Windows 10: unknown.log appearing in Windows Defender Service folder

I've had another thread about trying to get rid of the wacatac trojan which Windows Defender keeps reporting and blocking:

Virus Trojan:32/Wacatac.DC!ml not completely remediated on Windows PC

Once everything is clean, I shut down my PC (after running adaware, ccleaner, emissoft and WD) plus ensuring that the WD Service History folder was empty (someone suggested that this was a false positive coming from logs in that file).

However, when I restart my computer a file called unknown.log shows up in the WD Service folder. Can anyone shed light on this file? Could this have any bearing on the wacatac trojan? Note, no other antivirus program (I've tried several) has ever found a problem except for WD.

I am running the latest version of W10.

:)

 

Folder appears unknown

2 New folders have appeared unknown source, and will not delete.

Admin (PC) and bev (joe-pc).

They also appear under software in device manager. What gives? I have Bitdefender AV. I cannot ID which folder they are under. Listed under "This PC"

 

Windows Updates failed to instal

I'm not sure how differant XP media center Edition is but you could clear the history \ cache if these folders are there.

Step 1 Register DLL files.

=================

By trying this step, we can check if the update engines are working properly.



1. Close all instances of Internet Explorer.

2. Click Start and Run, type "Regsvr32 atl.dll" (without quotes) in the Open box and click OK.



Note: There is a space between regsvr32 and atl.dll



3. Similarly, one by one, register the files listed below:



Regsvr32 msxml3.dll

Regsvr32 wuapi.dll

Regsvr32 wuaueng.dll

Regsvr32 wuaueng1.dll

Regsvr32 wups2.dll

Regsvr32 wucltui.dll

Regsvr32 wups.dll

Regsvr32 wuweb.dll

Regsvr32 qmgr.dll

Regsvr32 qmgrprxy.dll

Regsvr32 jscript.dll



Note: If you encounter errors while registering any of these files then skip that file and continue with the next one.



If the issue persists, let's move on to the steps below to verify Windows Update services and temporary folders.



Step 2 Verify the relevant Windows Update services.

=========================================

1. Click Start->Run, type "services.msc" (without quotation marks) in the open box and click OK.

2. Double click the service "Automatic Updates".

3. Click on the Log On tab, please ensure the option "Local System account" is selected and the option "Allow service to interact with desktop" is unchecked.

4. Check if this service has been enabled on the listed Hardware Profile. If not, please click the Enable button to enable it.

5. Click on the tab "General "; make sure the "Startup Type" is "Automatic" or "Manual". Then please click the button "Stop" under "Service Status" to stop the service.

6. Then please click the button "Start" under "Service Status" to start the service.

7. Please repeat the above steps with the other services:



Background Intelligent Transfer Service

Event Log

Remote Procedure Call (RPC)



Note: Event log service is enabled on all of the hardware profiles; this service does not have an option to enable or disable on certain hardware profile.



If it still does not help, let's proceed to step 3.



Step 3 Reload the Update temporary folders.

===================================

One possible cause is that the temporary folder for Windows Update is containing corrupted files. Let's erase all the files there to get the system clean.



1. Click Start, Run, type: cmd and press Enter. Please run the following command in the opened window.



Net stop WuAuServ



2. Click Start, Run, type: %windir% and press Enter.

3. In the opened folder, rename the folder SoftwareDistribution to Sdold.

4. Click Start, Run, type: cmd and press Enter. Please run the following command in the opened window.



Net start WuAuServ



Please test the Windows Update website and let me know the result. If the issue persists, to clarify the issue and provide more accurate troubleshooting steps, please assist me in collecting the following information.

 

Securing Windows 2000/XP/Server 2003 services HOW TO

I will try changing their settings sometime, the one thing I've noticed about this guide is that it doesn't list the Windows services that NEED to be left as local system, so some people might not be too sure what they're doing and worry about any that aren't listed. Just a suggestion that you might want to include in any future revisions. *Smile

The non-default ones I have that you have not listed are:

.Net Runtime Optimization Service v2.0.50727_X86
Ati HotKey Poller
ATI Smart
AVG E-mail Scanner
AVG7 Alert Manager Server
AVG7 Update Service
BlueSoleil Hid Service
Bluetooth Support Service
ewido anti-spyware 4.0 guard
iPod Service
Messenger Sharing USN Journal Reader Service
Service Layer
Windows Defender Service

The problem is that the only ones of these I actually use are The AVG and Windows Defender services and occasionally the "Service Layer" service (related to Nokia PC Suite) and the "Messenger Sharing USN Journal Reader Service" (related to WindowsLive Messenger). Anyway, I'll see how much I can secure those and post back how I get on. I'll try to test it sometime this week just I'm a bit waring of changing the AVG settings because the only way to test if it was still working would be for a virus to be detected... and I' rather I didn't get viruses!