bridgman [MVP - Digital Media]"

 

[Guest]

Ok, great, so we know it happens with more than just Webshots!

Have you by any chance tried looking at the History pane in your Windows
Defender and seeing if any of the events there match up with the exact same
dates and times in System Restore? That was how I finally fingered Webshots.

Thanks,
Galan

I do not run Webshots and I see WD restore points- but this is old story
robin
"Galan Bridgman [MVP - Digital Media]"

I discovered what had been causing (for me) the numerous Windows Defender
restore points each day ... Webshots!

I'm still not sure exactly which of its operations causes it, but I found
an
exact correlation between the times System Restore created a WD restore
point, and the times WD recorded an allowed "Unknown" action in its
History
pane, which reads as follows:

-----
Description:
This program has potentially unwanted behavior.

Advice:
Allow this detected item only if you trust the program or the software
publisher.

Resources:
file:
C:\Documents and Settings\galanb\Start Menu\Programs\StartUp\Webshots.lnk

file:
C:\Program Files\Webshots\Launcher.exe

startup:
C:\Documents and Settings\galanb\Start Menu\Programs\StartUp\Webshots.lnk

Category:
Not Yet Classified
-----

It's interesting that it says it's "Not Yet Classified", yet Software
Explorer says it's classified as "Allowed", and perhaps stranger still
that
it doesn't show up in the "Allowed items" pane. (Perhaps there's a bug
there?)

Anyway, does anyone else on this newsgroup that's been seeing all these WD
restore points have Webshots running?

Thanks,
Galan

 

[Robin]

I have and they do not
robin

Ok, great, so we know it happens with more than just Webshots!

Have you by any chance tried looking at the History pane in your Windows
Defender and seeing if any of the events there match up with the exact
same
dates and times in System Restore? That was how I finally fingered
Webshots.

Thanks,
Galan

I do not run Webshots and I see WD restore points- but this is old story
robin
"Galan Bridgman [MVP - Digital Media]"

I discovered what had been causing (for me) the numerous Windows
Defender
restore points each day ... Webshots!

I'm still not sure exactly which of its operations causes it, but I
found
an
exact correlation between the times System Restore created a WD restore
point, and the times WD recorded an allowed "Unknown" action in its
History
pane, which reads as follows:

-----
Description:
This program has potentially unwanted behavior.

Advice:
Allow this detected item only if you trust the program or the software
publisher.

Resources:
file:
C:\Documents and Settings\galanb\Start
Menu\Programs\StartUp\Webshots.lnk

file:
C:\Program Files\Webshots\Launcher.exe

startup:
C:\Documents and Settings\galanb\Start
Menu\Programs\StartUp\Webshots.lnk

Category:
Not Yet Classified
-----

It's interesting that it says it's "Not Yet Classified", yet Software
Explorer says it's classified as "Allowed", and perhaps stranger still
that
it doesn't show up in the "Allowed items" pane. (Perhaps there's a bug
there?)

Anyway, does anyone else on this newsgroup that's been seeing all these
WD
restore points have Webshots running?

Thanks,
Galan

 

[Guest]

:
so we know it happens with more than just Webshots!

Yes. In my case, the culprit was an AOL driver, ATWPKT2.