45 replies to this topic

[cklenertz]

Hey Tomk, Happy Thanksgiving. I tried the latest solution. The result: Windows Defender finally started working again. SP3, however, again failed to install catalog files and was not installed. Kevin

[Tomk]

cklenertz,

Happy Thanksgiving to you and yours.

Please download the Win32kDiag.exe tool from the following location and save it to your desktop:

http://download.blee.../Win32kDiag.exe

Once downloaded, double-click on the program and let it finish. When it states Finished! Press any key to exit..., you can press any key on your keyboard to close the program. On your desktop should now be a file called Win32kDiag.txt.

Double-click on this file and post the contents as a reply to this topic.

[cklenertz]

Here you go again. Thanks of course, enjoy your day. Kevin ------------------------------------------------------------------------------------------------------------------------------------------ Running from: C:\Documents and Settings\Kevin Lenertz\My Documents\Downloads\Win32kDiag.exe Log file at : C:\Documents and Settings\Kevin Lenertz\Desktop\Win32kDiag.txt WARNING: Could not get backup privileges! Searching 'C:\WINDOWS'... Found mount point : C:\WINDOWS\$hf_mig$\KB912812\KB912812 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\$hf_mig$\KB912945\KB912945 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\$hf_mig$\KB915865\KB915865 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\$hf_mig$\KB916281\KB916281 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\$hf_mig$\KB918899\KB918899 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\$hf_mig$\KB922760\KB922760 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\$hf_mig$\KB928090\KB928090 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\$hf_mig$\KB943460\KB943460 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\$hf_mig$\KB950749\KB950749 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\$hf_mig$\KB969059\KB969059 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\$hf_mig$\KB971486\KB971486 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\$hf_mig$\KB973525\KB973525 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\$hf_mig$\KB974112\KB974112 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\$hf_mig$\KB974571\KB974571 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\$hf_mig$\KB975025\KB975025 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\$hf_mig$\KB975467\KB975467 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP167.tmp\ZAP167.tmp Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP276.tmp\ZAP276.tmp Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP2AC.tmp\ZAP2AC.tmp Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP4D7.tmp\ZAP4D7.tmp Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP6A9.tmp\ZAP6A9.tmp Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP7B9.tmp\ZAP7B9.tmp Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP7CA.tmp\ZAP7CA.tmp Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAPD7.tmp\ZAPD7.tmp Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\assembly\tmp\tmp Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Config\Config Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Connection Wizard\Connection Wizard Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\CSC\d1\d1 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\CSC\d2\d2 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\CSC\d3\d3 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\CSC\d4\d4 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\CSC\d5\d5 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\CSC\d6\d6 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\CSC\d7\d7 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\CSC\d8\d8 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Downloaded Installations\Downloaded Installations Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\ftpcache\ftpcache Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\History\History Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\ime\imejp\applets\applets Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\ime\imejp98\imejp98 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\InCD\InCD Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\0DC1503A46F231838AD88BCDDC8E8F7C\3.2.30729\3.2.30729 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\62287FAB00234BD4EB33D429A2978904\3.0.6920\3.0.6920 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\983B05722D2A359499AC721C2F8A6EDF\9.2.3042\9.2.3042 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\D7314F9862C648A4DB8BE2A5B47BE100\1.0.0\1.0.0 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\DC3BF90CC0D3D2F398A9A6D1762F70F3\2.2.30729\2.2.30729 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\java\trustlib\trustlib Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\Bind Logs\Bind Logs Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\Temporary ASP.NET Files Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Minidump\Minidump Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\msapps\msinfo\msinfo Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\msdownld.tmp\msdownld.tmp Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\mui\mui Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\PCHEALTH\HELPCTR\BATCH\BATCH Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\PCHEALTH\HELPCTR\Config\CheckPoint\CheckPoint Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\PCHEALTH\HELPCTR\HelpFiles\HelpFiles Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\PCHEALTH\HELPCTR\InstalledSKUs\InstalledSKUs Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\PCHEALTH\HELPCTR\System_OEM\System_OEM Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\PCHEALTH\HELPCTR\Temp\Temp Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Performance\WinSAT\DataStore\DataStore Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\PIF\PIF Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Registration\CRMLog\CRMLog Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\SoftwareDistribution\AuthCabs\Downloaded\Downloaded Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\SoftwareDistribution\Download\394fe6dfc179e51c798ca1a90ca6432e\backup\backup Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\SoftwareDistribution\Download\5cfa09586faf6d9470f0c817d855bb6b\backup\backup Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\backup\backup Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\SoftwareDistribution\Download\9868363812bbe4a0a4d814b7943ba906\backup\backup Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\SoftwareDistribution\Download\b0264899240408ce315fe572c84c0e59\backup\backup Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\SoftwareDistribution\Download\d3767eab8f4479a8d252b47e8ec225c8\backup\backup Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\4e2c4c1796c7661ddc2deb71954958c7\4e2c4c1796c7661ddc2deb71954958c7 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default\Default Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\SQL9_KB948109_ENU\hotfixas\files\files Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\SQL9_KB948109_ENU\hotfixdts\files\files Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\SQL9_KB948109_ENU\hotfixns\files\files Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\SQL9_KB948109_ENU\hotfixrs\files\files Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\SQL9_KB948109_ENU\hotfixsql\files\files Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\SQL9_KB948109_ENU\hotfixtools\files\files Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\SQLTools9_KB948109_ENU\hotfixas\files\files Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\SQLTools9_KB948109_ENU\hotfixdts\files\files Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\SQLTools9_KB948109_ENU\hotfixns\files\files Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\SQLTools9_KB948109_ENU\hotfixrs\files\files Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\SQLTools9_KB948109_ENU\hotfixsql\files\files Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\SQLTools9_KB948109_ENU\hotfixtools\files\files Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Sun\Java\Deployment\Deployment Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\SxsCaPendDel\SxsCaPendDel Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2 Mount point destination : \Device\__max++>\^ Finished!

[Tomk]

cklenertz,

Click on Start->Run, and copy-paste the following command (the bolded text) into the "Open" box, and click OK. When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please open it with notepad and post the contents here.
"%userprofile%\desktop\win32kdiag.exe" -f -r

[cklenertz]

Hey Tomk, What ever the Win32KDiag software did yesterday it helped. It finally downloaded SP3. Here the latest: Running from: C:\Documents and Settings\Kevin Lenertz\desktop\win32kdiag.exe Log file at : C:\Documents and Settings\Kevin Lenertz\Desktop\Win32kDiag.txt Removing all found mount points. Attempting to reset file permissions. WARNING: Could not get backup privileges! Searching 'C:\WINDOWS'... Finished!

[Tomk]

cklenertz, Please run ComboFix again. It will probably ask if you want to update it to the newest version. You do.

[cklenertz]

Here you go Tomk.

[Tomk]

cklenertz, Uhm... I think you forgot something.

[cklenertz]

You're absolutely correct. Unfortunately though it wouldn't let me attach it as a file or paste it because it is too big. I'll put it in three posts. Kevin POST 1

Attached Files

•  11_28_2009_ComboFix_log_1.txt   428.93KB   370 downloads

[cklenertz]

POST 2

Attached Files

•  11_28_2009_ComboFix_log_2.txt   495.38KB   464 downloads

[cklenertz]

POST 3

Attached Files

•  11_28_2009_ComboFix_log_3.txt   361.23KB   441 downloads

[cklenertz]

And now I'm off to work. I"m curious what you see in those Combo Fix logs. Is it explainable?

[Tomk]

cklenertz,

The majority of that log was a list of changed files. It was so big because you just updated your OS with SP3.

Otherwise, Log looks good


Time for some housekeeping

• Click START then RUN
• Now type ComboFix /Uninstall in the runbox and click OK.
• Note the space between the X and the U, it needs to be there.
• 

The above procedure will:

• Implement some cleanup procedures.
• Reset System Restore.

Please re-enable any security that was disabled.

Now to remove most of the tools that we have used in fixing your machine:

• Make sure you have an Internet Connection.
• Download OTC to your desktop and run it
• A list of tool components used in the cleanup of malware will be downloaded.
• If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
• Click Yes to begin the cleanup process and remove these components, including this application.
• You will be asked to reboot the machine to finish the cleanup process. If you are asked to reboot the machine choose Yes.

If any tools are left, go ahead and delete them.


The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein


Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved.

[cklenertz]

Tomk, Thank you sir. I will read the suggested materials and implement the suggestions and precautions I am not currently employing. Thank you for all your help and time. It is much appreciated. Kevin

[Tomk]

cklenertz, You are very welcome. Good Luck and be Well.