v.tew Posted October 2, 2008 ID:29520 Share Posted October 2, 2008 I'm getting this message when trying to reply to this thread:Method Not ImplementedPOST to /forums/index.php not supported. Link to post Share on other sites More sharing options...
v.tew Posted October 2, 2008 Author ID:29521 Share Posted October 2, 2008 Get the same message when trying to preview, save, or send a PM. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 2, 2008 Root Admin ID:29535 Share Posted October 2, 2008 Well doesn't make sense that you can post here but not in other topic.Please delete your cache and cookies from Internet Explorer and try again.Did you run Avenger as asked? Link to post Share on other sites More sharing options...
v.tew Posted October 2, 2008 Author ID:29537 Share Posted October 2, 2008 Well doesn't make sense that you can post here but not in other topic.Please delete your cache and cookies from Internet Explorer and try again.Did you run Avenger as asked?I agree it makes no sense that I can post this topic but not reply to others. I've tried from two machines. I will try deleting cache and reposting to logs.The quick summary: Avenger did not find the file (mrxdavv.sys) and didn't find any root kits. MBAM still identifies the file but cannot delete it. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 2, 2008 Root Admin ID:29540 Share Posted October 2, 2008 Okay thanks. I'm betting that it's not there and that it is a False Positive for MB.When you browse to this folder with Hidden Files turned off do you see it? If you search for it with Explorer do you see it? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 2, 2008 Root Admin ID:29541 Share Posted October 2, 2008 Please post the Avenger log here. Link to post Share on other sites More sharing options...
v.tew Posted October 2, 2008 Author ID:29573 Share Posted October 2, 2008 I'm betting that it's not there and that it is a False Positive for MB.What causes MB to report a file name that doesn't exist? I've search every which way I know how for the file and I can't find it. But if I connect to the net I get reinfected instantly. Actually I didn't this morning when I updated MB, but I was on maybe 15 seconds.Would it help if I connect to the internet, browse the MB site, update MB, etc. and when I get infected send you a log before I have MB delete everything?Please post the Avenger log here.Logfile of The Avenger Version 2.0, © by Swandog46 http://swandog46.geekstogo.comPlatform: Windows XP*******************Script file opened successfully.Script file read successfully.Backups directory opened successfully at C:\Avenger*******************Beginning to process script file:Rootkit scan active.No rootkits found!Error: file "C:\WINDOWS\System32\drivers\mrxdavv.sys" not found!Deletion of file "C:\WINDOWS\System32\drivers\mrxdavv.sys" failed!Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not existCompleted script processing.*******************Finished! Terminate. Link to post Share on other sites More sharing options...
v.tew Posted October 2, 2008 Author ID:29575 Share Posted October 2, 2008 When you browse to this folder with Hidden Files turned off do you see it? If you search for it with Explorer do you see it?I will try these tonight. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 2, 2008 Root Admin ID:29576 Share Posted October 2, 2008 Do you have CD burner on another system where you can download and run a Service Pack update?Normally I wouldn't do an install of anything during a scan and clean process but in your case I think it might help us some.Please download and burn this Service Pack for Windows XP to a CD and take it to the other system and install it.XP Service Pack 3 Link to post Share on other sites More sharing options...
v.tew Posted October 2, 2008 Author ID:29580 Share Posted October 2, 2008 Please download and burn this Service Pack for Windows XP to a CD and take it to the other system and install it.I'll try that tonight.Back on topic: Something in the HJT log is causing my reply problem. I can build up a reply with the Avenger and MB logs and preview it successfully. But when I paste in the HJT log, then I get the error when trying to preview. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 2, 2008 Root Admin ID:29581 Share Posted October 2, 2008 Okay, try zipping and attaching the zip file to the post. (we don't normally like this, but since normal method isn't working for you)Please run new MB Quick Scan - do not skip FIX, meaning make sure you tell MB to fix it. On reboot you can find the log in the LOG tab for posting.Then make sure you reboot, then do a new HJT scan only and post back both logs. Zip and attach if you need to. Link to post Share on other sites More sharing options...
v.tew Posted October 2, 2008 Author ID:29585 Share Posted October 2, 2008 Back on topic: Something in the HJT log is causing my reply problem.Here's the entry causing the 'cannot reply' problem. I inserted the space before etc in the URL to be able to post it:O16 - DPF: {3299935F-2C5A-499A-9908-95CFFF6EF8C1} (Quicksilver Class) - http://scpwlc.ops.placeware.com/ etc/place/LIMA/SCLpws-c2/5.1.7.413/lib/quicksilver.cabTake the space out and I cannot post this message. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 2, 2008 Root Admin ID:29586 Share Posted October 2, 2008 We don't want active LIVE links to potential Malware. If you change the http portion to hxxp is should post.hxxp://scpwlc.ops.placeware.com/place/LIMA/SCLpws-c2/5.1.7.413/lib/quicksilver.cab Link to post Share on other sites More sharing options...
GT500 Posted October 3, 2008 ID:29614 Share Posted October 3, 2008 I'm getting this message when trying to reply to this thread:Method Not ImplementedPOST to /forums/index.php not supported.I was getting that earlier as well. I assume it's OK now. Marcin was away, and not aware of the issues. We'll see if everything is OK now. Link to post Share on other sites More sharing options...
Root Admin RubbeR DuckY Posted October 3, 2008 Root Admin ID:29615 Share Posted October 3, 2008 Looking into it. Link to post Share on other sites More sharing options...
JimW Posted October 3, 2008 ID:29655 Share Posted October 3, 2008 Here's the entry causing the 'cannot reply' problem. I inserted the space before etc in the URL to be able to post it:O16 - DPF: {3299935F-2C5A-499A-9908-95CFFF6EF8C1} (Quicksilver Class) - hxxp://scpwlc.ops.placeware.com/ etc/place/LIMA/SCLpws-c2/5.1.7.413/lib/quicksilver.cabTake the space out and I cannot post this message.Tim, thank you. That was a very subtle problem in our web application level firewall's rules. Because of your careful isolation of the problem, it's now fixed.Jim Link to post Share on other sites More sharing options...
GT500 Posted October 4, 2008 ID:29669 Share Posted October 4, 2008 Tim, thank you. That was a very subtle problem in our web application level firewall's rules. Because of your careful isolation of the problem, it's now fixed.JimYes, many thanks for fixing the problem. Link to post Share on other sites More sharing options...
v.tew Posted October 4, 2008 Author ID:29671 Share Posted October 4, 2008 Tim, thank you.De nada. Link to post Share on other sites More sharing options...
goldhound Posted October 6, 2008 ID:29930 Share Posted October 6, 2008 "Method not implemented" was what i got when i tried to validate my account and sign in. Link to post Share on other sites More sharing options...
JimW Posted October 6, 2008 ID:29939 Share Posted October 6, 2008 Goldhound, your IP address was last blocked on 04/Oct/2008:20:42:35 +0000. I don't see any entries for your IP address after that.Apparently all is well now, because you were able to post successfully. Is all OK now? Jim Link to post Share on other sites More sharing options...
goldhound Posted October 6, 2008 ID:29956 Share Posted October 6, 2008 Goldhound, your IP address was last blocked on 04/Oct/2008:20:42:35 +0000. I don't see any entries for your IP address after that.Apparently all is well now, because you were able to post successfully. Is all OK now? JimYes all is well and thank you, just was an odd situation with that message. I understand member approval by admin as i have done that on my forum, did not express that way and i reckoned you had a temporary problem.Its all good Link to post Share on other sites More sharing options...
JimW Posted October 6, 2008 ID:29962 Share Posted October 6, 2008 There's a particular class of security-related errors that we're using the "501/Method Not Implemented" error for. The message can occur for several conditions, but all are serious security problems - unless, of course, they're false positives, like this one was.Thanks for your patience!Jim Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now