Infection messages?
in [Windows Viruses]
|
From: RJK on 24 Dec 2009 19:58 "Andy Medina" <gmedina(a)email.arizona.edu> wrote in message news:O9OkJxNhKHA.6136(a)TK2MSFTNGP04.phx.gbl... > "Robin Bignall" <docrobin(a)ntlworld.com> wrote in message > news:9u17j5h59c4ubfq3d9qvdsr5hmb3a3e7as(a)4ax.com... >> On the subject of these messages: >> >> infection:documents and settings\robin bignall\cookies\index.dat could >> not be removed. file is no longer existent. >> >> appearing before the XP login screen, I have discovered how to stop >> them occurring. That is to turn off the real-time background >> protection in A-squared. > > This shows the importance of turning off or uninstalling various programs > REGARDLESS of whether one believes it can not be the culprit. > Troubleshooting any problem demands it. Reminds me of the times years ago > (in the DOS and early Windows days) when *mouse drivers* would interfere > with printing. Many a tech would be caught red-faced because they just > could not believe a mouse driver would interfere with printing. Yet turn > off or uninstall the mouse driver and the printing problem would > disappear. Reinstall or turn the driver back on, and the printing problem > would resurface. Any tech worth his salt will seek to *prove* a > program/driver/utility is not the culprit, rather than go with the > *belief* it can not be the culprit. I have even had people complain about > turning off screen savers while troubleshooting a problem. Geeeeeez, it's > not like I want them to turn it off forever, unless it is causing > problems. Yes, even screen savers have been found to cause problems. > Agreed, ...the "bells and whistles" BLOATWARE that always seems to accompany new hardware, including mice - is often a recipe for disaster, i.e. it's often poorly written application software that accompanies hardware which causes problems, or, as you said, the mouse driver itseld. For years I've let Windows use it's own driver ! Unless Winodws can't find a "universal" driver (for want of a better word) then I think it best to chuck that CD that came with a piece of hardware - into the rubbish bin !! Also, too many people blindly install ALL the junk on the CD instead of just the driver !! ...then they wonder why their filetype associations have all changed !!!! regards, Richard
From: Robin Bignall on 25 Dec 2009 15:25 On Thu, 24 Dec 2009 19:35:49 -0500, "FromTheRafters" <erratic @nomail.afraid.org> wrote: >"Robin Bignall" <docrobin(a)ntlworld.com> wrote in message >news:vrq7j5940bhg9haf1j3i6fpv2m385mh3rb(a)4ax.com... >> On Thu, 24 Dec 2009 10:42:42 -0500, "Daave" <daave(a)example.com> wrote: >> >>>Robin Bignall wrote: >>>> On the subject of these messages: >>>> >>>> infection:documents and settings\robin bignall\cookies\index.dat >>>> could >>>> not be removed. file is no longer existent. >>>> >>>> appearing before the XP login screen, I have discovered how to stop >>>> them occurring. That is to turn off the real-time background >>>> protection in A-squared. >>>> >>>> I have no idea what is happening, but I assume something in >>>> A-squared >>>> is building a table (the number of messages I see seems to be >>>> directly >>>> proportional to the length of time the system is powered up) and >>>> then >>>> some component of XP, or, more likely, Kaspersky 2010, is running >>>> through this table generating these messages. Either some weird >>>> interaction or bug in either/both. >>>> >>>> The real-time guard of SAS works perfectly (or, at least, these >>>> messages do not appear when it's running). >>>> >>>> Merry Christmas or its equivalent to all. >>> >>>Thanks for sharing the cause of the problem. >>> >>>You are probably aware that it is not recommended to run two or more >>>real-time antispyware (or antivirus) programs simultaneously. I wonder >>>if you disabled SAS (or Kaspersky 2010) completely but keep A-Squared >>>with its real-time protection on, what the outcome would be. >>> >> I was aware of the problem running two antivirus programs >> simultaneously, but didn't appreciate that it applied to malware too. >> Having just installed Kaspersky 9.0.0.736 I'm reluctant to uninstall >> it. I'll switch Asquared on again and see if the problem still >> exists. SAS does not seem to affect these messages. > >It could even be affected by the order in which the suspects get loaded >into memory. Does a user have any control over that? >It kinda reminds me of the "Two Black Crows" routine about >the race '...if I get there first, I'll draw a line in the dirt - if you >get there first, you rub it out..'. Computer programs will actually try >to do this when told to. > I can confirm that the messages come back when A-squared's background guard is activated. -- Robin (BrE) Herts, England
From: "FromTheRafters" erratic on 25 Dec 2009 16:15 "Robin Bignall" <docrobin(a)ntlworld.com> wrote in message news:jk7aj55c990fgkvobdtq6gva74sahf9d8h(a)4ax.com... > On Thu, 24 Dec 2009 19:35:49 -0500, "FromTheRafters" <erratic > @nomail.afraid.org> wrote: [...] >>It could even be affected by the order in which the suspects get >>loaded >>into memory. > Does a user have any control over that? Not really, that would be a memory management thing. If two programs had the task of deleting index.dat, and one of them did it by "delete file" and the other by "if file exists, delete file" the first one *first* and the second one *second* would not create an error message for display. If the sequence were reversed, the later "delete file" would error because no check was made for the file's existence beforehand and it *had* been deleted already. It creates a race condition of sorts, and can account for intermittent symptoms. >>It kinda reminds me of the "Two Black Crows" routine about >>the race '...if I get there first, I'll draw a line in the dirt - if >>you >>get there first, you rub it out..'. Computer programs will actually >>try >>to do this when told to. >> > I can confirm that the messages come back when A-squared's background > guard is activated. It seems that you have narrowed it down to A-Squared being what is responsible for the messages. As to why it is doing so, who knows? I had thought maybe some other antispy component was deleting the file (perhaps upon exiting the browser?), and that was not expected by the programmers of the program (A-Squared?) that subsequently tried (numerous times?) to delete the same file. Does A-Squared log those events as well as display the messages (the wording should be essentially the same)?
From: Robin Bignall on 28 Dec 2009 16:44 On Fri, 25 Dec 2009 16:15:57 -0500, "FromTheRafters" <erratic @nomail.afraid.org> wrote: >"Robin Bignall" <docrobin(a)ntlworld.com> wrote in message >news:jk7aj55c990fgkvobdtq6gva74sahf9d8h(a)4ax.com... >> On Thu, 24 Dec 2009 19:35:49 -0500, "FromTheRafters" <erratic >> @nomail.afraid.org> wrote: > >[...] > >>>It could even be affected by the order in which the suspects get >>>loaded >>>into memory. > >> Does a user have any control over that? > >Not really, that would be a memory management thing. If two programs had >the task of deleting index.dat, and one of them did it by "delete file" >and the other by "if file exists, delete file" the first one *first* and >the second one *second* would not create an error message for display. >If the sequence were reversed, the later "delete file" would error >because no check was made for the file's existence beforehand and it >*had* been deleted already. It creates a race condition of sorts, and >can account for intermittent symptoms. > >>>It kinda reminds me of the "Two Black Crows" routine about >>>the race '...if I get there first, I'll draw a line in the dirt - if >>>you >>>get there first, you rub it out..'. Computer programs will actually >>>try >>>to do this when told to. >>> >> I can confirm that the messages come back when A-squared's background >> guard is activated. > >It seems that you have narrowed it down to A-Squared being what is >responsible for the messages. As to why it is doing so, who knows? I had >thought maybe some other antispy component was deleting the file >(perhaps upon exiting the browser?), and that was not expected by the >programmers of the program (A-Squared?) that subsequently tried >(numerous times?) to delete the same file. > >Does A-Squared log those events as well as display the messages (the >wording should be essentially the same)? > I don't know. I've stopped using A-Squared and have raised this item on their web forum. -- Robin (BrE) Herts, England
From: Buffalo on 28 Dec 2009 16:55
Robin Bignall wrote: [snipped] > I don't know. I've stopped using A-Squared and have raised this item > on their web forum. If you get an answer from them, let us know. At least you made a lot of progress. Buffalo |