The Proof behind just how worthless Windows One care really is.


Recommended Posts

Log file post from SuperAntispyware at the bottom of this post

I was working on a Vista laptop for a customer. All appeared well. No virus or spyware / malware or Trojan warnings. The customer was running windows one care. he didn't have service pack 1 so I installed it. Along will all the latest updates. But I noticed his task manager was disabled. To me that spells "your infected with something".

So I downloaded a copy of SuperAntispyware and did a full system scan. Keep in mind that according to one cares information, it was recently updated and recently did a full system scan with no problems detected.

I think the screenshots speak for themselves.

SuperAntispyware

capturekt2.jpg

Windows One Care

capture1ug6.jpg

Now I do realize other antiviruses could have failed just as miserably. But one care was the one on the system and at lease now we know at lease one worthless AV on the market.

Once that got done I opened defender which said it had not done a scan in 65 days. So I do a scan. It finds nothing.

Next I do a scan with Spybot Search and destroy.

Once again the screenshots speak for themselves.

Windows Defender

defednerhs0.jpg

Spybot Search and Destroy.

spybotuz4.jpg

List of files found in the Superantispyare Log file

C:\PROGRAM FILES\SEARCH SETTINGS\KB125\SEARCHSETTINGS.DLL

Rogue.AntiSpyStorm

C:\Program Files\AntispyStorm\AntispyStorm.exe.MANIFEST

C:\Program Files\AntispyStorm\config.dat

C:\Program Files\AntispyStorm\filesbase.bin

C:\Program Files\AntispyStorm\global_virus_table.bin

C:\Program Files\AntispyStorm\ignoredomainsbase.bin

C:\Program Files\AntispyStorm\ignorefilesbase.bin

C:\Program Files\AntispyStorm\ignoreregsbase.bin

C:\Program Files\AntispyStorm\mdReg.dll

C:\Program Files\AntispyStorm\parser.exe

C:\Program Files\AntispyStorm\regbase.bin

C:\Program Files\AntispyStorm\stat.bin

C:\Program Files\AntispyStorm\uninstall.exe

C:\Program Files\AntispyStorm\uninstall.log

C:\Program Files\AntispyStorm\urlbase.bin

C:\Program Files\AntispyStorm

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AntispyStorm\Uninstall AntispyStorm.lnk

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AntispyStorm

Trojan.Unclassified/NVCOI

C:\Program Files\Temporary

Adware.AdSponsor/ISM

C:\Program Files\Spcron

Trojan.Fake-Drop/Gen

C:\WINDOWS\CTFMON32.EXE

C:\WINDOWS\ACCESSS.EXE

C:\WINDOWS\AVPCC.DLL

C:\WINDOWS\CLRSSN.EXE

C:\WINDOWS\CPAN.DLL

C:\WINDOWS\CTRLPAN.DLL

C:\WINDOWS\DIRECTX32.EXE

C:\WINDOWS\DNSRELAY.DLL

C:\WINDOWS\EDITPAD.EXE

C:\WINDOWS\EXPLORE.EXE

C:\WINDOWS\EXPLORER32.EXE

C:\WINDOWS\FUNNIEST.EXE

C:\WINDOWS\FUNNY.EXE

C:\WINDOWS\GFMNAAA.DLL

C:\WINDOWS\HELPCVS.EXE

C:\WINDOWS\INETINF.EXE

C:\WINDOWS\INTERNET.EXE

C:\WINDOWS\MSCONFD.DLL

C:\WINDOWS\MSSPI.DLL

C:\WINDOWS\MSSYS.EXE

C:\WINDOWS\MSUPDATE.EXE

C:\WINDOWS\MSWSC10.DLL

C:\WINDOWS\MSWSC20.DLL

C:\WINDOWS\MTWIRL32.DLL

C:\WINDOWS\QUICKEN.EXE

C:\WINDOWS\NOTEPAD32.EXE

C:\WINDOWS\QTTASKS.EXE

C:\WINDOWS\RUNDLL16.EXE

C:\WINDOWS\SEARCHWORD.DLL

C:\WINDOWS\SISTEM.EXE

C:\WINDOWS\SVCHOST32.EXE

C:\WINDOWS\SVCINIT.EXE

C:\WINDOWS\WINDOW.EXE

C:\WINDOWS\TIME.EXE

C:\WINDOWS\USERS32.EXE

C:\WINDOWS\WAOL.EXE

C:\WINDOWS\WIN64.EXE

C:\WINDOWS\WINAJBM.DLL

C:\WINDOWS\WINMGNT.EXE

C:\WINDOWS\X.EXE

C:\WINDOWS\XPLUGIN.DLL

C:\WINDOWS\Y.EXE

Trojan.Dropper/ASTCTL32

C:\WINDOWS\ASTCTL32.OCX

Rogue.LiveSecurityCenter-Trace

C:\WINDOWS\DEFAULT.HTM

Trojan.Downloader-Gen/Win

C:\WINDOWS\IEDLL.EXE

C:\WINDOWS\WIN32E.EXE

Trojan.Unclassified/IExplorer-Fake

C:\WINDOWS\IEXPLORER.EXE

Trojan.Unclassified/Loader-Suspicious

C:\WINDOWS\LOADER.EXE

Trojan.CWS/VBE

C:\WINDOWS\RUNDLL32.VBE

Trojan.Downloader-Systeem

C:\WINDOWS\SYSTEEM.EXE

Trojan.Downloader-SystemCritcial/Fake Alert

C:\WINDOWS\SYSTEMCRITICAL.EXE

Trojan.Unclassified/XXXVid

C:\WINDOWS\XXXVIDEO.HTA

Adware.MyWebSearch

C:\WINDOWS.OLD\PROGRAM FILES\MYWEBSEARCH\BAR\1.BIN\MWSOEMON.EXE

Edited by warwagon

wow that is a massive fail on onecares part

the only thing that I could even think to ask was onecare installed before there was a problem or as an attempt to fix one that was there?

wow that is a massive fail on onecares part

the only thing that I could even think to ask was onecare installed before there was a problem or as an attempt to fix one that was there?

Well the fact it is on there at all with that many infections living right next to it, is just sad.

I'm not sure if onecare cleans out trackign cookies, wich is what all those file items are. and it's a fairly useless thign to do anyway.

I'm also fairly sure that it doesn't mess aroudn to much in the registry other than to remove stuff that actually comes with spyware, while that other apps seems to have decided to act as a registry cleaner, wichis not a good thing.

During the deletion process with superantispyware I saw a bunch of random Exe files getting deleted from the windows directoy. one of which was Y.exe

in that case it's strange, it hsould have detected any spyware executables as log as it's properly updated, wich it appears to be.

just think what NOD32 or Kaspersky would have clean'd out

Yes, because kaspersky or nod32 did better than Antivir which is also happens to be free :rolleyes:

One Care, here, just works fine...no virus and no spyware.

Haha? :blink:

I think it's generally considered good practice to have more than one defence these days...

Personally I use Superantispyware, AVG free, CCleaner and Lavasoft Adaware and have never had a problem...

No single program is 100% perfect but they'll catch pretty much everything between them :)

One thing for sure though - I'd NEVER pay for any antivirus/antispyware program - The free ones ARE good enough

(Well, they are in my own personal experience anyway)

I think it's generally considered good practice to have more than one defence these days...

Personally I use Superantispyware, AVG free, CCleaner and Lavasoft Adaware and have never had a problem...

No single program is 100% perfect but they'll catch pretty much everything between them :)

One thing for sure though - I'd NEVER pay for any antivirus/antispyware program - The free ones ARE good enough

(Well, they are in my own personal experience anyway)

I agree, but it also depends on the user. I mean some people just install and "ok-button-bash" anything :)

Been using Vista for more than a year now, after a year I did a spyware / malware check with several programs and all it found were some cookies.

/on-topic: Kinda disappointing from one-care, not that I use it, but it should have detected at least something I'd say.

All the Anti programs have their problems. It makes me laugh when you get a person saying "Program X is the best because I have no spyware/viruses on my PC" How do they know. This thread just goes to show that is not the case.

I run Kaspersky, but I would not say to anyone it's the best, because I don't know if it's got it all. I remember years ago someone telling me AVG was the daddy and I ran it for about a year. The day I swapped, Nod32 picked up a lot of crap. The day I swapped to Kaspersky, that picked up a bit of crap as well. If I swapped again when my sub runs out, whatever I choose to use will no doubt pick up some other crap.

[teach to suck eggs]

The best defence is not to download stuff you know 'may' contain trojans. Avoid dodgy sites (I know some legitimate sites that have dropped a nasty payload, so nothing is 100% safe) and browse with extensions like NoScipt and Adblock active. The only 100% safe way is not go on the interwebitubes (like that'll happen!)

[/teach to suck eggs]

i got avast home edition.. I Trust it to be the best (for me)

It already proved it was better then Novell (used @ school) that proved much for me XD

One Care, here, just works fine...no virus and no spyware.

That's the point of this thread.

I would suggest you take a few minutes to download and install another one, such as SuperAntiSpyware or Spybot, and just scan with those to make sure. Not every program is going to detect everything, and it's much better to have two or even three to make sure you're completely safe.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • BrowserOS 0.46.0 by Razvan Serea BrowserOS is a free, open-source Chromium-based browser that runs AI agents natively, offering a smarter, more productive browsing experience. It supports Chrome extensions and integrates AI agents to automate tasks, fill forms, and streamline workflows. Your data stays on your computer: you can use your own API keys or run local models via Ollama, making it a privacy-first alternative to tools like Perplexity, Comet, or Dia. With built-in productivity tools and app integrations, BrowserOS boosts efficiency while keeping control firmly in your hands. Being Chromium-based, BrowserOS lets you effortlessly import your bookmarks, passwords, and Chrome extensions in just a few clicks. BrowserOS works with OpenAI GPT models, Anthropic Claude, Google Gemini, and local AI models via Ollama or LMStudio. You can use your own API keys and effortlessly switch between providers. BrowserOS Agent Your AI productivity assistant that organizes and manages your browsing effortlessly Quickly list, group, or close tabs Save and resume browsing sessions Search your history and organize bookmarks Switch instantly to the tab you need BrowserOS Navigator – Automate web tasks with ease Navigate websites and search automatically Interact with pages without manual effort Handle repetitive tasks in seconds What makes BrowserOS special Feels like home - same familiar interface as Google Chrome, works with all your extensions AI agents that run on YOUR browser, not in the cloud Privacy first - bring your own keys or use local models with Ollama. Your browsing history stays on your computer Open source and community driven - see exactly what's happening under the hood MCP store to one-click install popular MCPs and use them directly in the browser bar (coming soon) Built-in AI ad blocker that works across more scenarios! BrowserOS 0.46.0 changelog: Run Claude Code & Codex right in your browser — We've extended the agent harness to bring full coding agents into BrowserOS. Claude Code and Codex now come bundled and plug straight into the assistant, so you can drive your browser with the agent — and the subscription — you already use. A brand new experience — A redesigned new tab, a calmer composer, and a rebuilt command center for switching between agents. The whole assistant is cleaner, faster to reach, and easier to live in. New MCP tools — We rebuilt the browser tool surface from the ground up — a tighter, more reliable set of tools for agents to drive the browser. Plus one-click install of BrowserOS as an MCP server into the agents you already run, with automatic URL sync. Chromium 148 — Updated to the latest Chromium base with all recent upstream fixes and security patches. Streamlined — We've pulled back a few features that weren't getting much use — Skills, Soul, and Memory — so we can focus and ship better versions of them soon. Download: BrowserOS 0.46.0 | 181.0 MB (Open Source) Download: BrowserOS for macOS | 485.0 MB Links: BrowserOS Homepage | Github | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • Microsoft finally admits its default Windows 11 25H2, 24H2 action broke key legacy component by Sayan Sen Microsoft last week released Windows 11 KB5094126 and KB5093998 as the latest Patch Tuesday updates. Following that the company also published the accompanying dynamic updates under KB5094149, KB5095971, and KB5094156. So far the company has acknowledged two known issues that have popped up after the release which include bugged-out Office apps as well as the Recycle Bin; though there could be more at play too. Speaking of bugs and issues, Microsoft seems to have finally acknowledged a problem that probably has been around for close to a year. That's because back in July of 2025 the company made a default change to the latest Windows 11 versions, wherein it switched to JScript9Legacy on Windows 11 24H2 and later releases. Hence following the release of version 25H2 in October 2025, JScript9Legacy also remained default-enabled. As a result there has been a compatibility issue ever since then. For those wondering, by switching to JScript9Legacy Microsoft intended to improve the security of modern Windows PCs by reducing vulnerabilities tied to legacy scripting like cross-site scripting (XSS), among others. XSS exploits can allow cyber-attackers to attach malicious code onto legitimate websites and use them to execute the code when a potential victim loads such a website. Hence the new JScript9Legacy engine enforced stricter execution policies and improved object handling, which should help mitigate such attacks. Microsoft today has published a new support article detailing the problem. Neowin spotted it while browsing. The company says that JScript global definitions and execution context may fail to persist across scripts, potentially breaking older dependent apps and web-based components that relied on this legacy behavior. In the article Microsoft has confirmed that the issue stems from its move away from the older jscript9.dll engine in favor of jscript9legacy.dll. As mentioned above, while the newer engine was designed to address vulnerabilities and strengthen security it also changes how JScript handles execution context. As a result functions and definitions loaded by one script could no longer remain available to subsequent scripts once execution ended. The company notes that some applications worked correctly on earlier Windows versions because the older JScript engine automatically retained global definitions and execution state between scripts. Under the newer model though that behavior is disabled by default causing certain legacy workloads and polyfill-dependent scripts to fail. Microsoft says it addressed the problem via the KB5077241 update though the fix had not been enabled automatically in the following updates. As such admins must explicitly turn on persistent JScript execution context using a Registry setting that the tech giant shared today. The configuration can be applied to individual processes or system-wide through the FEATURE_ENABLE_PERSISTENCE registry key. The steps have been outlined below: Run the following command to create the feature control registry key: reg add "HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_PERSISTENCE" Under this key, create a new DWORD (32-bit) value. Configure the value as follows: To enable persistence for specific processes only: Set the value to 1 for each target process name. To enable persistence for all processes: Add * as the key name and set its value to 1. You can find the official support article here on Microsoft's website.
    • The possibility that milk gathers back into a glass implies that gravity can be 'reversed'.
  • Recent Achievements

    • Week One Done
      Jordan Smith earned a badge
      Week One Done
    • Reacting Well
      BizSAR earned a badge
      Reacting Well
    • First Post
      AndreaB earned a badge
      First Post
    • Week One Done
      Huge Trailer earned a badge
      Week One Done
    • Week One Done
      Classifyskilleducation earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      590
    2. 2
      +Edouard
      186
    3. 3
      PsYcHoKiLLa
      76
    4. 4
      Michael Scrip
      73
    5. 5
      Steven P.
      66
  • Tell a friend

    Love Neowin? Tell a friend!