catroot may be corrupt

http://forums.spybot.info/showthread.php?t=60634
I have been helped by ken545 at Safernetworking removing malware from my system, in the course of running some scans under kens direction, the failed sigchecks from the Combofix log suggest that the catroot may be corrupt and needs to be fixed.

Hi DU Chris, welcome to WhatTheTech.

Are you having problems doing a Windows Update? If so, read here: You cannot install some updates or programs

Hi Ztruker, I was previously running service pack 3 before my malware problems. Problems with catroot were discovered during the malware resolution when I tried to uninstall SP3 in order to reinstall it in an attempt to fix the catroot problem. However, I could not uninstall SP3 and the computer strangely would not even acknowledge that I had SP3. So, in that sense, I am having a problem with a Windows update, as the issue is preventing me from having a functional SP3. Do you recommend I try the "fix it for me" link offered by Microsoft in this case? Thanks!

What errors do you get when you try to uninstall SP3?

Have you seen this: How to remove Windows XP Service Pack 3 from your computer

Two additional ways to get rid of SP3 if it won't uninstall normally.

Hi Ztruker

Thanks for looking and assisting Chris.

Just wanted to add my two cents…I have been helping Chris over at SaferNetworking and after removing a nasty rootkit he appears to be all clean now.

http://forums.spybot.info/showthread.php?t=60634

Reference Post 3. We have found that when a user runs Combofix and shows just a few sigchecks we usually can fix them, but with the large amount on this log its been suggested that the catroot may be corrupted .



Ken

Ok, I was able to get service pack 3 uninstalled and reinstalled. Is there something I should do to confirm that the issue with the sigchecks was resolved? Thanks.

Chris, Though not specifically addressing your question, logging onto MS Updates to download and install the upwards from 88 additional updates and patches available after SP3, will cause your machine to submit to Windows Genuine Advantage which goes a long way toward confirming that the operating system and service pack are authentic and correctly installed. You'll eventually have to complete that updating to guard against known vulnerability exploits. So might just as well do it now. Best Regards