Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss
[OT] MS Essentials goes awry
64 views
Skip to first unread message
W. eWatson
Sep 25, 2012, 11:54:24 PM9/25/12
to
I did a full scan with MSE and it found four problems. One was with
Adware OpenCandy, low severity. The other three had to do with Adobe,
high severity. When I try to use PC Clean to get rid of them, the
progress bar goes 3/4 of the way, and no further. I kill it and re-boot.
I've done this several times, and get nowhere. Is it time to call MS
support?
Adware OpenCandy, low severity. The other three had to do with Adobe,
high severity. When I try to use PC Clean to get rid of them, the
progress bar goes 3/4 of the way, and no further. I kill it and re-boot.
I've done this several times, and get nowhere. Is it time to call MS
support?
David H. Lipman
Sep 26, 2012, 9:06:11 AM9/26/12
to
From: "W. eWatson" <wolft...@invalid.com>
This subject matter is not "OT".
You said "The other three had to do with Adobe, high severity" but failed to
provide actual details.
Since Adobe creates legitimate software, I will presume these three high
severity Adobe related alerts were associated with Adobe software
vulnerabilities. PC Clean ? You can not "clean" vulnerabilities, you must
mitigate them through patches, updates, HotFixes or new versions.
--
Dave
Multi-AV Scanning Tool - http://multi-av.thespykiller.co.uk
http://www.pctipp.ch/downloads/dl/35905.asp
You said "The other three had to do with Adobe, high severity" but failed to
provide actual details.
Since Adobe creates legitimate software, I will presume these three high
severity Adobe related alerts were associated with Adobe software
vulnerabilities. PC Clean ? You can not "clean" vulnerabilities, you must
mitigate them through patches, updates, HotFixes or new versions.
--
Dave
Multi-AV Scanning Tool - http://multi-av.thespykiller.co.uk
http://www.pctipp.ch/downloads/dl/35905.asp
W. eWatson
Sep 26, 2012, 11:59:03 AM9/26/12
to
On 9/26/2012 6:06 AM, David H. Lipman wrote:
> From: "W. eWatson" <wolft...@invalid.com>
>
>> I did a full scan with MSE and it found four problems. One was with
>> Adware OpenCandy, low severity. The other three had to do with Adobe,
>> high severity. When I try to use PC Clean to get rid of them, the
>> progress bar goes 3/4 of the way, and no further. I kill it and
>> re-boot. I've done this several times, and get nowhere. Is it time to
>> call MS support?
>
> This subject matter is not "OT".
>
> You said "The other three had to do with Adobe, high severity" but
> failed to provide actual details.
>
> Since Adobe creates legitimate software, I will presume these three high
> severity Adobe related alerts were associated with Adobe software
> vulnerabilities. PC Clean ? You can not "clean" vulnerabilities, you
> must mitigate them through patches, updates, HotFixes or new versions.
>
The reason for little details was that I could not get MSE up. Things
> From: "W. eWatson" <wolft...@invalid.com>
>
>> I did a full scan with MSE and it found four problems. One was with
>> Adware OpenCandy, low severity. The other three had to do with Adobe,
>> high severity. When I try to use PC Clean to get rid of them, the
>> progress bar goes 3/4 of the way, and no further. I kill it and
>> re-boot. I've done this several times, and get nowhere. Is it time to
>> call MS support?
>
> This subject matter is not "OT".
>
> You said "The other three had to do with Adobe, high severity" but
> failed to provide actual details.
>
> Since Adobe creates legitimate software, I will presume these three high
> severity Adobe related alerts were associated with Adobe software
> vulnerabilities. PC Clean ? You can not "clean" vulnerabilities, you
> must mitigate them through patches, updates, HotFixes or new versions.
>
are different now.
MSE Home has a button called Clean PC and a large exclamation button.
The ! button say a potential threat has been detected. It also says to
complete the cleanup, you'll need to restart your PC. If I press Clean
PC Show details, it shows Adware:Win32/OpenCandy, Alert level low.
Strangely, no Adobe items listed.
I just pressed Clean PC, and the green progress bar is working its way
along. It's taken about 20 seconds to go 3/4 of the way. I just came
back 5 minutes long, and the bar is not present, and Clean PC is
replaced by Restart now. Amazing! It certainly didn't behave that way
last night. Well, let's see what happens if I reboot.
W. eWatson
Sep 26, 2012, 12:10:23 PM9/26/12
to
...
carrying viruses. In the last six months, each time I've started up my
PC, an Adobe Dialog to update is present. Flash, I think. I refuse the
update; however, several days ago I accepted it, thinking well maybe I
do need an update, since I had some slight video problem recently.
>> Since Adobe creates legitimate software, I will presume these three high
>> severity Adobe related alerts were associated with Adobe software
>> vulnerabilities. PC Clean ? You can not "clean" vulnerabilities, you
>> must mitigate them through patches, updates, HotFixes or new versions.
>>
> The reason for little details was that I could not get MSE up. Things
> are different now.
>
> MSE Home has a button called Clean PC and a large exclamation button.
> The ! button say a potential threat has been detected. It also says to
> complete the cleanup, you'll need to restart your PC. If I press Clean
> PC Show details, it shows Adware:Win32/OpenCandy, Alert level low.
> Strangely, no Adobe items listed.
>
> I just pressed Clean PC, and the green progress bar is working its way
> along. It's taken about 20 seconds to go 3/4 of the way. I just came
> back 5 minutes long, and the bar is not present, and Clean PC is
> replaced by Restart now. Amazing! It certainly didn't behave that way
> last night. Well, let's see what happens if I reboot.
The same Adware threat is there. BTW, Adobe updates are known for
>> severity Adobe related alerts were associated with Adobe software
>> vulnerabilities. PC Clean ? You can not "clean" vulnerabilities, you
>> must mitigate them through patches, updates, HotFixes or new versions.
>>
> The reason for little details was that I could not get MSE up. Things
> are different now.
>
> MSE Home has a button called Clean PC and a large exclamation button.
> The ! button say a potential threat has been detected. It also says to
> complete the cleanup, you'll need to restart your PC. If I press Clean
> PC Show details, it shows Adware:Win32/OpenCandy, Alert level low.
> Strangely, no Adobe items listed.
>
> I just pressed Clean PC, and the green progress bar is working its way
> along. It's taken about 20 seconds to go 3/4 of the way. I just came
> back 5 minutes long, and the bar is not present, and Clean PC is
> replaced by Restart now. Amazing! It certainly didn't behave that way
> last night. Well, let's see what happens if I reboot.
carrying viruses. In the last six months, each time I've started up my
PC, an Adobe Dialog to update is present. Flash, I think. I refuse the
update; however, several days ago I accepted it, thinking well maybe I
do need an update, since I had some slight video problem recently.
David H. Lipman
Sep 26, 2012, 12:51:59 PM9/26/12
to
From: "W. eWatson" <wolft...@invalid.com>
> The same Adware threat is there. BTW, Adobe updates are known for carrying viruses. In
> the last six months, each time I've started up my PC, an Adobe Dialog to update is
> present. Flash, I think. I refuse the update; however, several days ago I accepted it,
> thinking well maybe I do need an update, since I had some slight video problem recently.
Adobe updates are NOT known for carrying any form of malware inclusive of the small subset
of malware called "viruses".
Please obtain and post log snippets of the OpenCandy and Adobe related events.
BTW: OpenCandy is related to a software downloader this is packaged around a software
installer. For example, say you wanted to download software application called Widget.
You go to their web site and you download a small EXE file. You run that thinking you are
installing Widget. Instead the EXE downloads the real Widget installer and some
non-associsted crapware.
Their own words...
"OpenCandy provides a plug-in that developers include in their software to earn money by
showing recommendations for other software in their installers. Developers use this money
to keep their software free and invest in further software development.
The installer uses the OpenCandy plug-in to present a software recommendation (such as the
one below) during installation. You have complete control to accept the software
recommendation by selecting either the “Install” or “Do not install” options on the
software recommendation screen."
The detection of OpenCandy as "adware" is justified.
> The same Adware threat is there. BTW, Adobe updates are known for carrying viruses. In
> the last six months, each time I've started up my PC, an Adobe Dialog to update is
> present. Flash, I think. I refuse the update; however, several days ago I accepted it,
> thinking well maybe I do need an update, since I had some slight video problem recently.
of malware called "viruses".
Please obtain and post log snippets of the OpenCandy and Adobe related events.
BTW: OpenCandy is related to a software downloader this is packaged around a software
installer. For example, say you wanted to download software application called Widget.
You go to their web site and you download a small EXE file. You run that thinking you are
installing Widget. Instead the EXE downloads the real Widget installer and some
non-associsted crapware.
Their own words...
"OpenCandy provides a plug-in that developers include in their software to earn money by
showing recommendations for other software in their installers. Developers use this money
to keep their software free and invest in further software development.
The installer uses the OpenCandy plug-in to present a software recommendation (such as the
one below) during installation. You have complete control to accept the software
recommendation by selecting either the “Install” or “Do not install” options on the
software recommendation screen."
The detection of OpenCandy as "adware" is justified.
W. eWatson
Sep 26, 2012, 1:43:31 PM9/26/12
to
to collect snippets or Adobe events. A Win7 search (desktop icon) shows
no references to Adware. I see on their web site a removal tool. How
many of these "things" lurk out there that might get stuck on a computer?
In two hours I will be gone on a trip until returning Saturday.
David H. Lipman
Sep 26, 2012, 4:44:03 PM9/26/12
to
From: "W. eWatson" <wolft...@invalid.com>
> I have no use for OpenCandy that I know of. I have no knowledge of how to
> collect snippets or Adobe events. A Win7 search (desktop icon) shows no
> references to Adware. I see on their web site a removal tool. How many of
> these "things" lurk out there that might get stuck on a computer?
>
> In two hours I will be gone on a trip until returning Saturday.
I am referring to log snippets extracted from Microsoft Security Essentials
(MSE) showing the EXACT events surrounding OpenCandy adware and Adobe
related "high severity" events.
This information is critical to the root of the situation and to determine a
recourse/course of action.
I have actively been in this news group for almost 10 years. I can wait
until you will return but I do need you to go into MSE and extract that
requested, and pertinent, information.
> I have no use for OpenCandy that I know of. I have no knowledge of how to
> collect snippets or Adobe events. A Win7 search (desktop icon) shows no
> references to Adware. I see on their web site a removal tool. How many of
> these "things" lurk out there that might get stuck on a computer?
>
> In two hours I will be gone on a trip until returning Saturday.
(MSE) showing the EXACT events surrounding OpenCandy adware and Adobe
related "high severity" events.
This information is critical to the root of the situation and to determine a
recourse/course of action.
I have actively been in this news group for almost 10 years. I can wait
until you will return but I do need you to go into MSE and extract that
requested, and pertinent, information.
W. eWatson
Sep 28, 2012, 11:53:30 PM9/28/12
to
On 9/26/2012 1:44 PM, David H. Lipman wrote:
> From: "W. eWatson" <wolft...@invalid.com>
>
>
>> I have no use for OpenCandy that I know of. I have no knowledge of how
>> to collect snippets or Adobe events. A Win7 search (desktop icon)
>> shows no references to Adware. I see on their web site a removal tool.
>> How many of these "things" lurk out there that might get stuck on a
>> computer?
>>
>> In two hours I will be gone on a trip until returning Saturday.
>
> I am referring to log snippets extracted from Microsoft Security
> Essentials (MSE) showing the EXACT events surrounding OpenCandy adware
> and Adobe related "high severity" events.
>
> This information is critical to the root of the situation and to
> determine a recourse/course of action.
>
> I have actively been in this news group for almost 10 years. I can wait
> until you will return but I do need you to go into MSE and extract that
> requested, and pertinent, information.
>
>
Do you mean the history? I don't think I can copy and paste. I found
> From: "W. eWatson" <wolft...@invalid.com>
>
>
>> I have no use for OpenCandy that I know of. I have no knowledge of how
>> to collect snippets or Adobe events. A Win7 search (desktop icon)
>> shows no references to Adware. I see on their web site a removal tool.
>> How many of these "things" lurk out there that might get stuck on a
>> computer?
>>
>> In two hours I will be gone on a trip until returning Saturday.
>
> I am referring to log snippets extracted from Microsoft Security
> Essentials (MSE) showing the EXACT events surrounding OpenCandy adware
> and Adobe related "high severity" events.
>
> This information is critical to the root of the situation and to
> determine a recourse/course of action.
>
> I have actively been in this news group for almost 10 years. I can wait
> until you will return but I do need you to go into MSE and extract that
> requested, and pertinent, information.
>
>
an OpenCandy web site and they offer a way to remove it. Should I?
David H. Lipman
Sep 29, 2012, 8:39:41 AM9/29/12
to
From: "W. eWatson" <wolft...@invalid.com>
All AV applications log events. I doubt MSE is an exception. I would like the associated
log events text (as full as possible) in your reply.
Defer OpenCandy's removal instructions for a later time.
log events text (as full as possible) in your reply.
Defer OpenCandy's removal instructions for a later time.
W. eWatson
Sep 29, 2012, 1:09:14 PM9/29/12
to
On 9/29/2012 5:39 AM, David H. Lipman wrote:
> From: "W. eWatson" <wolft...@invalid.com>
>
>> On 9/26/2012 1:44 PM, David H. Lipman wrote:
>>> From: "W. eWatson" <wolft...@invalid.com>
>>>
>>>
>>>> I have no use for OpenCandy that I know of. I have no knowledge of how
>>>> to collect snippets or Adobe events. A Win7 search (desktop icon)
>>>> shows no references to Adware. I see on their web site a removal tool.
>>>> How many of these "things" lurk out there that might get stuck on a
>>>> computer?
>>>>
>>>> In two hours I will be gone on a trip until returning Saturday.
>>>
>>> I am referring to log snippets extracted from Microsoft Security
>>> Essentials (MSE) showing the EXACT events surrounding OpenCandy adware
>>> and Adobe related "high severity" events.
>>>
>>> This information is critical to the root of the situation and to
>>> determine a recourse/course of action.
>>>
>>> I have actively been in this news group for almost 10 years. I can wait
>>> until you will return but I do need you to go into MSE and extract that
>>> requested, and pertinent, information.
>>>
>>>
>> Do you mean the history? I don't think I can copy and paste. I found an OpenCandy web
>> site and they offer a way to remove it. Should I?
>
> All AV applications log events. I doubt MSE is an exception. I would like the associated
> log events text (as full as possible) in your reply.
>
> Defer OpenCandy's removal instructions for a later time.
>
AV?
> From: "W. eWatson" <wolft...@invalid.com>
>
>> On 9/26/2012 1:44 PM, David H. Lipman wrote:
>>> From: "W. eWatson" <wolft...@invalid.com>
>>>
>>>
>>>> I have no use for OpenCandy that I know of. I have no knowledge of how
>>>> to collect snippets or Adobe events. A Win7 search (desktop icon)
>>>> shows no references to Adware. I see on their web site a removal tool.
>>>> How many of these "things" lurk out there that might get stuck on a
>>>> computer?
>>>>
>>>> In two hours I will be gone on a trip until returning Saturday.
>>>
>>> I am referring to log snippets extracted from Microsoft Security
>>> Essentials (MSE) showing the EXACT events surrounding OpenCandy adware
>>> and Adobe related "high severity" events.
>>>
>>> This information is critical to the root of the situation and to
>>> determine a recourse/course of action.
>>>
>>> I have actively been in this news group for almost 10 years. I can wait
>>> until you will return but I do need you to go into MSE and extract that
>>> requested, and pertinent, information.
>>>
>>>
>> Do you mean the history? I don't think I can copy and paste. I found an OpenCandy web
>> site and they offer a way to remove it. Should I?
>
> All AV applications log events. I doubt MSE is an exception. I would like the associated
> log events text (as full as possible) in your reply.
>
> Defer OpenCandy's removal instructions for a later time.
>
W. eWatson
Sep 29, 2012, 1:14:29 PM9/29/12
to
OK, I figured it out. MS has AV msessential.exe AV tool for MSE. So you
want me to run it.
want me to run it.
David H. Lipman
Sep 30, 2012, 6:31:14 PM9/30/12
to
From: "W. eWatson" <wolft...@invalid.com>
> OK, I figured it out. MS has AV msessential.exe AV tool for MSE. So you
> want me to run it.
I want you to run what ever the management software is for MSE that will
show the event log. Please extract requested, related, events.
> OK, I figured it out. MS has AV msessential.exe AV tool for MSE. So you
> want me to run it.
show the event log. Please extract requested, related, events.
W. eWatson
Sep 30, 2012, 6:57:40 PM9/30/12
to
On 9/30/2012 3:31 PM, David H. Lipman wrote:
> From: "W. eWatson" <wolft...@invalid.com>
>
>> OK, I figured it out. MS has AV msessential.exe AV tool for MSE. So
>> you want me to run it.
>
> I want you to run what ever the management software is for MSE that will
> show the event log. Please extract requested, related, events.
>
There is no such facility. I'm looking at MSE, and it shows four tabs.
> From: "W. eWatson" <wolft...@invalid.com>
>
>> OK, I figured it out. MS has AV msessential.exe AV tool for MSE. So
>> you want me to run it.
>
> I want you to run what ever the management software is for MSE that will
> show the event log. Please extract requested, related, events.
>
Home, Update, History, and Settings. None of them offer anyway to access
a log.
Somehow in trying to figure this out, MS wanted me to update
antispyware, so I allowed it to do so. I no longer see OpenCandy in the
history area. There are three items there. All severe and all
quarantined. They are all related to Java.
If you cannot tell me how to get the log you desired, I'll call this
quits and remove the three items.
David H. Lipman
Oct 1, 2012, 9:18:09 AM10/1/12
to
From: "W. eWatson" <wolft...@invalid.com>
http://answers.microsoft.com/en-us/protect/forum/mse-protect_start/where-does-microsoft-security-essentials-keep-a/f1e4ecb9-ef17-466a-a18d-27cde9afea78
MSE uses the Event Viwer as stated above and it has instruction to open it.
MSE uses the Event Viwer as stated above and it has instruction to open it.
W. eWatson
Oct 1, 2012, 3:46:44 PM10/1/12
to
On 10/1/2012 6:18 AM, David H. Lipman wrote:
> From: "W. eWatson" <wolft...@invalid.com>
>
>> On 9/30/2012 3:31 PM, David H. Lipman wrote:
>>> From: "W. eWatson" <wolft...@invalid.com>
>>>
>>>> OK, I figured it out. MS has AV msessential.exe AV tool for MSE. So
>>>> you want me to run it.
>>>
>>> I want you to run what ever the management software is for MSE that will
>>> show the event log. Please extract requested, related, events.
>>>
>> There is no such facility. I'm looking at MSE, and it shows four tabs.
>> Home, Update, History, and Settings. None of them offer anyway to
>> access a log.
>>
>> Somehow in trying to figure this out, MS wanted me to update
>> antispyware, so I allowed it to do so. I no longer see OpenCandy in
>> the history area. There are three items there. All severe and all
>> quarantined. They are all related to Java.
>>
>> If you cannot tell me how to get the log you desired, I'll call this
>> quits and remove the three items.
>>
>
>
> http://answers.microsoft.com/en-us/protect/forum/mse-protect_start/where-does-microsoft-security-essentials-keep-a/f1e4ecb9-ef17-466a-a18d-27cde9afea78
>
>
> MSE uses the Event Viwer as stated above and it has instruction to open it.
>
Yes, let's call it quits.
> From: "W. eWatson" <wolft...@invalid.com>
>
>> On 9/30/2012 3:31 PM, David H. Lipman wrote:
>>> From: "W. eWatson" <wolft...@invalid.com>
>>>
>>>> OK, I figured it out. MS has AV msessential.exe AV tool for MSE. So
>>>> you want me to run it.
>>>
>>> I want you to run what ever the management software is for MSE that will
>>> show the event log. Please extract requested, related, events.
>>>
>> There is no such facility. I'm looking at MSE, and it shows four tabs.
>> Home, Update, History, and Settings. None of them offer anyway to
>> access a log.
>>
>> Somehow in trying to figure this out, MS wanted me to update
>> antispyware, so I allowed it to do so. I no longer see OpenCandy in
>> the history area. There are three items there. All severe and all
>> quarantined. They are all related to Java.
>>
>> If you cannot tell me how to get the log you desired, I'll call this
>> quits and remove the three items.
>>
>
>
> http://answers.microsoft.com/en-us/protect/forum/mse-protect_start/where-does-microsoft-security-essentials-keep-a/f1e4ecb9-ef17-466a-a18d-27cde9afea78
>
>
> MSE uses the Event Viwer as stated above and it has instruction to open it.
>
David H. Lipman
Oct 1, 2012, 4:51:24 PM10/1/12
to
0 new messages