Infection messages?

[Buffalo]

On Thu, 10 Dec 2009 14:27:55 -0700, "Buffalo"



Robin Bignall wrote:
[snip]

That is why I recommended that he disable or uninstall his
anti-virus and anti-malware programs and install Avira AntiVir
and free MBAM and hopefully the free SAS. ( I don't think he
ever said that he tried them both)
If the above doesn't change things, then that would indicate a
different security program causing the problem.
Buffalo

Just to save you reading back in the thread, I have SAS Pro,
which is not free, and MBAM, which is. I also run ActiveScan 2,
which was recommended, together with Kaspersky, by AumHa. I
don't intend to through the process of uninstalling Kaspersky.

OK, missed that point. If you disable Kaspersky and just use the
free Avira AntiVir and no message comes up, perhaps it is
Kaspersky doing it.
Doesn't really seem like it's worth the trouble overall.
Buffalo
PS: If you ever find out what it is, please post back.

I certainly will.

I'm running Avira now.

And it found nothing.

Perhaps just let Avira run for several days while Kaspersky is disabled, if
you wish.
Buffalo

 

[Robin Bignall]

["infected" messages before logon screen]

Perhaps just let Avira run for several days while Kaspersky is disabled,if
you wish.
Buffalo

I don't think it'll find anything.
There appears to be no rhyme or reason behind these messages. For
example, when I rebooted last night, there were hundreds of these
messages, in bunches. I can't tell how many are in a bunch, maybe 32
or 64. A bunch scrolls for about five seconds, there's a two second
gap, then another bunch scrolls, and so on. Last night there were four
of these bunches, plus half a screen of bunch five. Tonight when I
booted there were just two of these messages (not two bunches). I
booted again and there were none. I've found this behaviour before.
These messages seem to come and go.

I just again checked the contents of all files on c: and d:, and the
registry, for the string "infection", without finding anything
associated in any way with an executable. Weird.

 

[Buffalo]

["infected" messages before logon screen]

Perhaps just let Avira run for several days while Kaspersky is
disabled, if you wish.
Buffalo

I don't think it'll find anything.
There appears to be no rhyme or reason behind these messages. For
example, when I rebooted last night, there were hundreds of these
messages, in bunches. I can't tell how many are in a bunch, maybe 32
or 64. A bunch scrolls for about five seconds, there's a two second
gap, then another bunch scrolls, and so on. Last night there were four
of these bunches, plus half a screen of bunch five. Tonight when I
booted there were just two of these messages (not two bunches). I
booted again and there were none. I've found this behaviour before.
These messages seem to come and go.

I just again checked the contents of all files on c: and d:, and the
registry, for the string "infection", without finding anything
associated in any way with an executable. Weird.

I was just suggesting that possibly Kaspersky could be the culprit and
disabling it and only running Avira to see if the messages stop.
However, I really doubt Kaspersky would react that way.
We know 'something' is generating the messages and hopefully there is
someone in this ng that would have a good suggestion for a program that
could monitor all the startups.
Buffalo
PS: It will be interesting to see what caused it.
And, do you have more than one (1) antivirus program running in real time,
such as Windows Defender?

 

[FromTheRafters]

Do you use "Windows Washer" or some similar program?

 

[Daave]

Just another piece of data. I just logged on as "administrator" (with
several screens full of these infection messages) to see if, when I
rebooted, I might have some "administrator\cookies\index.dat"
messages.
When I rebooted back as myself all the infection messages had
vanished. But this has happened before on reboot.

If you configue a Clean Boot, do you still get these messages?

 

[Elmo]

The message is:
infection:documents and settings\robin bignall\cookies\index.dat could
not be removed. file is no longer existent.

This thread is very long.. if you've tried the following, I missed it.

A couple of things I would try:

- Create a text file using Wordpad and name it "index.dat". Store it in
the Documents and Settings\Robin Bignall\Cookies\ folder and restart the
machine.

- Look in the BIOS for an a/v utility and disable it.

 

[The Real Truth MVP]

Window washer no mail washer pro yes.


--
The Real Truth http://pcbutts1-therealtruth.blogspot.com/
*WARNING* Do NOT follow any advice given by the people listed below.
They do NOT have the expertise or knowledge to fix your issue. Do not waste
your time.
David H Lipman, Malke, PA Bear, Beauregard T. Shagnasty, Leythos.

 

[Leythos]

David H Lipman, Malke, PA Bear, Beauregard T. Shagnasty, Leythos.

I see you're still stalking myself and other in every post you make -
shows just how unethical you are.

 

[Robin Bignall]

Do you use "Windows Washer" or some similar program?

No, only what's in IE8 and CCleaner.

 

[The Real Truth MVP]

Actually Robin you do have Mail Washer Pro installed unless you've
uninstalled it in the past few days. It shows up in your log file.



--
The Real Truth http://pcbutts1-therealtruth.blogspot.com/
*WARNING* Do NOT follow any advice given by the people listed below.
They do NOT have the expertise or knowledge to fix your issue. Do not waste
your time.
David H Lipman, Malke, PA Bear, Beauregard T. Shagnasty, Leythos.

Do you use "Windows Washer" or some similar program?

No, only what's in IE8 and CCleaner.

 

[FromTheRafters]

Window washer no mail washer pro yes.

Thanks.

I asked about Windows Washer (and similar) because that is one program
that 'cleans up' some of the residual browsing traces by deleting
certain index.dat files (for privacy zealots). It wouldn't surprise me
if this were a conflict between two such programs - one that didn't
forsee the possibility that "not exist" could ever exist.

The OP could conceivably uninstall and then reinstall them in the
reverse order and avoid the 'non handled' error (assuming the other
program is written more smartly).

 

[FromTheRafters]

Do you use "Windows Washer" or some similar program?

No, only what's in IE8 and CCleaner.

***
I'm not too familiar with that (although I use it myself), but do you
use it in conjunction with a browser add-on (Firefox?).

I'm just grasping at straws here - try removing ccleaner completely (you
can reinstall it later) and see if the problem persists.
***

 

[Robin Bignall]

If you configue a Clean Boot, do you still get these messages?

It's hard to say, for a couple of reasons.
- even when logging on as "administrator" rather than just a member of
the administrator's group, you can't shut Kaspersky down without
uninstalling it. A "turn off protection for an hour" does not apply
through a reboot.
- sometimes, during normal operation, all of these messages vanish
anyway.

Having said that, I managed a cleanish boot with just Kaspersky and
the loudspeaker symbol showing in the tray, everything else disabled.
There were no infection messages on reboot. But I re enabled
everything and have booted several times since then and there are
still no messages. What this means I don't know.

 

[Robin Bignall]

No, only what's in IE8 and CCleaner.

***
I'm not too familiar with that (although I use it myself), but do you
use it in conjunction with a browser add-on (Firefox?).

No, I just use IE8.

I'm just grasping at straws here - try removing ccleaner completely (you
can reinstall it later) and see if the problem persists.
***

Ccleaner shouldn't do anything unless it's actually run. I haven't
run it for a few days, I just rebooted and got about 40 of these
messages, after having none for a while. Must get to bed now, but
tomorrow I'll physically disconnect from the Internet and boot a few
times to see what happens.

 

[The Real Truth MVP]

Completely uninstall Kaspersky and any other AV you may be running, reboot a
few times to see if it returns if it does then we know it is not Kaspersky.


--
The Real Truth http://pcbutts1-therealtruth.blogspot.com/
*WARNING* Do NOT follow any advice given by the people listed below.
They do NOT have the expertise or knowledge to fix your issue. Do not waste
your time.
David H Lipman, Malke, PA Bear, Beauregard T. Shagnasty, Leythos.

If you configue a Clean Boot, do you still get these messages?

It's hard to say, for a couple of reasons.
- even when logging on as "administrator" rather than just a member of
the administrator's group, you can't shut Kaspersky down without
uninstalling it. A "turn off protection for an hour" does not apply
through a reboot.
- sometimes, during normal operation, all of these messages vanish
anyway.

Having said that, I managed a cleanish boot with just Kaspersky and
the loudspeaker symbol showing in the tray, everything else disabled.
There were no infection messages on reboot. But I re enabled
everything and have booted several times since then and there are
still no messages. What this means I don't know.

 

[Daave]

It's hard to say, for a couple of reasons.
- even when logging on as "administrator" rather than just a member of
the administrator's group, you can't shut Kaspersky down without
uninstalling it. A "turn off protection for an hour" does not apply
through a reboot.
- sometimes, during normal operation, all of these messages vanish
anyway.

Having said that, I managed a cleanish boot with just Kaspersky and
the loudspeaker symbol showing in the tray, everything else disabled.
There were no infection messages on reboot. But I re enabled
everything and have booted several times since then and there are
still no messages. What this means I don't know.

Alas, intermittent problems are the most difficult to solve! And perhaps
you unknowingly fixed your problem.

 

[FromTheRafters]

If you configue a Clean Boot, do you still get these messages?

It's hard to say, for a couple of reasons.
- even when logging on as "administrator" rather than just a member of
the administrator's group, you can't shut Kaspersky down without
uninstalling it. A "turn off protection for an hour" does not apply
through a reboot.
- sometimes, during normal operation, all of these messages vanish
anyway.

Having said that, I managed a cleanish boot with just Kaspersky and
the loudspeaker symbol showing in the tray, everything else disabled.
There were no infection messages on reboot. But I re enabled
everything and have booted several times since then and there are
still no messages. What this means I don't know.

***
The intermittent nature of the symptoms may be due to a race condition.
What might be causing it, I haven't a clue.

Not removing ccleaner, because you don't think it could be the problem,
is not good troubleshooting. Many is the time that something that
couldn't be the cause of something - actually was the cause. I'm not
saying that this is the case here, but why not remove it anyway to see
what happens? It's not as if it were a needed system file, and you could
just put it back afterward.

Sorry I couldn't help you.
***

 

[Robin Bignall]

Alas, intermittent problems are the most difficult to solve! And perhaps
you unknowingly fixed your problem.

Unfortunately, no. When I booted this morning I got 30 or 40 of these
messages. I booted having physically disconnected from the Internet,
to leave the machine running all day and see what, if anything
happened. Unfortunately, my helpful wife, seeing the machine running
and thinking I'd inadvertently left it on, shut it down a few minutes
later. When I booted tonight, no infection messages. Who knows what
I'll see tomorrow...

 

[Robin Bignall]

This thread is very long.. if you've tried the following, I missed it.

A couple of things I would try:

- Create a text file using Wordpad and name it "index.dat". Store it in
the Documents and Settings\Robin Bignall\Cookies\ folder and restart the
machine.

I'll try that, see what happens.

- Look in the BIOS for an a/v utility and disable it.

That was the first thing that occurred to me. I don't see any a/v in
my ASUS BIOS (it's a P5E3 deluxe)

 

[Massimo]

Unfortunately, no. When I booted this morning I got 30 or 40 of these
messages. I booted having physically disconnected from the Internet,
to leave the machine running all day and see what, if anything
happened. Unfortunately, my helpful wife, seeing the machine running
and thinking I'd inadvertently left it on, shut it down a few minutes
later. When I booted tonight, no infection messages. Who knows what
I'll see tomorrow...

Your wife, most probably.

Massimo