tomsee
asked on
Unknown Backups In My Documents
Hello Everyone: I got these 8 Unknown Backups in My Documents and they grow in amount slowly! If I try to open one, it states that "windows cannot open because it has to know what program created it" and if I click on search the web to see what created it, I always get a "Cannot Dipsplay Page? So I am back to how to find out what these Backups are for and what created them. I have a picture showing the size etc. of one of them but this forum doesn't seem to accept attachments. So here is one of them exactly as it is shown, it simply says>>>> "Backup 20040927-151221-125.<<<< Now they all look like this and I think the first 8 numbers are the date but the 151221-125, I dont know what that is, also some are 580bytes, 76bytes etc,. Does anyone have any idea's as to what these are? Thanks, Tom
can you give us a file extension of the file?
ASKER
I dont see any file extension, it just says "File" I wish there was a way to send you a picture of one of them?
ASKER
Dont know if this as anything to do with it but I use to have VCatch on my pc but removed it. But I happen to spot this in my system32 folder and when I searched google to see what this .exe was it said Common Search but looked like it was related to VCatch. Do you think there is a link? Here is the .exe I found>>> Its called "WCWebInstall.exe"
ASKER
Its Called "VCWebInstall.exe, I made a mistake
If you open, say, a word document, word periodically saves the changes you have made to by making a backup of this file. Normally, when you eventually save your document and exit word those backup copies should be removed. Somehow this doesn't allways happen. These backups are mainly for the case when your system crashes, that you still are able to open the file. Normally if after a crash you open word it will also automatically open the last backup and you'll see something like "recovered" in the title bar.
If you can't see the file's extension, you probably have that option set in the folder's settings. Open control panel, folder options, set the "view" tab and make sure that "hide extensions for known file types" is turned off. Now you should be abls to see all extensions.
Word backup files usually end with .wbk
If you can't see the file's extension, you probably have that option set in the folder's settings. Open control panel, folder options, set the "view" tab and make sure that "hide extensions for known file types" is turned off. Now you should be abls to see all extensions.
Word backup files usually end with .wbk
ASKER
Hello Rindi: Are you refering to WordPad Documents?
No, MS Word, but they are just examples.
ASKER
Ok, Thanks, I dont have Word (or never used it) Also, I do keep the "Hide Extensions" Unchecked, but these dont seem to have a file extension.
Have you tried to open them in wordpad? If so, is there any 'readable' text in them. This might give a clue. Right click on it and select "Open with..." then chose Wordpad.
You mention that they are growing - by how much and how often?
What size is the largest one?
What windows are you running?
Do you have a virus scanner installed?
You mention that they are growing - by how much and how often?
What size is the largest one?
What windows are you running?
Do you have a virus scanner installed?
ASKER
Rubiconx: Hey you are right, they do open when I send them to WordPad. I got rid of Flash get long ago (So I thought) but the others I dont know about yet! and here are all but one > FIRST >>>>> O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B 7D41EF1CB5 2} - C:\Program Files\AWS\WeatherBug\Weath er.exe (file missing) (HKCU)
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Softwar e\Microsof t\Internet Explorer\Extensions\{AF6CA BAB-61F9-4 f12-A198-B 7D41EF1CB5 2}]
"Default Visible"="Yes"
"ButtonText"="WeatherBug"
"HotIcon"="C:\\Program Files\\AWS\\WeatherBug\\wx bug.ico"
"Icon"="C:\\Program Files\\AWS\\WeatherBug\\wx bug.ico"
"CLSID"="{1FBA04EE-3024-11 d2-8F1F-00 00F87ABD16 }"
"ClsidExtension"="{AF6CABA B-61F9-4f1 2-A198-B7D 41EF1CB52} "
"Exec"="C:\\Program Files\\AWS\\WeatherBug\\We ather.exe"
SECOND>>>O4 - HKCU\..\Run: [vCatch] C:\Program Files\CommonSearch\VCatch\ VCatch.exe THIRD>> O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0 050BA6940E 3} - C:\PROGRA~1\FlashGet\flash get.exe (file missing)
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Softwa re\Microso ft\Interne t Explorer\Extensions\{D6E81 4A0-E0C5-1 1d4-8D29-0 050BA6940E 3}]
"ButtonText"="FlashGet"
"Default Visible"="Yes"
"Exec"="C:\\PROGRA~1\\Flas hGet\\flas hget.exe"
"HotIcon"="C:\\PROGRA~1\\F lashGet\\f lashget.ex e,128"
"Icon"="C:\\PROGRA~1\\Flas hGet\\flas hget.exe,2 23"
"CLSID"="{1FBA04EE-3024-11 d2-8F1F-00 00F87ABD16 }"
"MenuStatusBar"="FlashGet"
"MenuText"="&FlashGet"
FOURTH>>> O17 - HKLM\System\CCS\Services\T cpip\..\{2 959632D-AE C1-4EFB-B2 7E-5026D5E A176F}: NameServer = 205.188.146.146
FIFTH>>>O8 - Extra context menu item: Download All by FlashGet - C:\PROGRA~1\FlashGet\jc_al l.htm
SIXTH>>>O8 - Extra context menu item: Download using FlashGet - C:\PROGRA~1\FlashGet\jc_li nk.htm
SEVENTH>>>O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0 050BA6940E 3} - C:\PROGRA~1\FlashGet\flash get.exe (file missing)
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Softwa re\Microso ft\Interne t Explorer\Extensions\{D6E81 4A0-E0C5-1 1d4-8D29-0 050BA6940E 3}]
"ButtonText"="FlashGet"
"Default Visible"="Yes"
"Exec"="C:\\PROGRA~1\\Flas hGet\\flas hget.exe"
"HotIcon"="C:\\PROGRA~1\\F lashGet\\f lashget.ex e,128"
"Icon"="C:\\PROGRA~1\\Flas hGet\\flas hget.exe,2 23"
"CLSID"="{1FBA04EE-3024-11 d2-8F1F-00 00F87ABD16 }"
"MenuStatusBar"="FlashGet"
"MenuText"="&FlashGet" IF, I delete these they seem to come back, what do you think is happening? Thanks, Tom
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Softwar
"Default Visible"="Yes"
"ButtonText"="WeatherBug"
"HotIcon"="C:\\Program Files\\AWS\\WeatherBug\\wx
"Icon"="C:\\Program Files\\AWS\\WeatherBug\\wx
"CLSID"="{1FBA04EE-3024-11
"ClsidExtension"="{AF6CABA
"Exec"="C:\\Program Files\\AWS\\WeatherBug\\We
SECOND>>>O4 - HKCU\..\Run: [vCatch] C:\Program Files\CommonSearch\VCatch\
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Softwa
"ButtonText"="FlashGet"
"Default Visible"="Yes"
"Exec"="C:\\PROGRA~1\\Flas
"HotIcon"="C:\\PROGRA~1\\F
"Icon"="C:\\PROGRA~1\\Flas
"CLSID"="{1FBA04EE-3024-11
"MenuStatusBar"="FlashGet"
"MenuText"="&FlashGet"
FOURTH>>> O17 - HKLM\System\CCS\Services\T
FIFTH>>>O8 - Extra context menu item: Download All by FlashGet - C:\PROGRA~1\FlashGet\jc_al
SIXTH>>>O8 - Extra context menu item: Download using FlashGet - C:\PROGRA~1\FlashGet\jc_li
SEVENTH>>>O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Softwa
"ButtonText"="FlashGet"
"Default Visible"="Yes"
"Exec"="C:\\PROGRA~1\\Flas
"HotIcon"="C:\\PROGRA~1\\F
"Icon"="C:\\PROGRA~1\\Flas
"CLSID"="{1FBA04EE-3024-11
"MenuStatusBar"="FlashGet"
"MenuText"="&FlashGet" IF, I delete these they seem to come back, what do you think is happening? Thanks, Tom
ASKER
BTW: I have a good AntiVirus, with OutPost firewall, Script Sentry, Process Guard, SpyWare Blaster, Spyware Guard, Ewido Security Suite, Ad-Aware, SpyBot Search and Destroy
If you think you have gotten rid of spyware or virii, you have probably not disabled system restore (control panel, system). It is important to turn that "feature" off (I'm beginning to wonder if that is more a feature or a bug), as otherwise the bugs will be restored again.
They all appear to be backup files created using HijackThis - I presume you've used this at some stage.
Have you still got this installed? Are you sure the files were growing in size?
As to why you can't delete them...!? Unsure. I suggest you switch off system restore...delete them...switch it back on again...and see if they come back!
To switch it off...
http://support.microsoft.com/default.aspx?scid=kb;%5BLN%5D;310405
presuming you have XP installed.
Dave
Have you still got this installed? Are you sure the files were growing in size?
As to why you can't delete them...!? Unsure. I suggest you switch off system restore...delete them...switch it back on again...and see if they come back!
To switch it off...
http://support.microsoft.com/default.aspx?scid=kb;%5BLN%5D;310405
presuming you have XP installed.
Dave
ASKER
I forgot to mention I do use HijackThis all the time. I can delete these backups! So you think it is HijackThis bringing them back? I this is so then I should have nothing to worry about them, Right"
When hijakthis 'fixes' something it creates a backup incase the change was an error. It can then use the backup files to restore details if neccessary. I believe you can configure these settings within the program.
Providing the programs they refer to really aren't wanted then feel free to delete them.
Dave
Providing the programs they refer to really aren't wanted then feel free to delete them.
Dave
ASKER
I see that they are associated with Flash Get and AWS weather bug, I really want to rid my pc once and for all of both of them. So you say to delete all backups and then turn off system restore, then restart the pc and then turn system restore back on, is this correct?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
You could run hijackthis...
click config.. (bottom right)
click backups (top middle)
delete approriate backups
click config.. (bottom right)
click backups (top middle)
delete approriate backups
ASKER
I just ran Hijack This and there was nothing in the backups at this time and the log looked good to me (nothing to fix) right now!
Try the system restore
I'm running out of ideas here!
I'm running out of ideas here!
ASKER
Ok, I will turn off system restore, delete the backups, then turn on system restore again. I will give it 3 or 4 days to see if they come back and will let you know! Thanks
Good luck!