From: Robin Bignall on
XP Pro SP3
During the past few weeks, immediately after the initial Windows
screen with the blue bar running left right, and before the logon
screen, I get a blue screen with white messages. There are dozens of
them, all identical, which say something like:
Infection: docs and settings my name cookies/index.dat does not exist
and cannot be removed. (Pause is inoperative and the normal logon
screen appears immediately after.)

If I reboot at the logon screen instead of logging on, they have all
disappeared. CHKDSK on system disk shows a healthy disk.

I have Kaspersky 9 and have run MBAM SAS Asquared etc., nothing found.
What is causing these? (There's no anti-virus in my BIOS, BTW.)
--
Robin
(BrE)
Herts, England
From: Gerry on
Robin

They could be ophaned start up items. Perhaps an infection only partly
removed.

To identify what loads when you boot use Autoruns (freeware) from
Microsoft.
http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/Autoruns.mspx

With Autoruns you can uncheck an item, which disables it from
starting,or you can right click an item and then delete it. If you
uncheck you can recheck to re-enable the item. It is a much safer
approach than editing the Registry and better than using msconfig..
Another useful feature of the programme is that you can right click an
item and select Search Online to get information about the item
selected.

When booting an automatic virus scan can impact significantly on
performance. The extent varies according to the anti-virus software, the
availability of RAM and the CPU capacity.

Is your system error free?

Have a look in the System and Application logs in Event Viewer for
Errors and Warnings and post copies here. Don't post any more than 48
hours ago.

You can access Event Viewer by selecting Start, Control Panel,
Administrative Tools, and Event Viewer. When researching the meaning
of the error, information regarding Event ID, Source and Description
are important.

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Click the button and close Event
Viewer.Now start your message (email) and do a paste into the body of
the message. Make sure this is the first paste after exiting from
Event Viewer.

--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

Robin Bignall wrote:
> XP Pro SP3
> During the past few weeks, immediately after the initial Windows
> screen with the blue bar running left right, and before the logon
> screen, I get a blue screen with white messages. There are dozens of
> them, all identical, which say something like:
> Infection: docs and settings my name cookies/index.dat does not exist
> and cannot be removed. (Pause is inoperative and the normal logon
> screen appears immediately after.)
>
> If I reboot at the logon screen instead of logging on, they have all
> disappeared. CHKDSK on system disk shows a healthy disk.
>
> I have Kaspersky 9 and have run MBAM SAS Asquared etc., nothing found.
> What is causing these? (There's no anti-virus in my BIOS, BTW.)

From: Daave on
Robin Bignall wrote:
> XP Pro SP3
> During the past few weeks, immediately after the initial Windows
> screen with the blue bar running left right, and before the logon
> screen, I get a blue screen with white messages. There are dozens of
> them, all identical, which say something like:
> Infection: docs and settings my name cookies/index.dat does not exist
> and cannot be removed. (Pause is inoperative and the normal logon
> screen appears immediately after.)

It is very important that you post back with the exact, complete
message! It's hard to tell at this moment, but it's possible you have a
variation of what is described here:

http://www.bleepingcomputer.com/virus-removal/anti-virus-1-removal

Please post back with the complete message.


From: Peter Foldes on
Robin

What is the exact error message as per verbatim that shows up on the Blue screen .
We need that for a proper answer

--
Peter

Please Reply to Newsgroup for the benefit of others
Requests for assistance by email can not and will not be acknowledged.

"Robin Bignall" <docrobin(a)ntlworld.com> wrote in message
news:h1gig5ten6ng0393s82qobo4829ucuco25(a)4ax.com...
XP Pro SP3
During the past few weeks, immediately after the initial Windows
screen with the blue bar running left right, and before the logon
screen, I get a blue screen with white messages. There are dozens of
them, all identical, which say something like:
Infection: docs and settings my name cookies/index.dat does not exist
and cannot be removed. (Pause is inoperative and the normal logon
screen appears immediately after.)

If I reboot at the logon screen instead of logging on, they have all
disappeared. CHKDSK on system disk shows a healthy disk.

I have Kaspersky 9 and have run MBAM SAS Asquared etc., nothing found.
What is causing these? (There's no anti-virus in my BIOS, BTW.)
--
Robin
(BrE)
Herts, England

From: Robin Bignall on
On Sun, 22 Nov 2009 11:36:50 -0500, "Daave" <daave(a)example.com> wrote:

>Robin Bignall wrote:
>> XP Pro SP3
>> During the past few weeks, immediately after the initial Windows
>> screen with the blue bar running left right, and before the logon
>> screen, I get a blue screen with white messages. There are dozens of
>> them, all identical, which say something like:
>> Infection: docs and settings my name cookies/index.dat does not exist
>> and cannot be removed. (Pause is inoperative and the normal logon
>> screen appears immediately after.)
>
>It is very important that you post back with the exact, complete
>message! It's hard to tell at this moment, but it's possible you have a
>variation of what is described here:
>
>http://www.bleepingcomputer.com/virus-removal/anti-virus-1-removal
>
>Please post back with the complete message.
>
Difficult. Pause/break stops the screen for a second and then it goes
straight to the logon. I just rebooted and all those messages have
vanished. None of the virus/malware programs finds anything.
I'll post again if those messages reappear. There's nothing in the
event log that looks suspicious.
--
Robin
(BrE)
Herts, England