Re: "Uninstall" files

From: David H. Lipman (DLipman~nospam~_at_Verizon.Net)
Date: 02/27/04


Date: Thu, 26 Feb 2004 19:28:09 -0500

Yes....

I could say something about AOL users but...I'll refrain :-)

It is NOT a virus it is a normal course of action when a post service pack Knowledge Base
update is installed. If you want to delete it, this is where XP finds the original files.
If you don't plan on removing KB828028 then it can be safely deleted.

The above holds true for Winb2K/WinXP for *any* %windir%\$NtUninstallKBxxxxxx$
directory.
Where; xxxxxx is the Knowledge Base number.

In addition:
If you post to UseNet with your TRUE, not a munged, email address then you have invited the
Swen Internet worm [aka; W32/Gibe-F] to visit you.

The Swen is news spelled backwards. The reason it is called this is because the Swen worm
harvests email addresses from UseNet News Groups. It has an engine that allows it to post
itself to UseNet News Groups as well as it has its own email engine. From the list of
email addresses that it has harvested, it will then email itself to those addresses.

I highly suggest that you get an AV package, you'll need it !

AVAST - http://www.avast.com/i_idt_1016.html - FREE
AVG - http://www.grisoft.com/us/us_dwnl_free.php - FREE
CA eTrust - http://www.my-etrust.com/microsoft/index.cfm - FREE for one year.

Dave

"Todd" <t o d d s h a r @aol.com> wrote in message
news:2ce501c3fcc6$cc6178d0$a401280a@phx.gbl...
| I have noticed more and more of this type of file in my
| Programs>Windows folder:
|
| $NtUninstallKB828028$
|
| Any thoughts?
|
| Thanks,
| Todd



Relevant Pages

  • Re: Virus
    ... Swen Internet worm to visit you. ... harvests email addresses from UseNet News Groups. ... itself to UseNet News Groups as well as it has its own email engine. ...
    (microsoft.public.security.virus)
  • Re: Virus
    ... |>harvests email addresses from UseNet News Groups. ... |>|>My system has got a virus that has disabled my Norman ...
    (microsoft.public.scripting.virus.discussion)
  • Re: Win 98 Ctrl Alt Delete Shows Multiple Delwebi ?
    ... harvests email addresses from UseNet News Groups. ... itself to UseNet News Groups as well as it has its own email engine. ... | Delwebi - performance improves. ...
    (microsoft.public.security.virus)
  • Re: myoffer2u.com What is it????
    ... because the Swen worm ... > harvests email addresses from UseNet News Groups. ... > itself to UseNet News Groups as well as it has its own email engine. ...
    (microsoft.public.security.virus)
  • Re: TXHMOND9LU Virus I think Help
    ... > Please go to one or more of the below online scanners and perform a scan ... > harvests email addresses from UseNet News Groups. ... > itself to UseNet News Groups as well as it has its own email engine. ...
    (microsoft.public.scripting.virus.discussion)