Unknown Backups In My Documents

Hello Everyone:  I got these 8 Unknown Backups in My Documents and they grow in amount slowly! If I try to open one, it states that "windows cannot open because it has to know what program created it" and if I click on search the web to see what created it, I always get a "Cannot Dipsplay Page? So I am back to how to find out what these Backups are for and what created them. I have a picture showing the size etc. of one of them but this forum doesn't seem to accept attachments. So here is one of them exactly as it is shown, it simply says>>>>   "Backup 20040927-151221-125.<<<< Now they all look like this and I think the first 8 numbers are the date but the 151221-125, I dont know what that is, also some are 580bytes, 76bytes etc,. Does anyone have any idea's as to what these are?   Thanks, Tom
tomseeAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

luv2smileCommented:
can you give us a file extension of the file?
0
tomseeAuthor Commented:
I dont see any file extension, it just says "File" I wish there was a way to send you a picture of one of them?
0
tomseeAuthor Commented:
Dont know if this as anything to do with it but I use to have VCatch on my pc but removed it. But I happen to spot this in my system32 folder and when I searched google to see what this .exe was it said Common Search but looked like it was related to VCatch. Do you think there is a link? Here is the .exe I found>>> Its called "WCWebInstall.exe"
0
Introducing the "443 Security Simplified" Podcast

This new podcast puts you inside the minds of leading white-hat hackers and security researchers. Hosts Marc Laliberte and Corey Nachreiner turn complex security concepts into easily understood and actionable insights on the latest cyber security headlines and trends.

tomseeAuthor Commented:
Its Called "VCWebInstall.exe, I made a mistake
0
rindiCommented:
If you open, say, a word document, word periodically saves the changes you have made to by making a backup of this file. Normally, when you eventually save your document and exit word those backup copies should be removed. Somehow this doesn't allways happen. These backups are mainly for the case when your system crashes, that you still are able to open the file. Normally if after a crash you open word it will also automatically open the last backup and you'll see something like "recovered" in the title bar.

If you can't see the file's extension, you probably have that option set in the folder's settings. Open control panel, folder options, set the "view" tab and make sure that "hide extensions for known file types" is turned off. Now you should be abls to see all extensions.

Word backup files usually end with .wbk
0
tomseeAuthor Commented:
Hello Rindi:   Are you refering to WordPad Documents?
0
rindiCommented:
No, MS Word, but they are just examples.
0
tomseeAuthor Commented:
Ok, Thanks, I dont have Word (or never used it) Also, I do keep the "Hide Extensions" Unchecked, but these dont seem to have a file extension.
0
rubiconxCommented:
Have you tried to open them in wordpad?  If so, is there any 'readable' text in them.  This might give a clue.  Right click on it and select "Open with..." then chose Wordpad.

You mention that they are growing - by how much and how often?

What size is the largest one?

What windows are you running?

Do you have a virus scanner installed?
0
tomseeAuthor Commented:
Rubiconx:  Hey you are right, they do open when I send them to WordPad. I got rid of Flash get long ago (So I thought) but the others I dont know about yet!  and here are all but one  > FIRST >>>>> O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\{AF6CABAB-61F9-4f12-A198-B7D41EF1CB52}]
"Default Visible"="Yes"
"ButtonText"="WeatherBug"
"HotIcon"="C:\\Program Files\\AWS\\WeatherBug\\wxbug.ico"
"Icon"="C:\\Program Files\\AWS\\WeatherBug\\wxbug.ico"
"CLSID"="{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"
"ClsidExtension"="{AF6CABAB-61F9-4f12-A198-B7D41EF1CB52}"
"Exec"="C:\\Program Files\\AWS\\WeatherBug\\Weather.exe"
SECOND>>>O4 - HKCU\..\Run: [vCatch] C:\Program Files\CommonSearch\VCatch\VCatch.exe  THIRD>> O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{D6E814A0-E0C5-11d4-8D29-0050BA6940E3}]
"ButtonText"="FlashGet"
"Default Visible"="Yes"
"Exec"="C:\\PROGRA~1\\FlashGet\\flashget.exe"
"HotIcon"="C:\\PROGRA~1\\FlashGet\\flashget.exe,128"
"Icon"="C:\\PROGRA~1\\FlashGet\\flashget.exe,223"
"CLSID"="{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"
"MenuStatusBar"="FlashGet"
"MenuText"="&FlashGet"
FOURTH>>>  O17 - HKLM\System\CCS\Services\Tcpip\..\{2959632D-AEC1-4EFB-B27E-5026D5EA176F}: NameServer = 205.188.146.146
FIFTH>>>O8 - Extra context menu item: Download All by FlashGet - C:\PROGRA~1\FlashGet\jc_all.htm
SIXTH>>>O8 - Extra context menu item: Download using FlashGet - C:\PROGRA~1\FlashGet\jc_link.htm
SEVENTH>>>O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{D6E814A0-E0C5-11d4-8D29-0050BA6940E3}]
"ButtonText"="FlashGet"
"Default Visible"="Yes"
"Exec"="C:\\PROGRA~1\\FlashGet\\flashget.exe"
"HotIcon"="C:\\PROGRA~1\\FlashGet\\flashget.exe,128"
"Icon"="C:\\PROGRA~1\\FlashGet\\flashget.exe,223"
"CLSID"="{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"
"MenuStatusBar"="FlashGet"
"MenuText"="&FlashGet"     IF, I delete these they seem to come back, what do you think is happening?  Thanks, Tom
0
tomseeAuthor Commented:
BTW: I have a good AntiVirus, with OutPost firewall, Script Sentry, Process Guard, SpyWare Blaster, Spyware Guard, Ewido Security Suite, Ad-Aware, SpyBot Search and Destroy
0
rindiCommented:
If you think you have gotten rid of spyware or virii, you have probably not disabled system restore (control panel, system). It is important to turn that "feature" off (I'm beginning to wonder if that is more a feature or a bug), as otherwise the bugs will be restored again.
0
rubiconxCommented:
They all appear to be backup files created using HijackThis - I presume you've used this at some stage.
Have you still got this installed?  Are you sure the files were growing in size?

As to why you can't delete them...!?  Unsure.  I suggest you switch off system restore...delete them...switch it back on again...and see if they come back!

To switch it off...

http://support.microsoft.com/default.aspx?scid=kb;%5BLN%5D;310405

presuming you have XP installed.

Dave
0
tomseeAuthor Commented:
I forgot to mention I do use HijackThis all the time. I can delete these backups! So you think it is HijackThis bringing them back? I this is so then I should have nothing to worry about them, Right"
0
rubiconxCommented:
When hijakthis 'fixes' something it creates a backup incase the change was an error.  It can then use the backup files to restore details if neccessary.  I believe you can configure these settings within the program.  

Providing the programs they refer to really aren't wanted then feel free to delete them.

Dave
0
tomseeAuthor Commented:
I see that they are associated with Flash Get and AWS weather bug, I really want to rid my pc once and for all of both of them. So you say to delete all backups and then turn off system restore, then restart the pc and then turn system restore back on, is this correct?
0
rubiconxCommented:
turn off system restore
delete files
turn system restore back on

This presumes that it is the system restore that is bringing them back.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
rubiconxCommented:
You could run hijackthis...

click config..  (bottom right)
click backups (top middle)
delete approriate backups

0
tomseeAuthor Commented:
I just ran Hijack This and there was nothing in the backups at this time and the log looked good to me (nothing to fix) right now!
0
rubiconxCommented:
Try the system restore

I'm running out of ideas here!
0
tomseeAuthor Commented:
Ok, I will turn off system restore, delete the backups, then turn on system restore again.  I will give it 3 or 4 days to see if they come back and will let you know!  Thanks
0
rubiconxCommented:
Good luck!
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Security

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.