From: Buffalo on


Robin Bignall wrote:
> On Thu, 10 Dec 2009 22:41:55 +0000, Robin Bignall
> <docrobin(a)ntlworld.com> wrote:
>
>> On Thu, 10 Dec 2009 22:13:51 +0000, Robin Bignall
>> <docrobin(a)ntlworld.com> wrote:
>>
>>> On Thu, 10 Dec 2009 14:27:55 -0700, "Buffalo"
>>> <Eric(a)nada.com.invalid> wrote:
>>>
>>>>
>>>>
>>>> Robin Bignall wrote:
>>>> [snip]
>>>>>>
>>>>>> That is why I recommended that he disable or uninstall his
>>>>>> anti-virus and anti-malware programs and install Avira AntiVir
>>>>>> and free MBAM and hopefully the free SAS. ( I don't think he
>>>>>> ever said that he tried them both)
>>>>>> If the above doesn't change things, then that would indicate a
>>>>>> different security program causing the problem.
>>>>>> Buffalo
>>>>>>
>>>>> Just to save you reading back in the thread, I have SAS Pro,
>>>>> which is not free, and MBAM, which is. I also run ActiveScan 2,
>>>>> which was recommended, together with Kaspersky, by AumHa. I
>>>>> don't intend to through the process of uninstalling Kaspersky.
>>>>
>>>> OK, missed that point. If you disable Kaspersky and just use the
>>>> free Avira AntiVir and no message comes up, perhaps it is
>>>> Kaspersky doing it.
>>>> Doesn't really seem like it's worth the trouble overall.
>>>> Buffalo
>>>> PS: If you ever find out what it is, please post back.
>>>>
>>> I certainly will.
>>
>> I'm running Avira now.
>
> And it found nothing.

Perhaps just let Avira run for several days while Kaspersky is disabled, if
you wish.
Buffalo


From: Robin Bignall on
On Thu, 10 Dec 2009 16:12:08 -0700, "Buffalo" <Eric(a)nada.com.invalid>
wrote:

>
>
["infected" messages before logon screen]

>>> I'm running Avira now.
>>
>> And it found nothing.
>
>Perhaps just let Avira run for several days while Kaspersky is disabled, if
>you wish.
>Buffalo
>
I don't think it'll find anything.
There appears to be no rhyme or reason behind these messages. For
example, when I rebooted last night, there were hundreds of these
messages, in bunches. I can't tell how many are in a bunch, maybe 32
or 64. A bunch scrolls for about five seconds, there's a two second
gap, then another bunch scrolls, and so on. Last night there were four
of these bunches, plus half a screen of bunch five. Tonight when I
booted there were just two of these messages (not two bunches). I
booted again and there were none. I've found this behaviour before.
These messages seem to come and go.

I just again checked the contents of all files on c: and d:, and the
registry, for the string "infection", without finding anything
associated in any way with an executable. Weird.
--
Robin
(BrE)
Herts, England
From: Buffalo on


Robin Bignall wrote:
> On Thu, 10 Dec 2009 16:12:08 -0700, "Buffalo" <Eric(a)nada.com.invalid>
> wrote:
>
>>
>>
> ["infected" messages before logon screen]
>
>>>> I'm running Avira now.
>>>
>>> And it found nothing.
>>
>> Perhaps just let Avira run for several days while Kaspersky is
>> disabled, if you wish.
>> Buffalo
>>
> I don't think it'll find anything.
> There appears to be no rhyme or reason behind these messages. For
> example, when I rebooted last night, there were hundreds of these
> messages, in bunches. I can't tell how many are in a bunch, maybe 32
> or 64. A bunch scrolls for about five seconds, there's a two second
> gap, then another bunch scrolls, and so on. Last night there were four
> of these bunches, plus half a screen of bunch five. Tonight when I
> booted there were just two of these messages (not two bunches). I
> booted again and there were none. I've found this behaviour before.
> These messages seem to come and go.
>
> I just again checked the contents of all files on c: and d:, and the
> registry, for the string "infection", without finding anything
> associated in any way with an executable. Weird.

I was just suggesting that possibly Kaspersky could be the culprit and
disabling it and only running Avira to see if the messages stop.
However, I really doubt Kaspersky would react that way.
We know 'something' is generating the messages and hopefully there is
someone in this ng that would have a good suggestion for a program that
could monitor all the startups.
Buffalo
PS: It will be interesting to see what caused it. :)
And, do you have more than one (1) antivirus program running in real time,
such as Windows Defender?