I let it delete dw20.exe not sure if it was false or not

[tashi]

Hello VicVegas,

Information on How to report Possible False Positives

For assistance with an infection start a topic in the Malware Removal Forum and a volunteer analyst will advise when available.

First see that forum's FAQ which also includes instructions in post #2 on how to provide DDS/aswMBR logs, which are the logs used in the preliminary analysis.
http://forums.spybot.info/showthread.php?t=288

Best regards.

[VicVegas]

I checked and it seems I may not be the only person having the problem with MS Updates. Even better, I may have to reinstall .NET Framework altogether. Great.

OS: Windows XP Media Center Edition, Version 2002, Service Pack 3

Browser: FireFox 16.0.2

Spybot Version: Don't know, I foolishly updated and scanned after it occurred.

Where did the false positive occur: Teatimer message.

No log was produced because it wasn't from a scan...

[Yodama]

hello,

without the dw20.exe file in question I cannot confirm the false positive.
TeaTimer is not supposed to delete files belonging to Windows.

One way to recover the lost dw20.exe would be to perform a Windows repair installation
however this will take a long time and may require patches and service packs to be reinstalled.

Since Doctor Watson is only necessary for Windows error reporting, I am not sure if it is worth the trouble.

If you suspect an infection please provide the information Tashi requested.

[VicVegas]

The only reason I would assume it would catch dw20.exe is because it's OLD and as far as I know it isn't even used in newer versions of Office. Or it's not in the same location for newer versions anyway. I didn't find it on my Windows Vista or 7.

Like I said, I checked for where the real one should be for my version of Office and it isn't there, so I can only assume it was the legit file. I'll have to be more careful next time I get one of those messages.

None of my five scanners have so much as picked up a trace so I'll assume there's no infection. A few weird things here and there but most likely unrelated.

Moving on then...