bracketed value pop-ups.. does it equal a virus?

Viruses and worms
1

hi, i keep getting pop ups that have this value in brackets: {B54B2B71-79A8-4ce8-A319-ECSB45BE42B3}

i noticed last scan that the windows installer was infected and i had to do bootscan, but i noticed at boot that maybe it was unable to do anything. i don’t know if they are related…

please help. i have windows xp pro and avast free

a month or so ago, i had a virus that made winantivirus pro and ebay pages popup. i used some vundo fix program and that stopped. i also ran avast and ad-aware. but immediately after the vundo fix, i got that value in brackets that continues even after avast runs even at boot! How do i get rid of that? do i really still have a virus, or is windows looking for a value that the virus created?

2

Search Google for B54B2B71 and you’ll find two links…
Is this useful?
http://foro.noticias3d.com/vbulletin/showthread.php?t=174073&page=2
Open Applications

{B54B2B71-79A8-4ce8-A319-EC5B45BE42B3}
3DMark06
VB - WatsonController
Watson
XILUX
3

no those links don’t help me. i can’t even translate the one that seems russian. i can translate the spanish one, but i could not find the relevant information.

4

I’m not finding it in the Castle Cops CLSID list.

Does the popup say anything else, or just what you posted?

5

the value is in the blue title bar. the rest is a blank white window. it seems mostly popping up during when the windows install process is running. i think it is a possibility that the value referenced may show up as a different value on different systems.

6

In Control Panel > Administrative Tools > Events
is there any errors related to this?

7

i have the following errors, not sure if it is related:

warnings:

The COM+ Event System failed to create an instance of the subscriber partition:{41E90F3E-56C1-4633-81C3-6E8BAC8BDD70}!new:{D3938AB0-5B9D-11D1-8DD2-00AA004ABD5E}. CoGetObject returned HRESULT 80070422.

The COM+ Event System attempted to fire the EventObjectChange::ChangedSubscription event but received a bad return code. HRESULT was 80040201.

Windows saved user ____ registry while an application or service was still using the registry during log off. The memory used by the user’s registry has not been freed. The registry will be unloaded when it is no longer in use.

This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.

errors:

Content index on d:\system volume information\catalog.wci could not be initialized. Error 3221225478.

The description for Event ID ( 1 ) in Source ( nview_info ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: NVIEW : zlclient: WAIT_TIMEOUT, while waiting for a read to clear - resetting read event

8

Maybe this? Just guessing…
Disable then enable again System restore on Windows XP: http://support.microsoft.com/default.aspx?scid=kb;[LN];310405

9

that isn’t it. system restore is already off. i noticed this thing seems to pop up a lot while firefox is open and i scanned the firefox folder and avast didn’t find any virus there.

10

Could it be a Firefox add-on that isn’t functoning properly?

11

By default, the Catalog.wci directory is created on your Web server during the installation of Microsoft Index Server. You can usually find the catalog directory under the InetPub directory on the drive where you installed IIS.
If you disable the Indexing Service and start it again, will it help?
When you Google for catalog.wci you got plenty of links…