Well - let me see if I can help--These two don't look necessarily worriesome
on the surface.
The first one is an "unknown"--this is an object that would be of interest
to Spynet (meaning simply that it is a driver, and one not already
classified as "good" or "bad"--hence the unknown.
I happen to be familiar with this one because of a false positive a few
weeks back, maybe--you are probably running some other antispyware apps?
At any rate, in general, unknown objects are not by default brought to the
users attention for just the reason you mention--they aren't going to know
what to do with that information. Most examples we see posted here are
benign--drivers for various other legit software. However, there was one
case where the "unknown" object was a trojan or virus which was posted here
in the last few days. I recommend that the average user leave the box to be
alerted to unknown objects unchecked, unless they are willing to do the
research. And such users probably wouldn't be browsing through the system
event log either. (Please don't take this personally--I don't mean you
specifically--just trying to generalize!)
The second one would on first glance be more significant--it is signature
based-- and there's both an executable and a related .dll file, but they are
in a system restore storage area.
Remotely Anywhere is a commercial remote administration tool:
http://www.remotelyanywhere.com/products/workstation_edition.asp
It may be used by, say, a corporate admin or help desk operation. Some
similar tools are placed on systems when they are built--some IBM machines
come with a VNC variant installed, for example--as a support tool.
This detection is meant to call out to the user that such a tool is
installed--since some such tools may be present and active without any clear
notice to the user.
If you are aware of having had Remotely Anywhere on the system at some point
in the past, this detection would be expected. If you weren't aware it
would be good to know why it was there, and perhaps when. The date on the
containing .MSI file might be a good indication of the when, but I can't
easily describe to you how to get to that file and check the date--if I were
trying to do so, I'd go via the command prompt--but there are hidden
subdirectories involved, so it isn't straighforward.
The way to get rid of that detection is simple--you destroy the restore
point that contains it. One way to do this is to turn off, and then back on
again, the System Restore feature on the C: drive. This destroys ALL
restore points, so you need to be confident about the condition of the
system, and create another restore point immediately.
A slightly safer way is to start the all programs, accessories, system
tools, disk cleanup tool, wait out the first operations, then hit the "more
options" tab and choose the system restore related choice on that tab--that
choice will remove all but the most recent restore point--which we can hope
won't be the one containing this RAT (remote administration tool.)
So--that's my opinion--and it is just that--nothing really hard and
fast--about those two items. Ring any bells? Microsoft is aware that the
messages in this situation (stuff found but not cleaned) are not what they
should be, and indeed--the cleaning behaviors are likely to change before
this product is released--they are aware that the current situation is
perplexing to most users.
--
