August Windows Update corrupts dlls/netframe?

Hello again!

I am really sorry for the delay in responding. Things got a bit hectic! My sincerest apologies.

Every time I look at this machine, something else needs fixing! lol. I am keeping a good record of what to do, though! Delay fixing SFC corruptions, check out infection first! If corrupt files have been patched as opposed to corrupted, disinfect!

Thanks for the extra CBS.logs. Nice letter to Microsoft! I don't know how many times you can be elevated - there was a time when you (or someone like me, but mainly MVPs) could be put through to the Windows Update product group themselves, and they would regularly help us on a difficult thread like this one. But no more, for they have now severed that connection.

OTL is a safe tool. I tell you that now. If it is indeed infected, then it must have been patched whilst arriving at your computer.

Can you please (if you still have it) upload OTL.exe to Virus Total: VirusTotal - Free Online Virus, Malware and URL Scanner

and paste for me the resulting log file. Also, can you please repeat this process for:

C:\Program Files (x86)\Common Files\System\Ole DB\msdaosp.dll
C:\Windows\SysWOW64\odbcjt32.dll
C:\Windows\SysNative\odbctrac.dll

If they are indeed infected, I will discuss at more length :)

Richard

Sorry this is another long one. We were 22 miles from the epicenter of the earthquake today in Virginia and along with all else I have been dealing with fallen bricks, cracked plaster, dust, and most importantly scared children the night before the first day of school.

So I am throwing it all out in this post, lest I forget something....


First - Sorry about my humor
The letter to MS Support on this forum was just a joke. I actually sent a polite but pointed letter to the department head and asked her if i could be moved over to an expert on repair installs and out of her area, but have not heard back yet. Will post after this is over.

OTL
When OTL was downloaded Kaspersky did say "Do you trust this application" it coupld potentially harm your computer, I put it into low restricted. Of course working with these issues I had UAC off, I know permissions are not as they should be and so it is my fault.

After running OTL the first time, but a bit later that day, Kasperky pops up randomly saying the following program is trying to execute, I terminated. Next boot an hour in, another pop up, different program trying to execute. But both were installers for programs installed already on the PC, so I terminated again and ran Kaspersky, found trojan.Win32.Swisyn.bsgf embedded in OTL.exe. KIS quarantined and deleted. While it was running went and googled, some security gurus say false positive by Kaspersky, but it seemed it was trying to install something on my pc, but KIS did stop and ask me, and since removed, no more popups......yet.

After KIS I immediately ran Malwarebytes full scan and it came up clean, then I ran KIS at the deepest scan and it was clean too. Then rebooted and repeated both.

But OTL is gone except for the logs as best I can tell. I am not logged in as hidden admin but as regular me, I was admiin, but I turned on UAC, rebooted as you must, and a few minutes ago I tried opening UAC through Control Panel and through Start - search UAC and I cannot open to change UAC settings.

I will try to go in as hidden admin and send your requests to Virus Total as soon as possible but want to poke around a bit more before I go in as that userid. It does seem that since Kaspersky removed Win32.Swisyn.bsgf it seems everything is working, well not fine, but the way it was before after the Windows Update fail.

Personal Current Investigations

I just started looking at everything in Kaspersky line by line. The reporting is pathetic in KIS 2011. I notice there is an unknow application that was put into "trusted" by KIS since it was "listed in the Kaspersky database" Why is it unknown if it is in the database? That's where my head was the last few hours and between minor aftershocks I sometimes can think clearly.

Another MS Support email right before the earthquake today from Rakesh

I started to do this, knowing I would stop as soon as anything looked awry, clearly Rakesh's dept head had not spoken to him yet and he does seem to be diiigent in trying to assist even if unable.

When I cleared %temp% there was a Kaspersky file in use. I stopped there, I don't feel like turning KIS off until I feel clean for a little while longer.

AND other than clearing the temp files, all the rest, renaming System Distribution, stopping services, fixits, have all been on prior instructions. My first job when taking over was to read the working papers completely, I imagine these guys are worked to hard to do that level of background learning, but it is the way it SHOULD be, even if it can't be.

Here is the email from MS Support

Thank you for contacting Microsoft Technical Support. This is Rakesh, writing to you in reference to case number SRX1159604917ID.
I was on my weekly off and thought our issue might have been fixed. Windows update issue can be some time be very critical and does not fix, after several tries. I would request you to follow the below steps and let me know the status.
Step 1: Clear Temp Files. To do so,
·Click on Start > All Programs > Accessories > Run
· In the Run windows type Temp and hit Ok.
·Clear or Delete all the files.
Step 2: Clear Temp files from Appdata. To do so.
·Open Run box.
·Type : %temp% and hit Ok.
·Clear all the files. ( Note : some of them cannot be deleted, so its okay).
Step 3: Clear Prefetch files. To do so,
·Click on Start > All Programs > Accessories > Run.
· In the Run windows type: Prefetch and hit ok.
·Clear all the files.
Step 4: We have to rename Software Distribution folder . To do so:
1.Click on Start > All Programs > Accessories > Run
2.In the Run windows type : Services.msc and hit enter.
3.Stop the three services mentioned below: (Double click on the Service name and Click on Stop > Apply > OK)
·Background Intelligence Transfer service.
·Cryptographic service.
·Windows Update service.
4.Minimize the Services window.
5.Rename Software Distribution folder. To do so:
6.Open C drive.
7.Go to Windows folder.
8.Rename SoftwareDistribution folder to SD.old
9.Restart the above 3 services from Services window.

Step 5:
Run the Microsoft Fixit from the following link:
To fix this problem automatically, click the Fix it link given below:

http://go.microsoft.com/?linkid=9748992

Click Run in the File Download dialog box, and then follow the steps in the Fix it wizard.

Restart the computer after running the above link, Restart of the computer : must be done to fix this issue.

Step 6:
Reset Windows Update components. Run this Microsoft fixit from the following link:

http://go.microsoft.com/?linkid=9665683

Note: Click on Run > Run > Select I Agree > Click Next >Select Run Aggressive Options (Not Recommended) > Click Next.
You must choose that Run Aggressive Options for this issue.
After the fix it complete it's process Restart the computer.(Do not skip Restart)
After Restart Check with the issue.
Best Regards
Rakesh

OTL is gone

Scans:

C:\Program Files (x86)\Common Files\System\Ole DB\msdaosp.dll
shows all OK - attached

C:\Windows\SysWOW64\odbcjt32.dll
shows all OK - attached

C:\Windows\SysNative\odbctrac.dll
***Note - if it makes a difference I am in as CRI Office (reg admin) not Hidden Admin***

C:\Windows\SysNative folder does not exist

Search for odbctrac.dll returns 6 results, snip attached
All 4 from winsxs show all OK

Both System32 and SysWow64 versions show 43/44 showing OK
and AVG finding Win32/Heur

Well a quick update. I am about to go from 5.8 earthquake and 4.5 aftershocks to a hurricane. The only thing that's consistent is MS Support.

I ran the instructions above Rakesh sent me (above). After those first three steps (clear temp, %temp%, prefetch) I sent the email to MS support asking about the remaining files but had not gotten a response by earthquake time.

Just now finally got to get back on early this morning and......
On my CRI Office regular admin login everything comes up perfectly, if I ckick on any desktop or taskbar item, again perfect. But left click the start button- Nothing. Right click -fine, but if you do a reset to defaults the start button still does nothing with left click.

So I have to start Task Manager, list all user processes, end explore.exe, then file/run/explore.exe run as admin, and all is perfect once again.

If I go in as hidden admin all works fine. So somehow clearing all those files did something MS Support did not expect.

Richard, take a look at what I clipped above and your thoughts.

Here is where I stand:

• Tired of MS Support.
• Virus Investigation
  
  • Spent all day with Kaspersky making sure that 1 report of Win32/heur was addressed.
  • Only prior anomally, two Kasperksy popups saying something was trying to make a change to an installation exe.
  • With the explore.exe occurance wanted to make sure all was clean.
  • Got to actual security analyst with Kaspersky through helpful moderator on KIS forum.
    
    • Ran KIS in safe mode
    • Ran KIS 2011 Infection tool
    • Downloaded and Ran SuperAntiSpyware in safe mode with options set as analyst wanted
    • Ran Malwarebytes in safe mode
    • Downloaded and Ran Advanced System Care Malware Scanner
    • Sent more logs and zips and updates than you could imagine
    • Turned on stereo, faced northeast, did the Hokey-Pokey
  • Security Analyst says "most likely a false positive by AVG" I say "most likely???" He says, maybe 99 to 99.5%% sure but you "never know, but if it's a new variant you discovered you can pick the four letters as the extension after the dot "
• Whoopie

So please your thoughts, it is probably time to try to go through the repair install process and see if I can get it to complete. Even if we thought we corrected everything it is so convoluted I would always worry. SAd thing, clearing out the temp files did make all of the little glitches I was having go away and the business software, as it has throughout, runs flawlessly.

If you concur, I will start a new thread to try to get as many eyes on my repair install plan and execution. Hopefully you will be there and can watch over me there as well. Also, might you have a suggestion as to the most learned scholar on repair installs that I might implore to review my plan (not yet written), execution and success in the repair?

Please reply as soon as you can but I may be offline if the path on the hurricane does not drastically change. We are not directly in the path, but onthe edge of the path and we are in the lodging business. So all day I have been getting calls from those on the coast being evacuated. Now is my time to serve others. Back soon.

Hello again,

I am really sorry for the delay in this response. A member of family become ill...I will try to return to swift responses from now on! I shall give you a full reply tomorrow, after a good look through all of those logs again. In particular, I intend to fix up those SFC corruptions, and see how things go from there. I wish you, your family and friends, and your property and possessions the very best of luck in the upcoming hurricane.

"...never know, but if it's a new variant you discovered you can pick the four letters as the extension after the dot."

That would be unusual. I don't know Kaspersky's exact rules, but the letters are usually chosen because of some significance they hold to the infected file when analysed. For example, TDSS was chosen because that phrase appeared repeatedly in the analysed file, most easily visible in tdssserv.sys in very old variants, but more importantly in the file itself. Anyway, I am going off topic!

I shall get back to you properly tomorrow, and I must thank you very much for your extended patience.

Richard

Niemero, the lettters comment by Sergey the security analyst was a pure joke. But the repore we struck up and a few key items in your posts have led to some of the most fun I have ever had in IT.

Bottom line, I will still need your help, but what occurred has partially been answered.
Why is still not known.

I have been told that to fix to the point of perfection would be difficult but possible, but to just get to the point a repair install will flow to completion the guys with me now say can be done by someone with solid W7 knowledge

I was on the right track in my first documentation sent to MS Support and I know it was never read even though still first item in the MS Support thread between myself and MS.

You also were on the right track with the attempt to use cacls and reset the permissions.

Right now I have a friend from the US Military National Ground Intelligence Center here in Charlottesville and Sergey the Kaspersky analyst doing a forensic rebuild just for fun to try to find a trail. I will get back to you.

There are key files and folders that windows needs to operate Windows Update that have no owner, no creator, no permissions, nothing. But they are intact and so far none corrupted. Not a virus because they only have been found in files that would be used by WU. But none of us three know W7 or WU. I am mid-range, Sergey lives in the DOS world and my friend is a global threat response guy and he clearly was not hired for Windows knowledge.

Will get back as soon as we are done. 14 hours in and I still am wide awake! It's my youth of jelly beans and coffee all over again.

Hello again!

I shall reply to your backlog of questions and comments soon (or at least the important ones)

Let's first try a permissions reset. Hopefully this will improve things...but I am not sure.

Please download the attached reset.inf to your Desktop, and run this command at an Elevated Command Prompt:

secedit /configure /cfg %UserProfile%\Desktop\reset.inf /db %UserProfile%\Desktop\reset.sdb /verbose

It may take anywhere between 2 seconds - 10 minutes to process (:)) depending on how much needs to be done. You will most likely receive some errors whilst running the command (it will most likely talk of non-existent directories) This is perfectly normal, and will not affect the end result.

Any change??

Richard

Richard, when power is up and stable I will try this. I am afraid to do much tonight because the power has not ever gone out but keeps dimming. I am on the laptop on battery for now.

Just in from Sergey, maybe it will shed some more light. I was also the one executing everything so if his note needs clarification I might be able to help but I could not take notes he moved a thousand miles per hour.

from sergey
to 0BA6-000535-0BFCxxxx

hello, I have finished and this is for you and helper person
IMPORTANT - to person helping user I am wormexpert but I am not expert with new windows but I hope this helps

I see two problem
user cannot read where needs to because c:\ permissions not allow R
some objects permissions owners do not exist. Saying go look and see in user interface under security (and in registry) group or user names nothing, or
on some this is ok but look at advanced and there is no owner.

what I reconstruct and see is during update restart Intel Raid Storage has permissions in temp scheduled for three ms, at ms 2 goes null and root permissions are stuck in bad place. users business application files recovered after update fail seem to have old Vista 64bit OS still somewhere in scripting reference
but proprietary so I not look in more but was in memory at time of recover try

investigate issue at top of list after reassemble data from event logs which is cryptographic service is access denied
Log incomplete because I rebuild from bits but I see many things like this:
User: SYSTEM
Description:
Log Name: Application
Source: Microsoft-Windows-CAPI2
Event ID: 256
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: CrossroadsInn
Description: The Cryptographic Services service failed to initialize the Catalog Database. The error was: 5 (0x5) : Access is denied.
rebuild event log for above -could be not complete either - say
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-CAPI2" Guid="{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}" EventSourceName="Microsoft-Windows-CAPI2" />
<EventID Qualifiers="0">256</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2011-08-29T19:10:55.379208200Z" />
<EventRecordID>356709</EventRecordID>
<Correlation />
<Execution ProcessID="1208" ThreadID="2544" />
<Channel>Application</Channel>
<Computer>CrossroadsInn</Computer>
<Security />
</System>
<EventData>
<Data>5 (0x5)</Data>
<Data>Access is denied.
</Data>
</EventData>
</Event>

So I look more
I see c:\temp\xcacls c:
C:\ NT AUTHORITY\SYSTEMOI)(CI)F
BUILTIN\AdministratorsOI)(CI)F

look at clean machine see
C:\>xcacls c:\
c:\ BUILTIN\Administrators:F
BUILTIN\AdministratorsOI)(CI)(IO)F
NT AUTHORITY\SYSTEM:F
NT AUTHORITY\SYSTEMOI)(CI)(IO)F
BUILTIN\UsersOI)(CI)R
NT AUTHORITY\Authenticated UsersOI)(CI)(IO)C
NT AUTHORITY\Authenticated Usersspecial access:)
FILE_APPEND_DATA

PLEASE SEE AND LOOK AFTER BUILTIN\Users in clean machine has rights to (R)ead
But this user has no right to Read where it is needed so cannot do some big things

I know only what I know and you can know more but this is start.

I would help user add BUILTIN\Users to get read access to C and may all work again or maybe just better
I think tell user after able to Read, no owner still remains
I think this is the good way to fix final or at least fix good
but if not fix good it will fix ok enough to do all repair from 7 dvd
put in win 7 dvd
click on repair
open command prompt window
typing
path %path%; C:\windows\System 32
icacls C:\windows\System32 /t /c /GRANT Everyone:F
(C:\ is being users top drive)

also as test
user never try sticky notes but I see this one no owner
I have him execute and error then have him add owner
retry and works

I have user make change to sticky notes, but not want to do others, for fear I break more
but need get someone knowing 7 to tell if this thing will just fix wrong or also missing. what will happen with missing? if not fixing, can query show all with no owner and no user at all with permission? saying to maybe run query and fix with script or fix by hand few needed then repair fix the rest?

saying if no owner or no user has permission, will this fix? or better if you know then I ask you what will fix?
I am sorry I cannot help you more but good news is no virus or trojan and I enjoy working with you for this time.

Sergey Zeldin

Sorry to copy most of the log in text below, but just in case I click something and all goes dark I wanted it here for you to see. Runtime about one minute.

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\windows\system32>secedit /configure /cfg %UserProfile%\Desktop\reset.inf /db
%UserProfile%\Desktop\reset.sdb /verbose
The data is invalid.
The task has completed with an error.
See log %windir%\security\logs\scesrv.log for detail info.
C:\windows\system32>


-------------------------------------------
Tuesday, August 30, 2011 10:42:11 PM
Error 13: The data is invalid.
Error converting %SCEINFCOMMONPROGRAMFILES%\SPEECHENGINES\MICROSOFT\TTS.
----Configuration engine was initialized successfully.----
----Reading Configuration Template info...

----Configure User Rights...
User Rights configuration was completed successfully.

----Configure Group Membership...
Group Membership configuration was completed successfully.

----Configure 64-bit Registry Keys...
Configure users\.default.
Warning 5: Access is denied.
Error setting security on users\.default\software\KasperskyLab\protected.
Configure machine\software.
Configure machine\software\classes.
Warning 5: Access is denied.
Error setting security on machine\software\classes.

(REM by Elmo about 500 additional Warning 5: Access is denied.)

Error setting security on machine\software\classes.
Warning 5: Access is denied.
Error setting security on machine\software\classes.
Configure machine\software\classes\.hlp.
Warning 5: Access is denied.
Error setting security on machine\software\microsoft.
Configure machine\software\microsoft\drm.
Warning 5: Access is denied.
Error setting security on machine\software\microsoft\windows.
Warning 5: Access is denied.
Error setting security on machine\software\microsoft\windows.
Warning 5: Access is denied.
Error setting security on machine\software\microsoft\windows\currentversion.
Configure machine\system.
Warning 5: Access is denied.
Error setting security on machine\system\currentcontrolset\control.
Warning 5: Access is denied.
Error setting security on machine\system\currentcontrolset\control.
Warning 5: Access is denied.
Error setting security on machine\system\currentcontrolset\control.
Warning 5: Access is denied.
Error setting security on machine\system\currentcontrolset\control.
Warning 5: Access is denied.
Error setting security on machine\system\currentcontrolset\control.
Warning 5: Access is denied.
Error setting security on machine\system\currentcontrolset\control.
Configure machine\system\currentcontrolset\control\class.
Configure machine\system\currentcontrolset\control\keyboard layouts.
Warning 5: Access is denied.
Error setting security on machine\system\currentcontrolset\control\lsa.
Configure machine\system\currentcontrolset\control\lsa\data.
Configure machine\system\currentcontrolset\control\lsa\gbg.
Configure machine\system\currentcontrolset\control\lsa\jd.
Configure machine\system\currentcontrolset\control\lsa\skew1.
Configure machine\system\currentcontrolset\control\nsi.
Configure machine\system\currentcontrolset\control\nsi\{eb004a00-9b1a-11d4-9123-0050047759bc}\4.
Configure machine\system\currentcontrolset\control\nsi\{eb004a01-9b1a-11d4-9123-0050047759bc}\4.
Configure machine\system\currentcontrolset\control\nsi\{eb004a1c-9b1a-11d4-9123-0050047759bc}\0.
Configure machine\system\currentcontrolset\control\wmi\security.
Warning 5: Access is denied.
Error setting security on machine\system\currentcontrolset\services.
Warning 5: Access is denied.
Error setting security on machine\system\currentcontrolset\services.
Warning 5: Access is denied.
Error setting security on machine\system\currentcontrolset\services.
Warning 5: Access is denied.
Error setting security on machine\system\currentcontrolset\services.
Warning 5: Access is denied.
Error setting security on machine\system\currentcontrolset\services.
Warning 5: Access is denied.
Error setting security on machine\system\currentcontrolset\services.
Warning 2: The system cannot find the file specified.
Error enumerating info for machine\system\currentcontrolset\services\appmgmt.
Configure machine\system\currentcontrolset\services\scardsvr\security.
Configure machine\system\currentcontrolset\services\stisvc\security.
Warning 2: The system cannot find the file specified.
Error enumerating info for machine\system\currentcontrolset\services\sysmonlog.
Configuration of Registry Keys was completed successfully.


----Configure 32-bit Registry Keys...
Configure machine\software.
Warning 5: Access is denied.
Error setting security on machine\software.
Configure machine\software\classes.
Warning 5: Access is denied.
Error setting security on machine\software\classes.
Warning 5: Access is denied.
Error setting security on machine\software\classes.
Warning 5: Access is denied.
Error setting security on machine\software\classes.

Error setting security on machine\software\classes.
Warning 5: Access is denied.
Error setting security on machine\software\classes.
Warning 5: Access is denied.
Error setting security on machine\software\classes.
Warning 5: Access is denied.
Error setting security on machine\software\classes.
Warning 5: Access is denied.
Error setting security on machine\software\classes.
Warning 5: Access is denied.
Error setting security on machine\software\classes.
Warning 5: Access is denied.
Error setting security on machine\software\classes.
Warning 5: Access is denied.
Error setting security on machine\software\classes.
Error setting security on machine\software\classes.
Warning 5: Access is denied.
Error setting security on machine\software\classes.
Warning 5: Access is denied.
Error setting security on machine\software\classes.
Configure machine\software\classes\.hlp.
Warning 5: Access is denied.
Error setting security on machine\software\microsoft.
Warning 5: Access is denied.
Error setting security on machine\software\microsoft.
Warning 5: Access is denied.
Error setting security on machine\software\microsoft.
Configure machine\software\microsoft\drm.
Warning 5: Access is denied.
Error setting security on machine\software\microsoft\windows.
Warning 5: Access is denied.
Error setting security on machine\software\microsoft\windows.
Warning 5: Access is denied.
Error setting security on machine\software\microsoft\windows\currentversion.
Warning 5: Access is denied.
Error setting security on machine\software\microsoft\windows\currentversion.
Configuration of Registry Keys was completed successfully.

----Configure File Security...
File Security configuration was completed successfully.

----Configure General Service Settings...
Configure sysmonlog.
Error 1060: The specified service does not exist as an installed service.
Error opening sysmonlog.
Configure SamSs.
Configure ntmssvc.
Error 1060: The specified service does not exist as an installed service.
Error opening ntmssvc.
Configure netddedsdm.
Error 1060: The specified service does not exist as an installed service.
Error opening netddedsdm.
Configure netdde.
Error 1060: The specified service does not exist as an installed service.
Error opening netdde.
Configure dmserver.
Error 1060: The specified service does not exist as an installed service.
Error opening dmserver.
Configure clipsrv.
Error 1060: The specified service does not exist as an installed service.
Error opening clipsrv.
Configure Browser.
General Service configuration was completed successfully.

----Configure available attachment engines...
Configuration of attachment engines was completed successfully.

----Configure Security Policy...
Configure password information.
System Access configuration was completed successfully.
Configuration of Registry Values was completed successfully.
Audit/Log configuration was completed successfully.

----Configure available attachment engines...
Configuration of attachment engines was completed successfully.

----Un-initialize configuration engine...