Prev: Avira switches to new update system
Next: Another Crock Of Fuvg Spyware Program
From: David H. Lipman on 25 Nov 2009 19:09
From: "Robin Bignall" <docrobin(a)ntlworld.com>

< snip >

| Thanks. I should say two other things:
| I ran MRT.EXE /f:y this afternoon. Zero problems reported.
| On reboot, sometimes all of these 'infection' messages are simply not
| there. Then, on another reboot, they're back again, sometimes a few,
| sometimes screens full. Normally I hibernate overnight and only
| reboot when something, like critical updates, forces me to.

| (alt.privacy.spyware added because this is being discussed there,
| too.)
| --
| Robin
| (BrE)
| Herts, England


It is definitly a security tool set to delete the file index.dat at system Reboot and
before the Winlogon process.

However, at this time none of my peers have pinpointed exactly what security tool is
generating the process.

However at this point I can/will say "don't worry". We know have done numerous anti
malware scans and the system can be deemed clean so don't get frazzled over this.

I will keep researching this and hopefully we will find what security tool is generating
the display you have seen.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp


From: Andy Walker on 25 Nov 2009 23:34
David H. Lipman wrote:

>I will keep researching this and hopefully we will find what security tool is generating
>the display you have seen.

It occurred to me that she may be able to find the text of the error
in a log file for the program generating the error. Assuming the
program keeps a log, and the log has a formatted text element, she
should be able to use the search function in Windows to search for the
string "INFECTION: DOCUMENTS AND SETTINGS\ROBIN
BIGNALL\COOKIES\INDEX.DAT COULD NOT BE REMOVED. FILE IS NO LONGER
EXISTENT." or some portion of that. If she can find the log file, she
should be able to identify the program.

From: David H. Lipman on 26 Nov 2009 08:50
From: "Andy Walker" <awalker(a)nspank.invalid>

| David H. Lipman wrote:

>>I will keep researching this and hopefully we will find what security tool is
>>generating
>>the display you have seen.

| It occurred to me that she may be able to find the text of the error
| in a log file for the program generating the error. Assuming the
| program keeps a log, and the log has a formatted text element, she
| should be able to use the search function in Windows to search for the
| string "INFECTION: DOCUMENTS AND SETTINGS\ROBIN
| BIGNALL\COOKIES\INDEX.DAT COULD NOT BE REMOVED. FILE IS NO LONGER
| EXISTENT." or some portion of that. If she can find the log file, she
| should be able to identify the program.


A good approach !

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp


From: Robin Bignall on 26 Nov 2009 16:10
On Wed, 25 Nov 2009 23:34:09 -0500, Andy Walker
<awalker(a)nspank.invalid> wrote:

>David H. Lipman wrote:
>
>>I will keep researching this and hopefully we will find what security tool is generating
>>the display you have seen.
>
>It occurred to me that she may be able to find the text of the error
>in a log file for the program generating the error. Assuming the
>program keeps a log, and the log has a formatted text element, she
>should be able to use the search function in Windows to search for the
>string "INFECTION: DOCUMENTS AND SETTINGS\ROBIN
>BIGNALL\COOKIES\INDEX.DAT COULD NOT BE REMOVED. FILE IS NO LONGER
>EXISTENT." or some portion of that. If she can find the log file, she
>should be able to identify the program.

Excellent idea, Andy. I'll try now and report back. Thanks also
David.
--
Robin (who is a he!)
(BrE)
Herts, England
From: Robin Bignall on 26 Nov 2009 16:32
On Thu, 26 Nov 2009 21:10:05 +0000, Robin Bignall
<docrobin(a)ntlworld.com> wrote:

>On Wed, 25 Nov 2009 23:34:09 -0500, Andy Walker
><awalker(a)nspank.invalid> wrote:
>
>>David H. Lipman wrote:
>>
>>>I will keep researching this and hopefully we will find what security tool is generating
>>>the display you have seen.
>>
>>It occurred to me that she may be able to find the text of the error
>>in a log file for the program generating the error. Assuming the
>>program keeps a log, and the log has a formatted text element, she
>>should be able to use the search function in Windows to search for the
>>string "INFECTION: DOCUMENTS AND SETTINGS\ROBIN
>>BIGNALL\COOKIES\INDEX.DAT COULD NOT BE REMOVED. FILE IS NO LONGER
>>EXISTENT." or some portion of that. If she can find the log file, she
>>should be able to identify the program.
>
>Excellent idea, Andy. I'll try now and report back. Thanks also
>David.

No joy with that. I searched for
FILE IS NO LONGER EXISTENT
but didn't find anything.
--
Robin
(BrE)
Herts, England

ps: do any of you out there live in Herts and use
text.news.virginmedia.com? Access from Herts has been down for nearly
a week.
--
Robin
(BrE)
Herts, England
 |  Next  |  Last
Pages: 1 2 3 4 5 6 7
Prev: Avira switches to new update system
Next: Another Crock Of Fuvg Spyware Program