Windows PC Backup Wizard Setup - good or bad?

Page 2 of 3 FirstFirst 123 LastLast

  1. Posts : 25,847
    Windows 10 Pro. 64/ version 1709 Windows 7 Pro/64
       #11

    Good idea Derek.

    AdwCleaner Download

    That is why I asked the question. To know whether the program was install intentionally by the owner/operator of the computer.

    The program might also be in msconfig/Startup or Services.

    What I don't know is if bula79 intended to install this program or it snuck in his/her computer.

    When I Google Windows PC Backup Wizard I find many things. Here are a couple.
    Their are many more.

    Set up or change automatic backup settings - Windows Help

    https://www.barracuda.com/products/backup?&a=[google_na]backup_search&grp=cloud_backup&ad=53122840341&kw=backup%20cloud&gclid=CKvz9sDzrsYCFdgBgQode6MAuw
      My Computer


  2. Posts : 17,322
    Win 10 Pro x64
       #12

    I doubt it was installed intentionally, probably in some installer. Sounds too aggressive to be bloatware too.

    Interesting that MBAM didn't see it as a threat...
      My Computer


  3. Posts : 25,847
    Windows 10 Pro. 64/ version 1709 Windows 7 Pro/64
       #13

    Well some of these Windows Backup programs are okay and downloaded by the operator and some are not okay and are a PUP that snuck in without the operator knowledge.

    If it is a okay program intentionally installed by the owner, then Malwarebytes would not stop it.

    A little more information from bula would be helpful.
      My Computer


  4. Posts : 7
    Windows 7 Home Premium 32 bit
    Thread Starter
       #14

    To be clear this is not my computer, I am a field technician and it is one of our clients computers. The client did not start receiving this message until a few days ago. It was definitely not installed intentionally.

    I have not heard of AdwCleaner before. Do you think running this could pick up something that MalwareBytes may have missed?

    Also, the clients Symantec Endpoint Protection definitions were out of date by about 6 months (I had no control over this). When I mentioned this to my boss he said running a scan with up to date definitions wouldn't pick up anything if Malwarebytes didn't pick it up. I'm not sure if I buy that though.

    And lastly the Windows automatic updates were set to manual (again, I had no control over this) and there were about 130+ updates that I installed when I was there. Is it possible that the issue could go away after installing the updates? My guess is probably not.
    Last edited by bula79; 27 Jun 2015 at 13:36. Reason: added more information
      My Computer


  5. Posts : 25,847
    Windows 10 Pro. 64/ version 1709 Windows 7 Pro/64
       #15

    Well well well all kinds of new information. Thank

    AdwCleaner is use by many forum members and it does work well.

    I would recommend getting it from the Bleeping Computer site.

    AdwCleaner Download


    Windows PC Backup Wizard Setup - good or bad?-adwcleaner-1-2-.jpg
      My Computer


  6. Posts : 3
    Windows 7 Ultimate x64
       #16

    I just solved this issue...


    I found the culprit, and it's not picked up by most adware/virus cleaners as of yet.

    The .exe launcher for this file is located in a folder called PCWDownloader in Program Files / Program Files (x86). Delete the PCWDownloader and PCWUpdated folders, remove references to them in the Registry and remove any scheduled tasks regarding these folders in the Task Scheduler.

    As of the time of this post, you have to manually remove this particular pop-up.
      My Computer


  7. Posts : 25,847
    Windows 10 Pro. 64/ version 1709 Windows 7 Pro/64
       #17

    Any computer that was that far behind in updates could of gathered anything if the computer goes on line.

    Is this a company computer?
    What Windows 7 is being used?
    Does this computer access a company domain or network?


    The reason I ask is according to your posted picture the computer is using a SSL connection for this program. My thinking is a infection/PUP would not be using such a connection and the installed backup program hasn't been used just like the security updates haven't been kept up with.

    Is this program found in Add and Remove and if so what does the properties claim as the owner?
    Example:
    *Microsoft
    *Carbonite
    Does this program show up in msconfig/Startup or Services?

    What I'm trying to do is do no harm.
    This computer is not yours or is it mine.
    So I'm trying not to remove something that should be there but has just been neglected by the user of the computer.

    Completing this tutorial by Brink could shine some light on things.
    Post the log here in this thread.

    Windows Genuine and Activation Issue Posting Instructions

    Completing this would also be helpful. Just post the information here also.

    System Info - See Your System Specs
      My Computer


  8. Posts : 1,102
    OEM Windows 7 Ult (x64) SP1
       #18

    derekimo said:
    I doubt it was installed intentionally, probably in some installer. Sounds too aggressive to be bloatware too.

    Interesting that MBAM didn't see it as a threat...
    shlack123 said:
    I found the culprit, and it's not picked up by most adware/virus cleaners as of yet. <snip>
    MBAM is pretty aggressive about PUPs, but it does not pick up all adware.

    If you have a sample of a possible PUP or malware that is not yet in the MBAM database, you may wish to submit the sample to the Research Team.

    Instructions for doing so are HERE and HERE
    The Research Center forum for Rogues is HERE and for malware is HERE

    Cheers,
      My Computer


  9. Posts : 3
    Windows 7 Ultimate x64
       #19

    Regarding AdwCleaner and Malwarebytes on this issue


    I've already submitted a sample to both software developers.

    As for the removal, the "Windows PC Backup Wizard" is a manual-removal pop-up for now. As with all malware/spyware databases, it takes time for these types of things to make it into mainstream databases for automatic removal, which is why I have taken the time to post the manual removal method.

    Adwcleaner, at the time of my post, does NOT remove this particular pop-up. This pop-up is nothing more than an executable called by a Scheduled Task within Windows Task Scheduler. It is referenced in the Registry as well, but it isn't in any autorun directories.

    I'm only trying to help a fellow tech with this pop-up as I had to deal with it merely a couple of hours ago, and I know first-hand that as of today, June 27, 2015, this pop-up isn't detected by Malwarebytes, Adwcleaner, or any other mainstream antivirus tool. It is new, and I have sent a sample to the powers that be.
      My Computer


  10. Posts : 3
    Windows 7 Ultimate x64
       #20

    MoxieMomma said:
    derekimo said:
    I doubt it was installed intentionally, probably in some installer. Sounds too aggressive to be bloatware too.

    Interesting that MBAM didn't see it as a threat...
    shlack123 said:
    I found the culprit, and it's not picked up by most adware/virus cleaners as of yet. <snip>
    MBAM is pretty aggressive about PUPs, but it does not pick up all adware.

    If you have a sample of a possible PUP or malware that is not yet in the MBAM database, you may wish to submit the sample to the Research Team.

    Instructions for doing so are HERE and HERE
    The Research Center forum for Rogues is HERE and for malware is HERE

    Cheers,
    It's not an installed program, which is why Mbam doesn't pick it up as a PUP - it's simply a Scheduled Task that calls on an executable that is placed into the Program Files folder. When searching for this file in the Registry, it isn't in any of the program files directories - only the Scheduled Task references.
      My Computer


 
Page 2 of 3 FirstFirst 123 LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 12:13.
Find Us