Infection messages?

On Sat, 12 Dec 2009 09:57:39 -0500, Elmo wrote:

Robin Bignall wrote:
On Sun, 22 Nov 2009 19:05:42 -0500, "Daave" wrote:

Robin Bignall wrote:
On Sun, 22 Nov 2009 11:36:50 -0500, "Daave" wrote:

Robin Bignall wrote:
XP Pro SP3
During the past few weeks, immediately after the initial Windows
screen with the blue bar running left right, and before the logon
screen, I get a blue screen with white messages. There are dozens
of them, all identical, which say something like:
Infection: docs and settings my name cookies/index.dat does not
exist and cannot be removed. (Pause is inoperative and the normal
logon screen appears immediately after.)
It is very important that you post back with the exact, complete
message! It's hard to tell at this moment, but it's possible you
have a variation of what is described he

http://www.bleepingcomputer.com/viru...irus-1-removal

Please post back with the complete message.

Difficult. Pause/break stops the screen for a second and then it goes
straight to the logon. I just rebooted and all those messages have
vanished. None of the virus/malware programs finds anything.
I'll post again if those messages reappear. There's nothing in the
event log that looks suspicious.
In the menu you get after hitting F8, do you see an option called
"Disable automatic restart on system failure"? If so, choose it. Another
way to do this:

http://pcsupport.about.com/od/tipstr...utorestart.htm

This way, you will be able to write down these messages.

The message is:
infection:documents and settings\robin bignall\cookies\index.dat could
not be removed. file is no longer existent.

This thread is very long.. if you've tried the following, I missed it.

A couple of things I would try:

- Create a text file using Wordpad and name it "index.dat". Store it in
the Documents and Settings\Robin Bignall\Cookies\ folder and restart the
machine.

I'll try that, see what happens.

- Look in the BIOS for an a/v utility and disable it.

That was the first thing that occurred to me. I don't see any a/v in
my ASUS BIOS (it's a P5E3 deluxe)
--
Robin
(BrE)
Herts, England

On Mon, 14 Dec 2009 22:34:52 +0000, Robin Bignall
wrote:

On Sun, 13 Dec 2009 19:18:03 -0500, "Daave" wrote:

Robin Bignall wrote:
On Fri, 11 Dec 2009 19:54:02 -0500, "Daave" wrote:

Robin Bignall wrote:

Just another piece of data. I just logged on as "administrator"
(with several screens full of these infection messages) to see if,
when I rebooted, I might have some "administrator\cookies\index.dat"
messages.
When I rebooted back as myself all the infection messages had
vanished. But this has happened before on reboot.

If you configue a Clean Boot, do you still get these messages?

It's hard to say, for a couple of reasons.
- even when logging on as "administrator" rather than just a member of
the administrator's group, you can't shut Kaspersky down without
uninstalling it. A "turn off protection for an hour" does not apply
through a reboot.
- sometimes, during normal operation, all of these messages vanish
anyway.

Having said that, I managed a cleanish boot with just Kaspersky and
the loudspeaker symbol showing in the tray, everything else disabled.
There were no infection messages on reboot. But I re enabled
everything and have booted several times since then and there are
still no messages. What this means I don't know.

Alas, intermittent problems are the most difficult to solve! And perhaps
you unknowingly fixed your problem.

Unfortunately, no. When I booted this morning I got 30 or 40 of these
messages. I booted having physically disconnected from the Internet,
to leave the machine running all day and see what, if anything
happened. Unfortunately, my helpful wife, seeing the machine running
and thinking I'd inadvertently left it on, shut it down a few minutes
later. When I booted tonight, no infection messages. Who knows what
I'll see tomorrow...

Your wife, most probably.

Massimo

Massimo wrote:
[snip]
When I booted tonight, no infection
messages. Who knows what I'll see tomorrow...

Your wife, most probably.

Massimo

You think?
Merry Christmas
Buffalo

On the subject of these messages:

infection:documents and settings\robin bignall\cookies\index.dat could
not be removed. file is no longer existent.

appearing before the XP login screen, I have discovered how to stop
them occurring. That is to turn off the real-time background
protection in A-squared.

I have no idea what is happening, but I assume something in A-squared
is building a table (the number of messages I see seems to be directly
proportional to the length of time the system is powered up) and then
some component of XP, or, more likely, Kaspersky 2010, is running
through this table generating these messages. Either some weird
interaction or bug in either/both.

The real-time guard of SAS works perfectly (or, at least, these
messages do not appear when it's running).

Merry Christmas or its equivalent to all.
--
Robin
(BrE)
Herts, England

Robin Bignall wrote:
On the subject of these messages:

infection:documents and settings\robin bignall\cookies\index.dat could
not be removed. file is no longer existent.

appearing before the XP login screen, I have discovered how to stop
them occurring. That is to turn off the real-time background
protection in A-squared.

I have no idea what is happening, but I assume something in A-squared
is building a table (the number of messages I see seems to be directly
proportional to the length of time the system is powered up) and then
some component of XP, or, more likely, Kaspersky 2010, is running
through this table generating these messages. Either some weird
interaction or bug in either/both.

The real-time guard of SAS works perfectly (or, at least, these
messages do not appear when it's running).

Merry Christmas or its equivalent to all.

Thanks for sharing the cause of the problem.

You are probably aware that it is not recommended to run two or more
real-time antispyware (or antivirus) programs simultaneously. I wonder
if you disabled SAS (or Kaspersky 2010) completely but keep A-Squared
with its real-time protection on, what the outcome would be.

Merry Christmas to you, too, Robin!

From: "Robin Bignall"

| On the subject of these messages:

| infection:documents and settings\robin bignall\cookies\index.dat could
| not be removed. file is no longer existent.

| appearing before the XP login screen, I have discovered how to stop
| them occurring. That is to turn off the real-time background
| protection in A-squared.

| I have no idea what is happening, but I assume something in A-squared
| is building a table (the number of messages I see seems to be directly
| proportional to the length of time the system is powered up) and then
| some component of XP, or, more likely, Kaspersky 2010, is running
| through this table generating these messages. Either some weird
| interaction or bug in either/both.

| The real-time guard of SAS works perfectly (or, at least, these
| messages do not appear when it's running).

| Merry Christmas or its equivalent to all.
| --
| Robin
| (BrE)
| Herts, England

Thanx for the update Robin!

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp

"Robin Bignall" wrote in message
...
On the subject of these messages:

infection:documents and settings\robin bignall\cookies\index.dat could
not be removed. file is no longer existent.

appearing before the XP login screen, I have discovered how to stop
them occurring. That is to turn off the real-time background
protection in A-squared.

This shows the importance of turning off or uninstalling various programs
REGARDLESS of whether one believes it can not be the culprit.
Troubleshooting any problem demands it. Reminds me of the times years ago
(in the DOS and early Windows days) when *mouse drivers* would interfere
with printing. Many a tech would be caught red-faced because they just could
not believe a mouse driver would interfere with printing. Yet turn off or
uninstall the mouse driver and the printing problem would disappear.
Reinstall or turn the driver back on, and the printing problem would
resurface. Any tech worth his salt will seek to *prove* a
program/driver/utility is not the culprit, rather than go with the *belief*
it can not be the culprit. I have even had people complain about turning off
screen savers while troubleshooting a problem. Geeeeeez, it's not like I
want them to turn it off forever, unless it is causing problems. Yes, even
screen savers have been found to cause problems.

On Thu, 24 Dec 2009 10:42:42 -0500, "Daave" wrote:

Robin Bignall wrote:
On the subject of these messages:

infection:documents and settings\robin bignall\cookies\index.dat could
not be removed. file is no longer existent.

appearing before the XP login screen, I have discovered how to stop
them occurring. That is to turn off the real-time background
protection in A-squared.

I have no idea what is happening, but I assume something in A-squared
is building a table (the number of messages I see seems to be directly
proportional to the length of time the system is powered up) and then
some component of XP, or, more likely, Kaspersky 2010, is running
through this table generating these messages. Either some weird
interaction or bug in either/both.

The real-time guard of SAS works perfectly (or, at least, these
messages do not appear when it's running).

Merry Christmas or its equivalent to all.

Thanks for sharing the cause of the problem.

You are probably aware that it is not recommended to run two or more
real-time antispyware (or antivirus) programs simultaneously. I wonder
if you disabled SAS (or Kaspersky 2010) completely but keep A-Squared
with its real-time protection on, what the outcome would be.

I was aware of the problem running two antivirus programs
simultaneously, but didn't appreciate that it applied to malware too.
Having just installed Kaspersky 9.0.0.736 I'm reluctant to uninstall
it. I'll switch Asquared on again and see if the problem still
exists. SAS does not seem to affect these messages.
--
Robin
(BrE)
Herts, England

"Robin Bignall" wrote in message
...
On Thu, 24 Dec 2009 10:42:42 -0500, "Daave" wrote:

Robin Bignall wrote:
On the subject of these messages:

infection:documents and settings\robin bignall\cookies\index.dat
could
not be removed. file is no longer existent.

appearing before the XP login screen, I have discovered how to stop
them occurring. That is to turn off the real-time background
protection in A-squared.

I have no idea what is happening, but I assume something in
A-squared
is building a table (the number of messages I see seems to be
directly
proportional to the length of time the system is powered up) and
then
some component of XP, or, more likely, Kaspersky 2010, is running
through this table generating these messages. Either some weird
interaction or bug in either/both.

The real-time guard of SAS works perfectly (or, at least, these
messages do not appear when it's running).

Merry Christmas or its equivalent to all.

Thanks for sharing the cause of the problem.

You are probably aware that it is not recommended to run two or more
real-time antispyware (or antivirus) programs simultaneously. I wonder
if you disabled SAS (or Kaspersky 2010) completely but keep A-Squared
with its real-time protection on, what the outcome would be.

I was aware of the problem running two antivirus programs
simultaneously, but didn't appreciate that it applied to malware too.
Having just installed Kaspersky 9.0.0.736 I'm reluctant to uninstall
it. I'll switch Asquared on again and see if the problem still
exists. SAS does not seem to affect these messages.

It could even be affected by the order in which the suspects get loaded
into memory. It kinda reminds me of the "Two Black Crows" routine about
the race '...if I get there first, I'll draw a line in the dirt - if you
get there first, you rub it out..'. Computer programs will actually try
to do this when told to.

"Andy Medina" wrote in message
...
"Robin Bignall" wrote in message
...
On the subject of these messages:

infection:documents and settings\robin bignall\cookies\index.dat could
not be removed. file is no longer existent.

appearing before the XP login screen, I have discovered how to stop
them occurring. That is to turn off the real-time background
protection in A-squared.

This shows the importance of turning off or uninstalling various programs
REGARDLESS of whether one believes it can not be the culprit.
Troubleshooting any problem demands it. Reminds me of the times years ago
(in the DOS and early Windows days) when *mouse drivers* would interfere
with printing. Many a tech would be caught red-faced because they just
could not believe a mouse driver would interfere with printing. Yet turn
off or uninstall the mouse driver and the printing problem would
disappear. Reinstall or turn the driver back on, and the printing problem
would resurface. Any tech worth his salt will seek to *prove* a
program/driver/utility is not the culprit, rather than go with the
*belief* it can not be the culprit. I have even had people complain about
turning off screen savers while troubleshooting a problem. Geeeeeez, it's
not like I want them to turn it off forever, unless it is causing
problems. Yes, even screen savers have been found to cause problems.


Agreed, ...the "bells and whistles" BLOATWARE that always seems to accompany
new hardware, including mice - is often a recipe for disaster, i.e. it's
often poorly written application software that accompanies hardware which
causes problems, or, as you said, the mouse driver itseld. For years I've
let Windows use it's own driver !
Unless Winodws can't find a "universal" driver (for want of a better word)
then I think it best to chuck that CD that came with a piece of hardware -
into the rubbish bin !!
Also, too many people blindly install ALL the junk on the CD instead of just
the driver !! ...then they wonder why their filetype associations have all
changed !!!!

regards, Richard

On Thu, 24 Dec 2009 19:35:49 -0500, "FromTheRafters" erratic
@nomail.afraid.org wrote:

"Robin Bignall" wrote in message
.. .
On Thu, 24 Dec 2009 10:42:42 -0500, "Daave" wrote:

Robin Bignall wrote:
On the subject of these messages:

infection:documents and settings\robin bignall\cookies\index.dat
could
not be removed. file is no longer existent.

appearing before the XP login screen, I have discovered how to stop
them occurring. That is to turn off the real-time background
protection in A-squared.

I have no idea what is happening, but I assume something in
A-squared
is building a table (the number of messages I see seems to be
directly
proportional to the length of time the system is powered up) and
then
some component of XP, or, more likely, Kaspersky 2010, is running
through this table generating these messages. Either some weird
interaction or bug in either/both.

The real-time guard of SAS works perfectly (or, at least, these
messages do not appear when it's running).

Merry Christmas or its equivalent to all.

Thanks for sharing the cause of the problem.

You are probably aware that it is not recommended to run two or more
real-time antispyware (or antivirus) programs simultaneously. I wonder
if you disabled SAS (or Kaspersky 2010) completely but keep A-Squared
with its real-time protection on, what the outcome would be.

I was aware of the problem running two antivirus programs
simultaneously, but didn't appreciate that it applied to malware too.
Having just installed Kaspersky 9.0.0.736 I'm reluctant to uninstall
it. I'll switch Asquared on again and see if the problem still
exists. SAS does not seem to affect these messages.

It could even be affected by the order in which the suspects get loaded
into memory.

Does a user have any control over that?

It kinda reminds me of the "Two Black Crows" routine about
the race '...if I get there first, I'll draw a line in the dirt - if you
get there first, you rub it out..'. Computer programs will actually try
to do this when told to.

I can confirm that the messages come back when A-squared's background
guard is activated.
--
Robin
(BrE)
Herts, England

"Robin Bignall" wrote in message
...
On Thu, 24 Dec 2009 19:35:49 -0500, "FromTheRafters" erratic
@nomail.afraid.org wrote:

[...]

It could even be affected by the order in which the suspects get
loaded
into memory.

Does a user have any control over that?

Not really, that would be a memory management thing. If two programs had
the task of deleting index.dat, and one of them did it by "delete file"
and the other by "if file exists, delete file" the first one *first* and
the second one *second* would not create an error message for display.
If the sequence were reversed, the later "delete file" would error
because no check was made for the file's existence beforehand and it
*had* been deleted already. It creates a race condition of sorts, and
can account for intermittent symptoms.

It kinda reminds me of the "Two Black Crows" routine about
the race '...if I get there first, I'll draw a line in the dirt - if
you
get there first, you rub it out..'. Computer programs will actually
try
to do this when told to.

I can confirm that the messages come back when A-squared's background
guard is activated.

It seems that you have narrowed it down to A-Squared being what is
responsible for the messages. As to why it is doing so, who knows? I had
thought maybe some other antispy component was deleting the file
(perhaps upon exiting the browser?), and that was not expected by the
programmers of the program (A-Squared?) that subsequently tried
(numerous times?) to delete the same file.

Does A-Squared log those events as well as display the messages (the
wording should be essentially the same)?

On Fri, 25 Dec 2009 16:15:57 -0500, "FromTheRafters" erratic
@nomail.afraid.org wrote:

"Robin Bignall" wrote in message
.. .
On Thu, 24 Dec 2009 19:35:49 -0500, "FromTheRafters" erratic
@nomail.afraid.org wrote:

[...]

It could even be affected by the order in which the suspects get
loaded
into memory.

Does a user have any control over that?

Not really, that would be a memory management thing. If two programs had
the task of deleting index.dat, and one of them did it by "delete file"
and the other by "if file exists, delete file" the first one *first* and
the second one *second* would not create an error message for display.
If the sequence were reversed, the later "delete file" would error
because no check was made for the file's existence beforehand and it
*had* been deleted already. It creates a race condition of sorts, and
can account for intermittent symptoms.

It kinda reminds me of the "Two Black Crows" routine about
the race '...if I get there first, I'll draw a line in the dirt - if
you
get there first, you rub it out..'. Computer programs will actually
try
to do this when told to.

I can confirm that the messages come back when A-squared's background
guard is activated.

It seems that you have narrowed it down to A-Squared being what is
responsible for the messages. As to why it is doing so, who knows? I had
thought maybe some other antispy component was deleting the file
(perhaps upon exiting the browser?), and that was not expected by the
programmers of the program (A-Squared?) that subsequently tried
(numerous times?) to delete the same file.

Does A-Squared log those events as well as display the messages (the
wording should be essentially the same)?

I don't know. I've stopped using A-Squared and have raised this item
on their web forum.
--
Robin
(BrE)
Herts, England

Robin Bignall wrote:
[snipped]
I don't know. I've stopped using A-Squared and have raised this item
on their web forum.
If you get an answer from them, let us know.
At least you made a lot of progress.
Buffalo

From: "Robin Bignall"

| I don't know. I've stopped using A-Squared and have raised this item
| on their web forum.
| --
| Robin
| (BrE)
| Herts, England

Did 'ShadowPuterDude' reply/respond ?

If not, please send me an email of the posted URL and I will have him give your A-Squared
thread due attention.


--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp