If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below. |
|
|
Thread Tools | Display Modes |
#76
|
|||
|
|||
Infection messages?
On Sat, 12 Dec 2009 09:57:39 -0500, Elmo wrote:
Robin Bignall wrote: On Sun, 22 Nov 2009 19:05:42 -0500, "Daave" wrote: Robin Bignall wrote: On Sun, 22 Nov 2009 11:36:50 -0500, "Daave" wrote: Robin Bignall wrote: XP Pro SP3 During the past few weeks, immediately after the initial Windows screen with the blue bar running left right, and before the logon screen, I get a blue screen with white messages. There are dozens of them, all identical, which say something like: Infection: docs and settings my name cookies/index.dat does not exist and cannot be removed. (Pause is inoperative and the normal logon screen appears immediately after.) It is very important that you post back with the exact, complete message! It's hard to tell at this moment, but it's possible you have a variation of what is described he http://www.bleepingcomputer.com/viru...irus-1-removal Please post back with the complete message. Difficult. Pause/break stops the screen for a second and then it goes straight to the logon. I just rebooted and all those messages have vanished. None of the virus/malware programs finds anything. I'll post again if those messages reappear. There's nothing in the event log that looks suspicious. In the menu you get after hitting F8, do you see an option called "Disable automatic restart on system failure"? If so, choose it. Another way to do this: http://pcsupport.about.com/od/tipstr...utorestart.htm This way, you will be able to write down these messages. The message is: infection:documents and settings\robin bignall\cookies\index.dat could not be removed. file is no longer existent. This thread is very long.. if you've tried the following, I missed it. A couple of things I would try: - Create a text file using Wordpad and name it "index.dat". Store it in the Documents and Settings\Robin Bignall\Cookies\ folder and restart the machine. I'll try that, see what happens. - Look in the BIOS for an a/v utility and disable it. That was the first thing that occurred to me. I don't see any a/v in my ASUS BIOS (it's a P5E3 deluxe) -- Robin (BrE) Herts, England |
Ads |
#77
|
|||
|
|||
Infection messages?
On Mon, 14 Dec 2009 22:34:52 +0000, Robin Bignall
wrote: On Sun, 13 Dec 2009 19:18:03 -0500, "Daave" wrote: Robin Bignall wrote: On Fri, 11 Dec 2009 19:54:02 -0500, "Daave" wrote: Robin Bignall wrote: Just another piece of data. I just logged on as "administrator" (with several screens full of these infection messages) to see if, when I rebooted, I might have some "administrator\cookies\index.dat" messages. When I rebooted back as myself all the infection messages had vanished. But this has happened before on reboot. If you configue a Clean Boot, do you still get these messages? It's hard to say, for a couple of reasons. - even when logging on as "administrator" rather than just a member of the administrator's group, you can't shut Kaspersky down without uninstalling it. A "turn off protection for an hour" does not apply through a reboot. - sometimes, during normal operation, all of these messages vanish anyway. Having said that, I managed a cleanish boot with just Kaspersky and the loudspeaker symbol showing in the tray, everything else disabled. There were no infection messages on reboot. But I re enabled everything and have booted several times since then and there are still no messages. What this means I don't know. Alas, intermittent problems are the most difficult to solve! And perhaps you unknowingly fixed your problem. Unfortunately, no. When I booted this morning I got 30 or 40 of these messages. I booted having physically disconnected from the Internet, to leave the machine running all day and see what, if anything happened. Unfortunately, my helpful wife, seeing the machine running and thinking I'd inadvertently left it on, shut it down a few minutes later. When I booted tonight, no infection messages. Who knows what I'll see tomorrow... Your wife, most probably. Massimo |
#78
|
|||
|
|||
Infection messages?
Massimo wrote: [snip] When I booted tonight, no infection messages. Who knows what I'll see tomorrow... Your wife, most probably. Massimo You think? Merry Christmas Buffalo |
#79
|
|||
|
|||
Infection messages?
On the subject of these messages:
infection:documents and settings\robin bignall\cookies\index.dat could not be removed. file is no longer existent. appearing before the XP login screen, I have discovered how to stop them occurring. That is to turn off the real-time background protection in A-squared. I have no idea what is happening, but I assume something in A-squared is building a table (the number of messages I see seems to be directly proportional to the length of time the system is powered up) and then some component of XP, or, more likely, Kaspersky 2010, is running through this table generating these messages. Either some weird interaction or bug in either/both. The real-time guard of SAS works perfectly (or, at least, these messages do not appear when it's running). Merry Christmas or its equivalent to all. -- Robin (BrE) Herts, England |
#80
|
|||
|
|||
Infection messages?
Robin Bignall wrote:
On the subject of these messages: infection:documents and settings\robin bignall\cookies\index.dat could not be removed. file is no longer existent. appearing before the XP login screen, I have discovered how to stop them occurring. That is to turn off the real-time background protection in A-squared. I have no idea what is happening, but I assume something in A-squared is building a table (the number of messages I see seems to be directly proportional to the length of time the system is powered up) and then some component of XP, or, more likely, Kaspersky 2010, is running through this table generating these messages. Either some weird interaction or bug in either/both. The real-time guard of SAS works perfectly (or, at least, these messages do not appear when it's running). Merry Christmas or its equivalent to all. Thanks for sharing the cause of the problem. You are probably aware that it is not recommended to run two or more real-time antispyware (or antivirus) programs simultaneously. I wonder if you disabled SAS (or Kaspersky 2010) completely but keep A-Squared with its real-time protection on, what the outcome would be. Merry Christmas to you, too, Robin! |
#81
|
|||
|
|||
Infection messages?
From: "Robin Bignall"
| On the subject of these messages: | infection:documents and settings\robin bignall\cookies\index.dat could | not be removed. file is no longer existent. | appearing before the XP login screen, I have discovered how to stop | them occurring. That is to turn off the real-time background | protection in A-squared. | I have no idea what is happening, but I assume something in A-squared | is building a table (the number of messages I see seems to be directly | proportional to the length of time the system is powered up) and then | some component of XP, or, more likely, Kaspersky 2010, is running | through this table generating these messages. Either some weird | interaction or bug in either/both. | The real-time guard of SAS works perfectly (or, at least, these | messages do not appear when it's running). | Merry Christmas or its equivalent to all. | -- | Robin | (BrE) | Herts, England Thanx for the update Robin! -- Dave http://www.claymania.com/removal-trojan-adware.html Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp |
#82
|
|||
|
|||
Infection messages?
"Robin Bignall" wrote in message
... On the subject of these messages: infection:documents and settings\robin bignall\cookies\index.dat could not be removed. file is no longer existent. appearing before the XP login screen, I have discovered how to stop them occurring. That is to turn off the real-time background protection in A-squared. This shows the importance of turning off or uninstalling various programs REGARDLESS of whether one believes it can not be the culprit. Troubleshooting any problem demands it. Reminds me of the times years ago (in the DOS and early Windows days) when *mouse drivers* would interfere with printing. Many a tech would be caught red-faced because they just could not believe a mouse driver would interfere with printing. Yet turn off or uninstall the mouse driver and the printing problem would disappear. Reinstall or turn the driver back on, and the printing problem would resurface. Any tech worth his salt will seek to *prove* a program/driver/utility is not the culprit, rather than go with the *belief* it can not be the culprit. I have even had people complain about turning off screen savers while troubleshooting a problem. Geeeeeez, it's not like I want them to turn it off forever, unless it is causing problems. Yes, even screen savers have been found to cause problems. |
#83
|
|||
|
|||
Infection messages?
On Thu, 24 Dec 2009 10:42:42 -0500, "Daave" wrote:
Robin Bignall wrote: On the subject of these messages: infection:documents and settings\robin bignall\cookies\index.dat could not be removed. file is no longer existent. appearing before the XP login screen, I have discovered how to stop them occurring. That is to turn off the real-time background protection in A-squared. I have no idea what is happening, but I assume something in A-squared is building a table (the number of messages I see seems to be directly proportional to the length of time the system is powered up) and then some component of XP, or, more likely, Kaspersky 2010, is running through this table generating these messages. Either some weird interaction or bug in either/both. The real-time guard of SAS works perfectly (or, at least, these messages do not appear when it's running). Merry Christmas or its equivalent to all. Thanks for sharing the cause of the problem. You are probably aware that it is not recommended to run two or more real-time antispyware (or antivirus) programs simultaneously. I wonder if you disabled SAS (or Kaspersky 2010) completely but keep A-Squared with its real-time protection on, what the outcome would be. I was aware of the problem running two antivirus programs simultaneously, but didn't appreciate that it applied to malware too. Having just installed Kaspersky 9.0.0.736 I'm reluctant to uninstall it. I'll switch Asquared on again and see if the problem still exists. SAS does not seem to affect these messages. -- Robin (BrE) Herts, England |
#84
|
|||
|
|||
Infection messages?
"Robin Bignall" wrote in message
... On Thu, 24 Dec 2009 10:42:42 -0500, "Daave" wrote: Robin Bignall wrote: On the subject of these messages: infection:documents and settings\robin bignall\cookies\index.dat could not be removed. file is no longer existent. appearing before the XP login screen, I have discovered how to stop them occurring. That is to turn off the real-time background protection in A-squared. I have no idea what is happening, but I assume something in A-squared is building a table (the number of messages I see seems to be directly proportional to the length of time the system is powered up) and then some component of XP, or, more likely, Kaspersky 2010, is running through this table generating these messages. Either some weird interaction or bug in either/both. The real-time guard of SAS works perfectly (or, at least, these messages do not appear when it's running). Merry Christmas or its equivalent to all. Thanks for sharing the cause of the problem. You are probably aware that it is not recommended to run two or more real-time antispyware (or antivirus) programs simultaneously. I wonder if you disabled SAS (or Kaspersky 2010) completely but keep A-Squared with its real-time protection on, what the outcome would be. I was aware of the problem running two antivirus programs simultaneously, but didn't appreciate that it applied to malware too. Having just installed Kaspersky 9.0.0.736 I'm reluctant to uninstall it. I'll switch Asquared on again and see if the problem still exists. SAS does not seem to affect these messages. It could even be affected by the order in which the suspects get loaded into memory. It kinda reminds me of the "Two Black Crows" routine about the race '...if I get there first, I'll draw a line in the dirt - if you get there first, you rub it out..'. Computer programs will actually try to do this when told to. |
#85
|
|||
|
|||
Infection messages?
"Andy Medina" wrote in message ... "Robin Bignall" wrote in message ... On the subject of these messages: infection:documents and settings\robin bignall\cookies\index.dat could not be removed. file is no longer existent. appearing before the XP login screen, I have discovered how to stop them occurring. That is to turn off the real-time background protection in A-squared. This shows the importance of turning off or uninstalling various programs REGARDLESS of whether one believes it can not be the culprit. Troubleshooting any problem demands it. Reminds me of the times years ago (in the DOS and early Windows days) when *mouse drivers* would interfere with printing. Many a tech would be caught red-faced because they just could not believe a mouse driver would interfere with printing. Yet turn off or uninstall the mouse driver and the printing problem would disappear. Reinstall or turn the driver back on, and the printing problem would resurface. Any tech worth his salt will seek to *prove* a program/driver/utility is not the culprit, rather than go with the *belief* it can not be the culprit. I have even had people complain about turning off screen savers while troubleshooting a problem. Geeeeeez, it's not like I want them to turn it off forever, unless it is causing problems. Yes, even screen savers have been found to cause problems. Agreed, ...the "bells and whistles" BLOATWARE that always seems to accompany new hardware, including mice - is often a recipe for disaster, i.e. it's often poorly written application software that accompanies hardware which causes problems, or, as you said, the mouse driver itseld. For years I've let Windows use it's own driver ! Unless Winodws can't find a "universal" driver (for want of a better word) then I think it best to chuck that CD that came with a piece of hardware - into the rubbish bin !! Also, too many people blindly install ALL the junk on the CD instead of just the driver !! ...then they wonder why their filetype associations have all changed !!!! regards, Richard |
#86
|
|||
|
|||
Infection messages?
On Thu, 24 Dec 2009 19:35:49 -0500, "FromTheRafters" erratic
@nomail.afraid.org wrote: "Robin Bignall" wrote in message .. . On Thu, 24 Dec 2009 10:42:42 -0500, "Daave" wrote: Robin Bignall wrote: On the subject of these messages: infection:documents and settings\robin bignall\cookies\index.dat could not be removed. file is no longer existent. appearing before the XP login screen, I have discovered how to stop them occurring. That is to turn off the real-time background protection in A-squared. I have no idea what is happening, but I assume something in A-squared is building a table (the number of messages I see seems to be directly proportional to the length of time the system is powered up) and then some component of XP, or, more likely, Kaspersky 2010, is running through this table generating these messages. Either some weird interaction or bug in either/both. The real-time guard of SAS works perfectly (or, at least, these messages do not appear when it's running). Merry Christmas or its equivalent to all. Thanks for sharing the cause of the problem. You are probably aware that it is not recommended to run two or more real-time antispyware (or antivirus) programs simultaneously. I wonder if you disabled SAS (or Kaspersky 2010) completely but keep A-Squared with its real-time protection on, what the outcome would be. I was aware of the problem running two antivirus programs simultaneously, but didn't appreciate that it applied to malware too. Having just installed Kaspersky 9.0.0.736 I'm reluctant to uninstall it. I'll switch Asquared on again and see if the problem still exists. SAS does not seem to affect these messages. It could even be affected by the order in which the suspects get loaded into memory. Does a user have any control over that? It kinda reminds me of the "Two Black Crows" routine about the race '...if I get there first, I'll draw a line in the dirt - if you get there first, you rub it out..'. Computer programs will actually try to do this when told to. I can confirm that the messages come back when A-squared's background guard is activated. -- Robin (BrE) Herts, England |
#87
|
|||
|
|||
Infection messages?
"Robin Bignall" wrote in message
... On Thu, 24 Dec 2009 19:35:49 -0500, "FromTheRafters" erratic @nomail.afraid.org wrote: [...] It could even be affected by the order in which the suspects get loaded into memory. Does a user have any control over that? Not really, that would be a memory management thing. If two programs had the task of deleting index.dat, and one of them did it by "delete file" and the other by "if file exists, delete file" the first one *first* and the second one *second* would not create an error message for display. If the sequence were reversed, the later "delete file" would error because no check was made for the file's existence beforehand and it *had* been deleted already. It creates a race condition of sorts, and can account for intermittent symptoms. It kinda reminds me of the "Two Black Crows" routine about the race '...if I get there first, I'll draw a line in the dirt - if you get there first, you rub it out..'. Computer programs will actually try to do this when told to. I can confirm that the messages come back when A-squared's background guard is activated. It seems that you have narrowed it down to A-Squared being what is responsible for the messages. As to why it is doing so, who knows? I had thought maybe some other antispy component was deleting the file (perhaps upon exiting the browser?), and that was not expected by the programmers of the program (A-Squared?) that subsequently tried (numerous times?) to delete the same file. Does A-Squared log those events as well as display the messages (the wording should be essentially the same)? |
#88
|
|||
|
|||
Infection messages?
On Fri, 25 Dec 2009 16:15:57 -0500, "FromTheRafters" erratic
@nomail.afraid.org wrote: "Robin Bignall" wrote in message .. . On Thu, 24 Dec 2009 19:35:49 -0500, "FromTheRafters" erratic @nomail.afraid.org wrote: [...] It could even be affected by the order in which the suspects get loaded into memory. Does a user have any control over that? Not really, that would be a memory management thing. If two programs had the task of deleting index.dat, and one of them did it by "delete file" and the other by "if file exists, delete file" the first one *first* and the second one *second* would not create an error message for display. If the sequence were reversed, the later "delete file" would error because no check was made for the file's existence beforehand and it *had* been deleted already. It creates a race condition of sorts, and can account for intermittent symptoms. It kinda reminds me of the "Two Black Crows" routine about the race '...if I get there first, I'll draw a line in the dirt - if you get there first, you rub it out..'. Computer programs will actually try to do this when told to. I can confirm that the messages come back when A-squared's background guard is activated. It seems that you have narrowed it down to A-Squared being what is responsible for the messages. As to why it is doing so, who knows? I had thought maybe some other antispy component was deleting the file (perhaps upon exiting the browser?), and that was not expected by the programmers of the program (A-Squared?) that subsequently tried (numerous times?) to delete the same file. Does A-Squared log those events as well as display the messages (the wording should be essentially the same)? I don't know. I've stopped using A-Squared and have raised this item on their web forum. -- Robin (BrE) Herts, England |
#89
|
|||
|
|||
Infection messages?
Robin Bignall wrote: [snipped] I don't know. I've stopped using A-Squared and have raised this item on their web forum. If you get an answer from them, let us know. At least you made a lot of progress. Buffalo |
#90
|
|||
|
|||
Infection messages?
From: "Robin Bignall"
| I don't know. I've stopped using A-Squared and have raised this item | on their web forum. | -- | Robin | (BrE) | Herts, England Did 'ShadowPuterDude' reply/respond ? If not, please send me an email of the posted URL and I will have him give your A-Squared thread due attention. -- Dave http://www.claymania.com/removal-trojan-adware.html Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp |
Thread Tools | |
Display Modes | |
|
|