[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 234
  • Last Modified:

Unknown Backups In My Documents

Hello Everyone:  I got these 8 Unknown Backups in My Documents and they grow in amount slowly! If I try to open one, it states that "windows cannot open because it has to know what program created it" and if I click on search the web to see what created it, I always get a "Cannot Dipsplay Page? So I am back to how to find out what these Backups are for and what created them. I have a picture showing the size etc. of one of them but this forum doesn't seem to accept attachments. So here is one of them exactly as it is shown, it simply says>>>>   "Backup 20040927-151221-125.<<<< Now they all look like this and I think the first 8 numbers are the date but the 151221-125, I dont know what that is, also some are 580bytes, 76bytes etc,. Does anyone have any idea's as to what these are?   Thanks, Tom
0
tomsee
Asked:
tomsee
  • 11
  • 7
  • 3
  • +1
1 Solution
 
luv2smileCommented:
can you give us a file extension of the file?
0
 
tomseeAuthor Commented:
I dont see any file extension, it just says "File" I wish there was a way to send you a picture of one of them?
0
 
tomseeAuthor Commented:
Dont know if this as anything to do with it but I use to have VCatch on my pc but removed it. But I happen to spot this in my system32 folder and when I searched google to see what this .exe was it said Common Search but looked like it was related to VCatch. Do you think there is a link? Here is the .exe I found>>> Its called "WCWebInstall.exe"
0
When ransomware hits your clients, what do you do?

MSPs: Endpoint security isn’t enough to prevent ransomware.
As the impact and severity of crypto ransomware attacks has grown, Webroot has fought back, not just by building a next-gen endpoint solution capable of preventing ransomware attacks but also by being a thought leader.

 
tomseeAuthor Commented:
Its Called "VCWebInstall.exe, I made a mistake
0
 
rindiCommented:
If you open, say, a word document, word periodically saves the changes you have made to by making a backup of this file. Normally, when you eventually save your document and exit word those backup copies should be removed. Somehow this doesn't allways happen. These backups are mainly for the case when your system crashes, that you still are able to open the file. Normally if after a crash you open word it will also automatically open the last backup and you'll see something like "recovered" in the title bar.

If you can't see the file's extension, you probably have that option set in the folder's settings. Open control panel, folder options, set the "view" tab and make sure that "hide extensions for known file types" is turned off. Now you should be abls to see all extensions.

Word backup files usually end with .wbk
0
 
tomseeAuthor Commented:
Hello Rindi:   Are you refering to WordPad Documents?
0
 
rindiCommented:
No, MS Word, but they are just examples.
0
 
tomseeAuthor Commented:
Ok, Thanks, I dont have Word (or never used it) Also, I do keep the "Hide Extensions" Unchecked, but these dont seem to have a file extension.
0
 
rubiconxCommented:
Have you tried to open them in wordpad?  If so, is there any 'readable' text in them.  This might give a clue.  Right click on it and select "Open with..." then chose Wordpad.

You mention that they are growing - by how much and how often?

What size is the largest one?

What windows are you running?

Do you have a virus scanner installed?
0
 
tomseeAuthor Commented:
Rubiconx:  Hey you are right, they do open when I send them to WordPad. I got rid of Flash get long ago (So I thought) but the others I dont know about yet!  and here are all but one  > FIRST >>>>> O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\{AF6CABAB-61F9-4f12-A198-B7D41EF1CB52}]
"Default Visible"="Yes"
"ButtonText"="WeatherBug"
"HotIcon"="C:\\Program Files\\AWS\\WeatherBug\\wxbug.ico"
"Icon"="C:\\Program Files\\AWS\\WeatherBug\\wxbug.ico"
"CLSID"="{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"
"ClsidExtension"="{AF6CABAB-61F9-4f12-A198-B7D41EF1CB52}"
"Exec"="C:\\Program Files\\AWS\\WeatherBug\\Weather.exe"
SECOND>>>O4 - HKCU\..\Run: [vCatch] C:\Program Files\CommonSearch\VCatch\VCatch.exe  THIRD>> O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{D6E814A0-E0C5-11d4-8D29-0050BA6940E3}]
"ButtonText"="FlashGet"
"Default Visible"="Yes"
"Exec"="C:\\PROGRA~1\\FlashGet\\flashget.exe"
"HotIcon"="C:\\PROGRA~1\\FlashGet\\flashget.exe,128"
"Icon"="C:\\PROGRA~1\\FlashGet\\flashget.exe,223"
"CLSID"="{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"
"MenuStatusBar"="FlashGet"
"MenuText"="&FlashGet"
FOURTH>>>  O17 - HKLM\System\CCS\Services\Tcpip\..\{2959632D-AEC1-4EFB-B27E-5026D5EA176F}: NameServer = 205.188.146.146
FIFTH>>>O8 - Extra context menu item: Download All by FlashGet - C:\PROGRA~1\FlashGet\jc_all.htm
SIXTH>>>O8 - Extra context menu item: Download using FlashGet - C:\PROGRA~1\FlashGet\jc_link.htm
SEVENTH>>>O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{D6E814A0-E0C5-11d4-8D29-0050BA6940E3}]
"ButtonText"="FlashGet"
"Default Visible"="Yes"
"Exec"="C:\\PROGRA~1\\FlashGet\\flashget.exe"
"HotIcon"="C:\\PROGRA~1\\FlashGet\\flashget.exe,128"
"Icon"="C:\\PROGRA~1\\FlashGet\\flashget.exe,223"
"CLSID"="{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"
"MenuStatusBar"="FlashGet"
"MenuText"="&FlashGet"     IF, I delete these they seem to come back, what do you think is happening?  Thanks, Tom
0
 
tomseeAuthor Commented:
BTW: I have a good AntiVirus, with OutPost firewall, Script Sentry, Process Guard, SpyWare Blaster, Spyware Guard, Ewido Security Suite, Ad-Aware, SpyBot Search and Destroy
0
 
rindiCommented:
If you think you have gotten rid of spyware or virii, you have probably not disabled system restore (control panel, system). It is important to turn that "feature" off (I'm beginning to wonder if that is more a feature or a bug), as otherwise the bugs will be restored again.
0
 
rubiconxCommented:
They all appear to be backup files created using HijackThis - I presume you've used this at some stage.
Have you still got this installed?  Are you sure the files were growing in size?

As to why you can't delete them...!?  Unsure.  I suggest you switch off system restore...delete them...switch it back on again...and see if they come back!

To switch it off...

http://support.microsoft.com/default.aspx?scid=kb;%5BLN%5D;310405

presuming you have XP installed.

Dave
0
 
tomseeAuthor Commented:
I forgot to mention I do use HijackThis all the time. I can delete these backups! So you think it is HijackThis bringing them back? I this is so then I should have nothing to worry about them, Right"
0
 
rubiconxCommented:
When hijakthis 'fixes' something it creates a backup incase the change was an error.  It can then use the backup files to restore details if neccessary.  I believe you can configure these settings within the program.  

Providing the programs they refer to really aren't wanted then feel free to delete them.

Dave
0
 
tomseeAuthor Commented:
I see that they are associated with Flash Get and AWS weather bug, I really want to rid my pc once and for all of both of them. So you say to delete all backups and then turn off system restore, then restart the pc and then turn system restore back on, is this correct?
0
 
rubiconxCommented:
turn off system restore
delete files
turn system restore back on

This presumes that it is the system restore that is bringing them back.
0
 
rubiconxCommented:
You could run hijackthis...

click config..  (bottom right)
click backups (top middle)
delete approriate backups

0
 
tomseeAuthor Commented:
I just ran Hijack This and there was nothing in the backups at this time and the log looked good to me (nothing to fix) right now!
0
 
rubiconxCommented:
Try the system restore

I'm running out of ideas here!
0
 
tomseeAuthor Commented:
Ok, I will turn off system restore, delete the backups, then turn on system restore again.  I will give it 3 or 4 days to see if they come back and will let you know!  Thanks
0
 
rubiconxCommented:
Good luck!
0

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 11
  • 7
  • 3
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now