BleepingComputer.com: Unquarantine isn't working

I chose to quarantine Kazaa on my computer because I don't like it. But along with taking out kazaa, it took out all my music that I've stored on my music from CD's I've legally purchased, as well as anything I've downloaded.
So I go into the quarantine section, check of kazaa, and tell it to unquarantine kazaa. Once I do that, it freezes. And then I get really angry. I've written microsoft, but they won't respond. So I'm hoping someone here can help. I can send anyone my error log from the program if you want it. Just ask here or write to (Mod Edited to remove email so spambots do not use it - Leurgy) with the subject "error log for microsoft antispyware". Please help, cause this is reallllly annoying.

This post has been edited by Leurgy: 11 May 2005 - 05:14 PM

I'll take a couple of shots at this, but they are just guesses.

1) Its not really freezing, but if you have a lot of music and incomplete downloads then the unquarantine will take some time. When you try to unquarantine, is your hard drive light on or flashing? If so you will need to wait until it stops.

2) Incomplete downloads with kazaa are .dat files. Do a search for *.dat or *.mp3 or *.mpg and see what you come up with. Chances are the completed tunes are in the same place. Set your computer to show hidden files.

3) Browse to Program Files/Microsoft AntiSpyware folder and look in there to see if your files are there. Again you need to be able to see hidden files.

4) MS Spyware can't unquarantine kazaa because it has seperately removed and deleted the spyware components and therefore the installation is incomplete.

HTH, but as I said, I'm guessing.

I had the exact same problem, i lost about 400 songs including a few episodes of some t.v. programmes. Kazaa was quarantined and i tried to unquarantine it and that worked fine, however after a reboot the kazaa folder was missing along with all my songs. I no longer use Kazaa as it has caused me too many problems and my new downloading program i use is not picked up as Adware by Microsoft Antispyware or anything else for that matter, so im assuming its ok.

Leurgy:
Here are my responses to your suggestions in order:

1) I'm pretty sure it's freezing, because the un-quarantine process doesn't even start; when i click to un-quarantine checked items after checking off kazaa, it stops moving before even bringing up the un-qauarantine status, and reports to be unresponsive in the task manager.

2) The files aren't in their original folder. They are all in Microsoft antispyware's quarantine folder, as I explain in the next part.

3) Under Microsoft's Antispyware quarantine folder, all the files have names that can't be identified to what their original names were. Examples of the names include

72D9638C-BBBC-4782-9063-F38140
F42D6054-CCD9-4F61-8259-8C2349

Obviously these names are changed and their real names are stored somewhere else so they couldn't damage my computer if they really were harmful. But these are definitely them, because the file sizes range from 500 KB (which i had some files of) to 600 MB (which i also had some files of).

4) Well, why would it delete anything if it's gonna go ahead and quarantine it? that just sucks... but as I said, there is a one folder in the quarantine section, and I only have Kazaa quarantined.

What does "HTH" mean? you wrote that at the end of your message. Anyway, thanks so far and try to get back to me.

HTH = Hope that helps.

Quote

I'm still guessing but here is what I think is going on, based on what I know about Kazaa.

When you install Kazaa you are really installing more than one program. Whatever malware is bundled with Kazaa is installed seperately so it runs all the time, whether Kazaa is running or not. MS Beta (Anti-Spyware) detects the seperate programs and deletes them. When Kazaa got quarantined it was done without the malware and I think that it won't restore without the malware.

I have used programs like Ad-Aware and Spybot to uninstall the Kazaa bundled spyware and then if you want to uninstall Kazaa you can't because of a missing file, cd_clint.dll. This is a file associated with CyDoor spyware. So in that case I reinstalled Kazaa, then uninstalled it and THEN I removed the spyware and that worked. This may work in your case. If you reinstall Kazaa you will need to disable the real time protection in MS Beta.

What I would do in this case is download the dummy cd_clint.dll (it fools the program into thinking its the real one but is not spyware capable) from here. Place it in C:\Winnt\System32 folder. Try the unquarantine.

Quote

If that doesn't work then I would reinstall Kazaa, try unquarantining (you may have to allow files to be over written), recover your files, move them somewhere else, uninstall Kazaa and then run the anti-spyware programs (MS Beta, Ad-Aware and Spybot) to get rid of the spyware.

HTH

This post has been edited by Leurgy: 16 May 2005 - 07:48 AM