Link to home
Start Free TrialLog in
Avatar of tomsee
tomsee

asked on

Unknown Backups In My Documents

Hello Everyone:  I got these 8 Unknown Backups in My Documents and they grow in amount slowly! If I try to open one, it states that "windows cannot open because it has to know what program created it" and if I click on search the web to see what created it, I always get a "Cannot Dipsplay Page? So I am back to how to find out what these Backups are for and what created them. I have a picture showing the size etc. of one of them but this forum doesn't seem to accept attachments. So here is one of them exactly as it is shown, it simply says>>>>   "Backup 20040927-151221-125.<<<< Now they all look like this and I think the first 8 numbers are the date but the 151221-125, I dont know what that is, also some are 580bytes, 76bytes etc,. Does anyone have any idea's as to what these are?   Thanks, Tom
Avatar of luv2smile
luv2smile

can you give us a file extension of the file?
Avatar of tomsee

ASKER

I dont see any file extension, it just says "File" I wish there was a way to send you a picture of one of them?
Avatar of tomsee

ASKER

Dont know if this as anything to do with it but I use to have VCatch on my pc but removed it. But I happen to spot this in my system32 folder and when I searched google to see what this .exe was it said Common Search but looked like it was related to VCatch. Do you think there is a link? Here is the .exe I found>>> Its called "WCWebInstall.exe"
Avatar of tomsee

ASKER

Its Called "VCWebInstall.exe, I made a mistake
Avatar of rindi
If you open, say, a word document, word periodically saves the changes you have made to by making a backup of this file. Normally, when you eventually save your document and exit word those backup copies should be removed. Somehow this doesn't allways happen. These backups are mainly for the case when your system crashes, that you still are able to open the file. Normally if after a crash you open word it will also automatically open the last backup and you'll see something like "recovered" in the title bar.

If you can't see the file's extension, you probably have that option set in the folder's settings. Open control panel, folder options, set the "view" tab and make sure that "hide extensions for known file types" is turned off. Now you should be abls to see all extensions.

Word backup files usually end with .wbk
Avatar of tomsee

ASKER

Hello Rindi:   Are you refering to WordPad Documents?
No, MS Word, but they are just examples.
Avatar of tomsee

ASKER

Ok, Thanks, I dont have Word (or never used it) Also, I do keep the "Hide Extensions" Unchecked, but these dont seem to have a file extension.
Have you tried to open them in wordpad?  If so, is there any 'readable' text in them.  This might give a clue.  Right click on it and select "Open with..." then chose Wordpad.

You mention that they are growing - by how much and how often?

What size is the largest one?

What windows are you running?

Do you have a virus scanner installed?
Avatar of tomsee

ASKER

Rubiconx:  Hey you are right, they do open when I send them to WordPad. I got rid of Flash get long ago (So I thought) but the others I dont know about yet!  and here are all but one  > FIRST >>>>> O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\{AF6CABAB-61F9-4f12-A198-B7D41EF1CB52}]
"Default Visible"="Yes"
"ButtonText"="WeatherBug"
"HotIcon"="C:\\Program Files\\AWS\\WeatherBug\\wxbug.ico"
"Icon"="C:\\Program Files\\AWS\\WeatherBug\\wxbug.ico"
"CLSID"="{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"
"ClsidExtension"="{AF6CABAB-61F9-4f12-A198-B7D41EF1CB52}"
"Exec"="C:\\Program Files\\AWS\\WeatherBug\\Weather.exe"
SECOND>>>O4 - HKCU\..\Run: [vCatch] C:\Program Files\CommonSearch\VCatch\VCatch.exe  THIRD>> O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{D6E814A0-E0C5-11d4-8D29-0050BA6940E3}]
"ButtonText"="FlashGet"
"Default Visible"="Yes"
"Exec"="C:\\PROGRA~1\\FlashGet\\flashget.exe"
"HotIcon"="C:\\PROGRA~1\\FlashGet\\flashget.exe,128"
"Icon"="C:\\PROGRA~1\\FlashGet\\flashget.exe,223"
"CLSID"="{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"
"MenuStatusBar"="FlashGet"
"MenuText"="&FlashGet"
FOURTH>>>  O17 - HKLM\System\CCS\Services\Tcpip\..\{2959632D-AEC1-4EFB-B27E-5026D5EA176F}: NameServer = 205.188.146.146
FIFTH>>>O8 - Extra context menu item: Download All by FlashGet - C:\PROGRA~1\FlashGet\jc_all.htm
SIXTH>>>O8 - Extra context menu item: Download using FlashGet - C:\PROGRA~1\FlashGet\jc_link.htm
SEVENTH>>>O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{D6E814A0-E0C5-11d4-8D29-0050BA6940E3}]
"ButtonText"="FlashGet"
"Default Visible"="Yes"
"Exec"="C:\\PROGRA~1\\FlashGet\\flashget.exe"
"HotIcon"="C:\\PROGRA~1\\FlashGet\\flashget.exe,128"
"Icon"="C:\\PROGRA~1\\FlashGet\\flashget.exe,223"
"CLSID"="{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"
"MenuStatusBar"="FlashGet"
"MenuText"="&FlashGet"     IF, I delete these they seem to come back, what do you think is happening?  Thanks, Tom
Avatar of tomsee

ASKER

BTW: I have a good AntiVirus, with OutPost firewall, Script Sentry, Process Guard, SpyWare Blaster, Spyware Guard, Ewido Security Suite, Ad-Aware, SpyBot Search and Destroy
If you think you have gotten rid of spyware or virii, you have probably not disabled system restore (control panel, system). It is important to turn that "feature" off (I'm beginning to wonder if that is more a feature or a bug), as otherwise the bugs will be restored again.
They all appear to be backup files created using HijackThis - I presume you've used this at some stage.
Have you still got this installed?  Are you sure the files were growing in size?

As to why you can't delete them...!?  Unsure.  I suggest you switch off system restore...delete them...switch it back on again...and see if they come back!

To switch it off...

http://support.microsoft.com/default.aspx?scid=kb;%5BLN%5D;310405

presuming you have XP installed.

Dave
Avatar of tomsee

ASKER

I forgot to mention I do use HijackThis all the time. I can delete these backups! So you think it is HijackThis bringing them back? I this is so then I should have nothing to worry about them, Right"
When hijakthis 'fixes' something it creates a backup incase the change was an error.  It can then use the backup files to restore details if neccessary.  I believe you can configure these settings within the program.  

Providing the programs they refer to really aren't wanted then feel free to delete them.

Dave
Avatar of tomsee

ASKER

I see that they are associated with Flash Get and AWS weather bug, I really want to rid my pc once and for all of both of them. So you say to delete all backups and then turn off system restore, then restart the pc and then turn system restore back on, is this correct?
ASKER CERTIFIED SOLUTION
Avatar of rubiconx
rubiconx

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
You could run hijackthis...

click config..  (bottom right)
click backups (top middle)
delete approriate backups

Avatar of tomsee

ASKER

I just ran Hijack This and there was nothing in the backups at this time and the log looked good to me (nothing to fix) right now!
Try the system restore

I'm running out of ideas here!
Avatar of tomsee

ASKER

Ok, I will turn off system restore, delete the backups, then turn on system restore again.  I will give it 3 or 4 days to see if they come back and will let you know!  Thanks
Good luck!