Re: "Uninstall" files

From: David H. Lipman (DLipman~nospam~_at_Verizon.Net)
Date: 02/27/04

Date: Thu, 26 Feb 2004 19:28:09 -0500


I could say something about AOL users but...I'll refrain :-)

It is NOT a virus it is a normal course of action when a post service pack Knowledge Base
update is installed. If you want to delete it, this is where XP finds the original files.
If you don't plan on removing KB828028 then it can be safely deleted.

The above holds true for Winb2K/WinXP for *any* %windir%\$NtUninstallKBxxxxxx$
Where; xxxxxx is the Knowledge Base number.

In addition:
If you post to UseNet with your TRUE, not a munged, email address then you have invited the
Swen Internet worm [aka; W32/Gibe-F] to visit you.

The Swen is news spelled backwards. The reason it is called this is because the Swen worm
harvests email addresses from UseNet News Groups. It has an engine that allows it to post
itself to UseNet News Groups as well as it has its own email engine. From the list of
email addresses that it has harvested, it will then email itself to those addresses.

I highly suggest that you get an AV package, you'll need it !

CA eTrust - - FREE for one year.


"Todd" <t o d d s h a r> wrote in message
| I have noticed more and more of this type of file in my
| Programs>Windows folder:
| $NtUninstallKB828028$
| Any thoughts?
| Thanks,
| Todd