unwise.exe and Defender

[Robert]

KB 915587 downloaded and installed OK. When I ran it, it picked up
unwise.exe installed with Atomic Clock Syc (which has been on this computer
for about two years). I deleted it and removed the programme.

However, as I liked this programme, I did a search and found there are
different opinions about unwise.exe. Some say it's spyware, others say
it's an uninstaller and is OK. Searching my computer, I find there are 17
other copies of this file all associated with different programmes.

I would like to reinstall this programme - which is from
Worldtimeserver.com - as it is useful. Can anyone advise if there is
spyware in this, or is it a false alarm ?

One other point - update 1.14.1325.6 is listed on the Windows Defender
Status screen, but when I checked on Add and Remove Programmes, there are
lots of Windows updates listed but not KB 915587. Where are Defender
updates listed ?

Regards,

Robert.

 

[Guest]

Hello Robert.

It could be anything.

unwise.exe is a process belonging to the Claria advertising program by
Claria Corporation. This process monitors your browsing habits and
distributes the data back to the author's servers for analysis. This also
prompts advertising popups. This program is a registered security risk and
should be removed immediately.

WD updates come with KB 915597

Definitions are saved in C:\Documents and Settings\All
Users.WINNT\Application Data\Microsoft\Windows Defender\Definition Updates

I hope this post is helpfull.
Еиçеl

 

[Robert]

Thank you !

You think I should remove all 17 different copies of unwise.exe ? These
are not being picked up. Among other programmes, there is a copy in
PaintShopPro, which shouldn't be spyware.

I've looked in C:\Documents and Settings\All Users\Application
Data\Microsoft\Windows Defender\Definition Updates and there's nothing there
quoting KB 915597.

I don't have C:\Documents and Settings\All Users.WINNT\Application
Data\Microsoft\Windows Defender\Definition Updates - could be becauseI have
XP Home SP2 and uptodate ?
Regards,
Robert.

 

[Randy Knobloch]

You think I should remove all 17 different copies of unwise.exe ?

Definitely *not* as "unwise.exe" is the uninstaller for many third-party products.
Your were give (BAD) advice to do so...
Do not proceed -

Update Defender via the normal method.

Randy

--
siljaline

MS - MVP Windows (IE/OE) & Security, AH-VSOP
_________________________________________
Security Tools Updates
http://aumha.net/viewforum.php?f=31

Reply to group, as return address
is invalid that we may all benefit.

 

[Robert]

Thanks - I won't do that then !

Could you read my original post and reply to my points on that please ?

Robert.

 

[Bill Sanderson]

I would recommend that you pick a different clock sync program. I don't
know for certain whether your original choice is "bad" or whether this is
simply a false positive, but there are lots of other choices. XP's clock
applet natively synchs to timesources already--neither Windows 2000 nor XP
needs such an app to be synched to a reference timesource.

I've used this one in the past:

http://www.analogx.com/contents/download/network/ats.htm

 

[Bill Sanderson]

Second point:

Where are the defs listed?

I don't know--I looked, and I didn't spot them, even with "show updates"
checked. They are removable via several methods, however.

 

[Robert]

Thanks for your last two posts.

I wasn't aware that the XP clock could update itself - I've now activated
that, so as you suggest, I'll just do without Atomic Clock Sync. Hope that
Defender doesn't start objecting to all the other unwise.exes I've got
installed.

I have "show updates" checked and that's where I looked first - without
finding the definition update state.

Too many mysteries about all this !

Thanks again,

Robert.

 

[Bill Sanderson]

I think you will be OK on the unise.exe's. What sometimes happens is that a
given commercial or freeware bit of helper code is used in some specfic
piece of spyware, and that gets into the signatures. Clearly it was able to
distinguish among those on your machine--so perhaps the one "fingered"
really was bad--or perhaps it simply happened to have the same checksum as
one used by a spyware app.

At any rate, it shouldn't be needed under XP--so you're probably better off
without it.

--

 

[Robert]

Thank you !

Robert.

I think you will be OK on the unise.exe's. What sometimes happens is that
a given commercial or freeware bit of helper code is used in some specfic
piece of spyware, and that gets into the signatures. Clearly it was able
to distinguish among those on your machine--so perhaps the one "fingered"
really was bad--or perhaps it simply happened to have the same checksum as
one used by a spyware app.

At any rate, it shouldn't be needed under XP--so you're probably better
off without it.