Infection messages?

Robin Bignall wrote:
On Thu, 10 Dec 2009 22:41:55 +0000, Robin Bignall
wrote:

On Thu, 10 Dec 2009 22:13:51 +0000, Robin Bignall
wrote:

On Thu, 10 Dec 2009 14:27:55 -0700, "Buffalo"
wrote:



Robin Bignall wrote:
[snip]

That is why I recommended that he disable or uninstall his
anti-virus and anti-malware programs and install Avira AntiVir
and free MBAM and hopefully the free SAS. ( I don't think he
ever said that he tried them both)
If the above doesn't change things, then that would indicate a
different security program causing the problem.
Buffalo

Just to save you reading back in the thread, I have SAS Pro,
which is not free, and MBAM, which is. I also run ActiveScan 2,
which was recommended, together with Kaspersky, by AumHa. I
don't intend to through the process of uninstalling Kaspersky.

OK, missed that point. If you disable Kaspersky and just use the
free Avira AntiVir and no message comes up, perhaps it is
Kaspersky doing it.
Doesn't really seem like it's worth the trouble overall.
Buffalo
PS: If you ever find out what it is, please post back.

I certainly will.

I'm running Avira now.

And it found nothing.

Perhaps just let Avira run for several days while Kaspersky is disabled, if
you wish.
Buffalo

On Thu, 10 Dec 2009 16:12:08 -0700, "Buffalo"
wrote:



["infected" messages before logon screen]

I'm running Avira now.

And it found nothing.

Perhaps just let Avira run for several days while Kaspersky is disabled, if
you wish.
Buffalo

I don't think it'll find anything.
There appears to be no rhyme or reason behind these messages. For
example, when I rebooted last night, there were hundreds of these
messages, in bunches. I can't tell how many are in a bunch, maybe 32
or 64. A bunch scrolls for about five seconds, there's a two second
gap, then another bunch scrolls, and so on. Last night there were four
of these bunches, plus half a screen of bunch five. Tonight when I
booted there were just two of these messages (not two bunches). I
booted again and there were none. I've found this behaviour before.
These messages seem to come and go.

I just again checked the contents of all files on c: and d:, and the
registry, for the string "infection", without finding anything
associated in any way with an executable. Weird.
--
Robin
(BrE)
Herts, England

Robin Bignall wrote:
On Thu, 10 Dec 2009 16:12:08 -0700, "Buffalo"
wrote:



["infected" messages before logon screen]

I'm running Avira now.

And it found nothing.

Perhaps just let Avira run for several days while Kaspersky is
disabled, if you wish.
Buffalo

I don't think it'll find anything.
There appears to be no rhyme or reason behind these messages. For
example, when I rebooted last night, there were hundreds of these
messages, in bunches. I can't tell how many are in a bunch, maybe 32
or 64. A bunch scrolls for about five seconds, there's a two second
gap, then another bunch scrolls, and so on. Last night there were four
of these bunches, plus half a screen of bunch five. Tonight when I
booted there were just two of these messages (not two bunches). I
booted again and there were none. I've found this behaviour before.
These messages seem to come and go.

I just again checked the contents of all files on c: and d:, and the
registry, for the string "infection", without finding anything
associated in any way with an executable. Weird.

I was just suggesting that possibly Kaspersky could be the culprit and
disabling it and only running Avira to see if the messages stop.
However, I really doubt Kaspersky would react that way.
We know 'something' is generating the messages and hopefully there is
someone in this ng that would have a good suggestion for a program that
could monitor all the startups.
Buffalo
PS: It will be interesting to see what caused it.
And, do you have more than one (1) antivirus program running in real time,
such as Windows Defender?

"Robin Bignall" wrote in message
...

Do you use "Windows Washer" or some similar program?

Robin Bignall wrote:

Just another piece of data. I just logged on as "administrator" (with
several screens full of these infection messages) to see if, when I
rebooted, I might have some "administrator\cookies\index.dat"
messages.
When I rebooted back as myself all the infection messages had
vanished. But this has happened before on reboot.

If you configue a Clean Boot, do you still get these messages?

Robin Bignall wrote:
On Sun, 22 Nov 2009 19:05:42 -0500, "Daave" wrote:

Robin Bignall wrote:
On Sun, 22 Nov 2009 11:36:50 -0500, "Daave" wrote:

Robin Bignall wrote:
XP Pro SP3
During the past few weeks, immediately after the initial Windows
screen with the blue bar running left right, and before the logon
screen, I get a blue screen with white messages. There are dozens
of them, all identical, which say something like:
Infection: docs and settings my name cookies/index.dat does not
exist and cannot be removed. (Pause is inoperative and the normal
logon screen appears immediately after.)
It is very important that you post back with the exact, complete
message! It's hard to tell at this moment, but it's possible you
have a variation of what is described he

http://www.bleepingcomputer.com/viru...irus-1-removal

Please post back with the complete message.

Difficult. Pause/break stops the screen for a second and then it goes
straight to the logon. I just rebooted and all those messages have
vanished. None of the virus/malware programs finds anything.
I'll post again if those messages reappear. There's nothing in the
event log that looks suspicious.
In the menu you get after hitting F8, do you see an option called
"Disable automatic restart on system failure"? If so, choose it. Another
way to do this:

http://pcsupport.about.com/od/tipstr...utorestart.htm

This way, you will be able to write down these messages.

The message is:
infection:documents and settings\robin bignall\cookies\index.dat could
not be removed. file is no longer existent.

This thread is very long.. if you've tried the following, I missed it.

A couple of things I would try:

- Create a text file using Wordpad and name it "index.dat". Store it in
the Documents and Settings\Robin Bignall\Cookies\ folder and restart the
machine.

- Look in the BIOS for an a/v utility and disable it.

--
Joe =o)

In article ,
says...
David H Lipman, Malke, PA Bear, Beauregard T. Shagnasty, Leythos.


I see you're still stalking myself and other in every post you make -
shows just how unethical you are.

--
You can't trust your best friends, your five senses, only the little
voice inside you that most civilians don't even hear -- Listen to that.
Trust yourself.
(remove 999 for proper email address)

On Fri, 11 Dec 2009 19:35:03 -0500, "FromTheRafters" erratic
@nomail.afraid.org wrote:


"Robin Bignall" wrote in message
.. .

Do you use "Windows Washer" or some similar program?

No, only what's in IE8 and CCleaner.
--
Robin
(BrE)
Herts, England

"FromTheRafters" erratic @nomail.afraid.org wrote in message
...

Do you use "Windows Washer" or some similar program?

"The Real Truth MVP" wrote in message
...
Window washer no mail washer pro yes.

Thanks.

I asked about Windows Washer (and similar) because that is one program
that 'cleans up' some of the residual browsing traces by deleting
certain index.dat files (for privacy zealots). It wouldn't surprise me
if this were a conflict between two such programs - one that didn't
forsee the possibility that "not exist" could ever exist.

The OP could conceivably uninstall and then reinstall them in the
reverse order and avoid the 'non handled' error (assuming the other
program is written more smartly).

"Robin Bignall" wrote in message
...
On Fri, 11 Dec 2009 19:35:03 -0500, "FromTheRafters" erratic
@nomail.afraid.org wrote:


"Robin Bignall" wrote in message
.. .

Do you use "Windows Washer" or some similar program?

No, only what's in IE8 and CCleaner.

***
I'm not too familiar with that (although I use it myself), but do you
use it in conjunction with a browser add-on (Firefox?).

I'm just grasping at straws here - try removing ccleaner completely (you
can reinstall it later) and see if the problem persists.
***

On Fri, 11 Dec 2009 19:54:02 -0500, "Daave" wrote:

Robin Bignall wrote:

Just another piece of data. I just logged on as "administrator" (with
several screens full of these infection messages) to see if, when I
rebooted, I might have some "administrator\cookies\index.dat"
messages.
When I rebooted back as myself all the infection messages had
vanished. But this has happened before on reboot.

If you configue a Clean Boot, do you still get these messages?

It's hard to say, for a couple of reasons.
- even when logging on as "administrator" rather than just a member of
the administrator's group, you can't shut Kaspersky down without
uninstalling it. A "turn off protection for an hour" does not apply
through a reboot.
- sometimes, during normal operation, all of these messages vanish
anyway.

Having said that, I managed a cleanish boot with just Kaspersky and
the loudspeaker symbol showing in the tray, everything else disabled.
There were no infection messages on reboot. But I re enabled
everything and have booted several times since then and there are
still no messages. What this means I don't know.
--
Robin
(BrE)
Herts, England

On Sat, 12 Dec 2009 19:05:41 -0500, "FromTheRafters" erratic
@nomail.afraid.org wrote:

"Robin Bignall" wrote in message
.. .
On Fri, 11 Dec 2009 19:35:03 -0500, "FromTheRafters" erratic
wrote:


"Robin Bignall" wrote in message
. ..

Do you use "Windows Washer" or some similar program?

No, only what's in IE8 and CCleaner.

***
I'm not too familiar with that (although I use it myself), but do you
use it in conjunction with a browser add-on (Firefox?).

No, I just use IE8.

I'm just grasping at straws here - try removing ccleaner completely (you
can reinstall it later) and see if the problem persists.
***

Ccleaner shouldn't do anything unless it's actually run. I haven't
run it for a few days, I just rebooted and got about 40 of these
messages, after having none for a while. Must get to bed now, but
tomorrow I'll physically disconnect from the Internet and boot a few
times to see what happens.
--
Robin
(BrE)
Herts, England

Robin Bignall wrote:
On Fri, 11 Dec 2009 19:54:02 -0500, "Daave" wrote:

Robin Bignall wrote:

Just another piece of data. I just logged on as "administrator"
(with several screens full of these infection messages) to see if,
when I rebooted, I might have some "administrator\cookies\index.dat"
messages.
When I rebooted back as myself all the infection messages had
vanished. But this has happened before on reboot.

If you configue a Clean Boot, do you still get these messages?

It's hard to say, for a couple of reasons.
- even when logging on as "administrator" rather than just a member of
the administrator's group, you can't shut Kaspersky down without
uninstalling it. A "turn off protection for an hour" does not apply
through a reboot.
- sometimes, during normal operation, all of these messages vanish
anyway.

Having said that, I managed a cleanish boot with just Kaspersky and
the loudspeaker symbol showing in the tray, everything else disabled.
There were no infection messages on reboot. But I re enabled
everything and have booted several times since then and there are
still no messages. What this means I don't know.

Alas, intermittent problems are the most difficult to solve! And perhaps
you unknowingly fixed your problem.

"Robin Bignall" wrote in message
...
On Fri, 11 Dec 2009 19:54:02 -0500, "Daave" wrote:

Robin Bignall wrote:

Just another piece of data. I just logged on as "administrator"
(with
several screens full of these infection messages) to see if, when I
rebooted, I might have some "administrator\cookies\index.dat"
messages.
When I rebooted back as myself all the infection messages had
vanished. But this has happened before on reboot.

If you configue a Clean Boot, do you still get these messages?

It's hard to say, for a couple of reasons.
- even when logging on as "administrator" rather than just a member of
the administrator's group, you can't shut Kaspersky down without
uninstalling it. A "turn off protection for an hour" does not apply
through a reboot.
- sometimes, during normal operation, all of these messages vanish
anyway.

Having said that, I managed a cleanish boot with just Kaspersky and
the loudspeaker symbol showing in the tray, everything else disabled.
There were no infection messages on reboot. But I re enabled
everything and have booted several times since then and there are
still no messages. What this means I don't know.

***
The intermittent nature of the symptoms may be due to a race condition.
What might be causing it, I haven't a clue.

Not removing ccleaner, because you don't think it could be the problem,
is not good troubleshooting. Many is the time that something that
couldn't be the cause of something - actually was the cause. I'm not
saying that this is the case here, but why not remove it anyway to see
what happens? It's not as if it were a needed system file, and you could
just put it back afterward.

Sorry I couldn't help you.
***

On Sun, 13 Dec 2009 19:18:03 -0500, "Daave" wrote:

Robin Bignall wrote:
On Fri, 11 Dec 2009 19:54:02 -0500, "Daave" wrote:

Robin Bignall wrote:

Just another piece of data. I just logged on as "administrator"
(with several screens full of these infection messages) to see if,
when I rebooted, I might have some "administrator\cookies\index.dat"
messages.
When I rebooted back as myself all the infection messages had
vanished. But this has happened before on reboot.

If you configue a Clean Boot, do you still get these messages?

It's hard to say, for a couple of reasons.
- even when logging on as "administrator" rather than just a member of
the administrator's group, you can't shut Kaspersky down without
uninstalling it. A "turn off protection for an hour" does not apply
through a reboot.
- sometimes, during normal operation, all of these messages vanish
anyway.

Having said that, I managed a cleanish boot with just Kaspersky and
the loudspeaker symbol showing in the tray, everything else disabled.
There were no infection messages on reboot. But I re enabled
everything and have booted several times since then and there are
still no messages. What this means I don't know.

Alas, intermittent problems are the most difficult to solve! And perhaps
you unknowingly fixed your problem.

Unfortunately, no. When I booted this morning I got 30 or 40 of these
messages. I booted having physically disconnected from the Internet,
to leave the machine running all day and see what, if anything
happened. Unfortunately, my helpful wife, seeing the machine running
and thinking I'd inadvertently left it on, shut it down a few minutes
later. When I booted tonight, no infection messages. Who knows what
I'll see tomorrow...
--
Robin
(BrE)
Herts, England