Infection messages?
in [Help and Support]
|
Prev: Cannot Install / Find Driver for Microsoft 2.4GHz Transceiver USB?
Next: Persistent Problem with USPS Shipping Assistant .Net Framework
From: Robin Bignall on 26 Nov 2009 18:15 On Wed, 25 Nov 2009 20:24:12 -0500, "FromTheRafters" <erratic @nomail.afraid.org> wrote: >"Robin Bignall" <docrobin(a)ntlworld.com> wrote in message >news:bubrg555vcle0jo5kj0ioouhg90djmtlsg(a)4ax.com... > >The precise message is: >INFECTION:DOCUMENTS AND SETTINGS\ROBIN BIGNALL\COOKIES\INDEX.DAT COULD >NOT BE REMOVED. FILE IS NO LONGER EXISTENT. > >*** >It sounds to me like a conflict between two programs trying to do the >same thing, and one doesn't check for the existence of the file prior to >attempting the delete action. >*** > What, other than malware, would want to delete the cookie index? Incidentally, I've run iecv, and there are no cookies in any of the user's cookie folders. -- Robin (BrE) Herts, England
From: "FromTheRafters" erratic on 26 Nov 2009 19:04 "Robin Bignall" <docrobin(a)ntlworld.com> wrote in message news:kt2ug5163h2js36ir46ndbci7ogvkhd6dq(a)4ax.com... On Wed, 25 Nov 2009 20:24:12 -0500, "FromTheRafters" <erratic @nomail.afraid.org> wrote: >"Robin Bignall" <docrobin(a)ntlworld.com> wrote in message >news:bubrg555vcle0jo5kj0ioouhg90djmtlsg(a)4ax.com... > >The precise message is: >INFECTION:DOCUMENTS AND SETTINGS\ROBIN BIGNALL\COOKIES\INDEX.DAT COULD >NOT BE REMOVED. FILE IS NO LONGER EXISTENT. > >*** >It sounds to me like a conflict between two programs trying to do the >same thing, and one doesn't check for the existence of the file prior >to >attempting the delete action. >*** > What, other than malware, would want to delete the cookie index? Incidentally, I've run iecv, and there are no cookies in any of the user's cookie folders. *** People who have issues with privacy and spyware (in the form of cookies) sometimes download programs that "protect" them from data leakage (or from their own OS's hidden data stores or pagefile.sys). Malware (spyware specifically) is more likely to want that file to remain existent. ***
From: Robin Bignall on 27 Nov 2009 10:36 On Thu, 26 Nov 2009 19:04:55 -0500, "FromTheRafters" <erratic @nomail.afraid.org> wrote: > >"Robin Bignall" <docrobin(a)ntlworld.com> wrote in message >news:kt2ug5163h2js36ir46ndbci7ogvkhd6dq(a)4ax.com... >On Wed, 25 Nov 2009 20:24:12 -0500, "FromTheRafters" <erratic >@nomail.afraid.org> wrote: > >>"Robin Bignall" <docrobin(a)ntlworld.com> wrote in message >>news:bubrg555vcle0jo5kj0ioouhg90djmtlsg(a)4ax.com... >> >>The precise message is: >>INFECTION:DOCUMENTS AND SETTINGS\ROBIN BIGNALL\COOKIES\INDEX.DAT COULD >>NOT BE REMOVED. FILE IS NO LONGER EXISTENT. >> Just another piece of data. I just logged on as "administrator" (with several screens full of these infection messages) to see if, when I rebooted, I might have some "administrator\cookies\index.dat" messages. When I rebooted back as myself all the infection messages had vanished. But this has happened before on reboot. -- Robin (BrE) Herts, England
From: Robin Bignall on 7 Dec 2009 11:08 On Wed, 25 Nov 2009 19:09:56 -0500, "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote: >From: "Robin Bignall" <docrobin(a)ntlworld.com> > >< snip > > >| Thanks. I should say two other things: >| I ran MRT.EXE /f:y this afternoon. Zero problems reported. >| On reboot, sometimes all of these 'infection' messages are simply not >| there. Then, on another reboot, they're back again, sometimes a few, >| sometimes screens full. Normally I hibernate overnight and only >| reboot when something, like critical updates, forces me to. > >| (alt.privacy.spyware added because this is being discussed there, >| too.) >| -- >| Robin >| (BrE) >| Herts, England > > >It is definitly a security tool set to delete the file index.dat at system Reboot and >before the Winlogon process. > >However, at this time none of my peers have pinpointed exactly what security tool is >generating the process. > >However at this point I can/will say "don't worry". We know have done numerous anti >malware scans and the system can be deemed clean so don't get frazzled over this. > >I will keep researching this and hopefully we will find what security tool is generating >the display you have seen. Just another word on this, for it's still happening. I created a text file on c: containing the word "infection" only. I then used Windows 'search within files' to check all files -- including hidden and system -- on the system disk. I found seven instances of 'infection' in various places, mostly text or pdf files, including the made-up one, but none relating in any way to the system, the virus checker or any malware. I find it baffling to know what is generating this message, and how. -- Robin (BrE) Herts, England
From: David H. Lipman on 7 Dec 2009 16:08
From: "Robin Bignall" <docrobin(a)ntlworld.com> | Just another word on this, for it's still happening. I created a text | file on c: containing the word "infection" only. I then used Windows | 'search within files' to check all files -- including hidden and | system -- on the system disk. I found seven instances of 'infection' | in various places, mostly text or pdf files, including the made-up | one, but none relating in any way to the system, the virus checker or | any malware. I find it baffling to know what is generating this | message, and how. | -- | Robin | (BrE) | Herts, England To date, NOTHING has been pin-pointed yet as the source :-( -- Dave http://www.claymania.com/removal-trojan-adware.html Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp |