system32.exe infected

I

infected

My C:\WINDOWS\system32\System32.exe is infected with
Backdoor.Sdbot. Norton Antivirus 2004 can't repair,
quarantine or delete it. I guess it is bad to remove the
file, even if I could somehow. My idea is to somehow
replace it with the original from the WinXP_Pro_SP1 CD.
But I can't find the original there and even if I do, is
it just to replace it or will I have to boot from the cd?
How to do?
 
R

Rob Schneider

infected said:
My C:\WINDOWS\system32\System32.exe is infected with
Backdoor.Sdbot. Norton Antivirus 2004 can't repair,
quarantine or delete it. I guess it is bad to remove the
file, even if I could somehow. My idea is to somehow
replace it with the original from the WinXP_Pro_SP1 CD.
But I can't find the original there and even if I do, is
it just to replace it or will I have to boot from the cd?
How to do?
Click to expand...

Did you follow the instructions from Norton at
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.sdbot.html
 
I

infected

-----Original Message-----


Did you follow the instructions from Norton at
http://securityresponse.symantec.com/avcenter/venc/data/b ackdoor.sdbot.html

To some extent. I have felt unsecure about deleting my
Click to expand...
only infected file system32.exe as it wasn't in their
list and as I thought it might be a vital system file.
But as I was (some minutes ago) working through Norton's
advice I decided to try this (ending the process
system32.exe and deleting the file) anyway. It seemed to
have worked apart from that when I tried to delete the
file the system told me I couldn't/wasn't allowed to but
the file disappeared anyway (a result of me ending the
system32.exe process just seconds earlier?). Am I clean?
I guess the scan will tell after I've edited the registry.
 
C

CEismon

-----Original Message-----
My C:\WINDOWS\system32\System32.exe is infected with
Backdoor.Sdbot. Norton Antivirus 2004 can't repair,
quarantine or delete it. I guess it is bad to remove the
file, even if I could somehow. My idea is to somehow
replace it with the original from the WinXP_Pro_SP1 CD.
But I can't find the original there and even if I do, is
it just to replace it or will I have to boot from the cd?
How to doComparing files ml1.srt and ML2.SRT
Click to expand...
***** ml1.srt
;---------------------------------------------------------
-------------------
; Build ID: 31NAheRED3
; Created by: Dat Dinh
; Date: Mon Oct 28 17:09:18 2002
BlocksXP\BUDD\Ehelp2003Spring\eHelp_2_5_1095_PRE_EN_US_000
01552_A-01
BlocksXP\BUDD\HPware2003Spring\03Q1_RUBIK_PhoneBook_Patch_
36_ALL_WW_00001526_A-02
***** ML2.SRT
;---------------------------------------------------------
-------------------
; Build ID: 31NAheRED2
; Created by: Dat Dinh
; Date: Tue Oct 22 09:39:45 2002
BlocksXP\BUDD\Ehelp2003Spring\eHelp_2_5_1081_PRE_EN_US_000
01528_A-01
BlocksXP\BUDD\HPware2003Spring\03Q1_RUBIK_PhoneBook_Patch_
36_ALL_WW_00001526_A-02
*****

***** ml1.srt
BlocksXP\BUDD\HPware2003Spring\Welcome_MSG_PRE_EN_US_00001
443_C-01
BlocksXP\BUDD\HPware2003Spring\Winbom_MFU_HPWare_ALL_WW_00
000000_A-02
BlocksXP\BUDD\HPware2003Spring\Winbom_MFU_HPWare_PRE_EN_US
_00000000_A-02
BlocksXP\BUDD\PC_Doctor2003Spring\PC_Doctor_ALL_EN_0000141
2_D-01
BlocksXP\BUDD\PC_Doctor2003Spring\pcdoctor_patch_ALL_EN_00
001549_A-01
BlocksXP\BUDD\pre_buDD\Color_Management_PRE_WW_XP_227543_B
2B-01
***** ML2.SRT
BlocksXP\BUDD\HPware2003Spring\Welcome_MSG_PRE_EN_US_00001
443_C-01
BlocksXP\BUDD\HPware2003Spring\Winbom_MFU_HPWare_ALL_WW_00
000000_A-01
BlocksXP\BUDD\PC_Doctor2003Spring\PC_Doctor_ALL_EN_0000141
2_D-01
BlocksXP\BUDD\pre_buDD\Color_Management_PRE_WW_XP_227543_B
2B-01
*****

***** ml1.srt
BlocksXP\Build\beginbuild\beginbuild_WW_XP_0000-01
BlocksXP\Build\CheckConfig\CheckConfig_ALL_WW_00000000_A-
02
BlocksXP\build\endbuild\HP_EndBuild_ALL_WW_00000000_A-07
***** ML2.SRT
BlocksXP\Build\beginbuild\beginbuild_WW_XP_0000-01
BlocksXP\Build\CheckConfig\CheckConfig_ALL_WW_00000000_A-
01
BlocksXP\build\endbuild\HP_EndBuild_ALL_WW_00000000_A-07
*****

***** ml1.srt
BlocksXP\Build\FullScreen\FullScreen_ALL_WW_0000-14
BlocksXP\Build\Latte\Latte_ALL_WW_00000000_A-02
BlocksXP\Build\misc\AppSwitch0ff_ALL_WW_00000000_A-03
***** ML2.SRT
BlocksXP\Build\FullScreen\FullScreen_ALL_WW_0000-14
BlocksXP\Build\misc\AppSwitch0ff_ALL_WW_00000000_A-03
*****

***** ml1.srt
BlocksXP\Build\misc\BrandWarning_ALL_WW_XP_00000000_A-02
BlocksXP\Build\misc\FeatureBitWarning_ALL_WW_XP_00000000_A
-01
BlocksXP\Build\misc\Shutdown_and_backup-03
***** ML2.SRT
BlocksXP\Build\misc\BrandWarning_ALL_WW_XP_00000000_A-02
BlocksXP\Build\misc\Shutdown_and_backup-03
*****

***** ml1.srt
BlocksXP\Build\Motherboards\Spring03_all_boards_ALL_EN_000
00000_A-02
BlocksXP\Build\patch_sp1_upgrade\WinXP_SP1_Upgrade_Patch_A
LL_WW_00000000_A-01
BlocksXP\Build\patchusbs3\patchusbs3_0000-02
***** ML2.SRT
BlocksXP\Build\Motherboards\Spring03_all_boards_ALL_EN_000
00000_A-02
BlocksXP\Build\patchusbs3\patchusbs3_0000-02
*****

***** ml1.srt
BlocksXP\Build\Scandta\Scandta_ww_XP_0000-07
BlocksXP\Build\SetRes\SetResWPIcons_WW_XP_0000-07
BlocksXP\Build\ShutDown_and_Detect\before_shutdown_detect_
and_remove_ALL_WW_00000000_A-02
***** ML2.SRT
BlocksXP\Build\Scandta\Scandta_ww_XP_0000-07
BlocksXP\Build\SetRes\SetResWPIcons_WW_XP_0000-06
BlocksXP\Build\ShutDown_and_Detect\before_shutdown_detect_
and_remove_ALL_WW_00000000_A-02
*****

***** ml1.srt
BlocksXP\CUE\DJprinter\DJPrinter_ALL_WW_00001223_B-01
BlocksXP\Drivers\DMA\DMAOn_WW_XP_0000-04
***** ML2.SRT
BlocksXP\CUE\DJprinter\DJPrinter_ALL_WW_00001223_B-01
BlocksXP\CUE\Patch\CUEpatch927_ALL_WW_00001219_C-01
BlocksXP\Drivers\DMA\DMAOn_WW_XP_0000-04
*****

***** ml1.srt
BlocksXP\Drivers2003
\Audio\creative\Creative_254_ALL_WW_XP_00001295_B-02
BlocksXP\Drivers2003
\Audio\Realtek\Realtek_5_10_4020_ALL_WW_XP_00001291_C-02
BlocksXP\Drivers2003
\IndeoCodec\Indeo_Codec_PRE_EN_00000000_A-04
BlocksXP\Drivers2003
\Keyboard\Kbupdate_SP03_ALL_WW_XP_00000215_L-02
BlocksXP\Drivers2003
\Misc\845_chipset\845_chipset_4_04_1005_ALL_WW_SP1_0000115
0_A-09
***** ML2.SRT
BlocksXP\Drivers2003
\Audio\creative\Creative_254_ALL_WW_XP_00001295_B-02
BlocksXP\Drivers2003
\Audio\Realtek\Realtek_5_10_4020_ALL_WW_XP_00001291_C-01
BlocksXP\Drivers2003
\IndeoCodec\Indeo_Codec_PRE_EN_00000000_A-03
BlocksXP\Drivers2003
\Keyboard\Kbupdate_SP03_ALL_WW_XP_00000215_J-02
BlocksXP\Drivers2003
\Misc\845_chipset\845_chipset_4_04_1005_ALL_WW_SP1_0000115
0_A-09
*****

***** ml1.srt
BlocksXP\Drivers2003
\Video\ATI\Video_ATI_7_76_2_1_ALL_WW_XP_00001516_A-01
BlocksXP\Drivers2003
\Video\nVidia\Video_nVidia_31_90_ALL_WW_XP_00001504_C-01
BlocksXP\Drivers2003
\Video\S3_VIA\Video_S3_VIA_V_13_93_58_ALL_WW_XP_00001459_A
-02
***** ML2.SRT
BlocksXP\Drivers2003
\Video\ATI\Video_ATI_7_76_2_1_ALL_WW_XP_00001516_A-01
BlocksXP\Drivers2003
\Video\nVidia\Video_nVidia_31_90_ALL_WW_XP_00001504_B-01
BlocksXP\Drivers2003
\Video\S3_VIA\Video_S3_VIA_V_13_93_58_ALL_WW_XP_00001459_A
-02
*****

***** ml1.srt
BlocksXP\Drivers2003
\Video\SiS\Video_SiS651_6_13_10_2092_ALL_WW_XP_00001308_A-
07
BlocksXP\DVDCDRW\RecordNow\RECORDNOW_PATCH_ALL_WW_00000000
_A-01
BlocksXP\DvdCdrw\RecordNow\Veritas_RecordNow_4_5_ALL_EN_00
001093_F-02
BlocksXP\Education\Encarta\EncartaOnline_US_PRE_XP_00000_A
-03
***** ML2.SRT
BlocksXP\Drivers2003
\Video\SiS\Video_SiS651_6_13_10_2092_ALL_WW_XP_00001308_A-
07
BlocksXP\dvdcdrw\recordnow\Veritas_RecordNow_4_5_ALL_EN_00
001093_E-01
BlocksXP\Education\Encarta\EncartaOnline_US_PRE_XP_00000_A
-03
*****

***** ml1.srt
BlocksXP\Entertainment\Icons\DTIcons_Disney_03Q1_PRE_EN_US
_00001259_C-01
BlocksXP\Entertainment\MyDVD\Sonic_MyDvd_4_0_2_ALL_WW_0000
0987_M-01
BlocksXP\Entertainment\RealPlayer\Real_Player_6_0_11_780D_
PRE_EN_US_00001248_C-01
***** ML2.SRT
BlocksXP\Entertainment\Icons\DTIcons_Disney_03Q1_PRE_EN_US
_00001259_C-01
BlocksXP\entertainment\mydvd\Sonic_MyDvd_4_0_2_ALL_WW_0000
0987_J-02
BlocksXP\Entertainment\RealPlayer\Real_Player_6_0_11_780D_
PRE_EN_US_00001248_C-01
*****

***** ml1.srt
BlocksXP\entertainment\showbiz\ArcSoft_ShowBiz_1_3_RC5_ALL
_WW_00000211_S-01
BlocksXP\Entertainment\WeatherBug\Weatherbug_20879_4_0_ALL
_EN_US_XP_00001213_B-01
BlocksXP\Entertainment\Wildtangent\WildTangent_HPCMPQ0106_
PRE_EN_00001273_B-02
***** ML2.SRT
BlocksXP\entertainment\showbiz\ArcSoft_ShowBiz_1_3_RC5_ALL
_WW_00000211_S-01
BlocksXP\Entertainment\WeatherBug\Weatherbug_20879_4_0_ALL
_EN_US_XP_00001213_A-02
BlocksXP\Entertainment\Wildtangent\WildTangent_HPCMPQ0106_
PRE_EN_00001273_B-02
*****

***** ml1.srt
BlocksXP\Entertainment\WinDvd\WinDvd4_Audio6_Patch_6_1_ALL
_WW_00001194_D-01
BlocksXP\Microsoft2\ATI_QFE_330638_ALL_WW_00001544_A-01
BlocksXP\Microsoft2\OCA_MRK_ALL_WW_XP_00001419_A-01
***** ML2.SRT
BlocksXP\Entertainment\WinDvd\WinDvd4_Audio6_Patch_6_1_ALL
_WW_00001194_D-01
BlocksXP\Microsoft2\OCA_MRK_ALL_WW_XP_00001419_A-01
*****

***** ml1.srt
BlocksXP\Online2003Spring\EN_US\AOL_DTIcon_PRE_EN_US_00001
300_A-01
BlocksXP\Online2003Spring\EN_US\AOL_Fix_031Q_PRE_EN_US_000
01294_B-02
BlocksXP\Online2003Spring\EN_US\AOLCOMUSERVEFIX_PRE_EN_US_
00001537_A-03
BlocksXP\Online2003Spring\EN_US\BB_ISP_Demo_08_29_02_PRE_E
N_US_00001227_A-01
***** ML2.SRT
BlocksXP\Online2003Spring\EN_US\AOL_DTIcon_PRE_EN_US_00001
300_A-01
BlocksXP\Online2003Spring\EN_US\AOL_Fix_031Q_PRE_EN_US_000
01294_B-01
BlocksXP\Online2003Spring\EN_US\AOLCOMUSERVEFIX_PRE_EN_US_
00001537_A-02
BlocksXP\Online2003Spring\EN_US\BB_ISP_Demo_08_29_02_PRE_E
N_US_00001227_A-01
*****

***** ml1.srt
BlocksXP\Online2003Spring\EN_US\Compuserve_preload_PRE_EN_
US_00001313_A-01
BlocksXP\Online2003Spring\EN_US\Netscape_7_0_PRE_EN_US_000
01376_A-02
BlocksXP\Online2003Spring\EN_US\Yahoo_DTIcon_PRE_EN_US_000
01301_A-01
***** ML2.SRT
BlocksXP\Online2003Spring\EN_US\Compuserve_preload_PRE_EN_
US_00001313_A-01
BlocksXP\Online2003Spring\EN_US\Netscape_7_0_PRE_EN_US_000
01376_A-01
BlocksXP\Online2003Spring\EN_US\Yahoo_DTIcon_PRE_EN_US_000
01301_A-01
*****

***** ml1.srt
BlocksXP\Productivity\Acrobat\Acrobat_5_0_ALL_EN_3221-10
BlocksXP\Productivity\Money\MS_Money_2002_EN_XP_3561-06
BlocksXP\Productivity\Quicken\Quicken_NUE_2003_ALL_EN_US_0
0001292_B-03
BlocksXP\Productivity\Quicken\QUICKEN_PATCH_ALL_EN_US_0000
1292_B-02
BlocksXP\Productivity\Works\MS_Works_7_0_ALL_EN_US_0000148
5_A-03
BlocksXP\Support\FrameNetwork\FrameNetwork_ALL_EN_US_SP1_0
0001302_A-01
***** ML2.SRT
BlocksXP\Productivity\Acrobat\Acrobat_5_0_ALL_EN_3221-10
BlocksXP\Productivity\Money\MS_Money_2002_EN_XP_3561-03
BlocksXP\Productivity\Quicken\Quicken_NUE_2003_ALL_EN_US_0
0001292_B-01
BlocksXP\Productivity\Quicken\QUICKEN_PATCH_ALL_EN_US_0000
1292_B-02
BlocksXP\Productivity\Works\MS_Works_7_0_ALL_EN_US_0000148
5_A-01
BlocksXP\Support\FrameNetwork\FrameNetwork_ALL_EN_US_SP1_0
0001302_A-01
*****

***** ml1.srt
BlocksXP\Support\HP_Odometer\HP_Odometer_1_7_XP_1246-01
BlocksXP\Support\HPSysInfo\HPSysInfo_ALL_WW_00000741_F-09
BlocksXP\Support\MenuShowDelay\Menu_Show_Delay_ALL_WW_XP_0
000-01
BlocksXP\Support\Norton\Preload_NortonAV2003_ALL_EN_000012
10_A-02
BlocksXP\Support\OPK_SUPPORT\SUPPORT_ALL_EN_SP1_00001302_A
-01
BlocksXP\Support\RecoverySuite\RecoverySuite_ALL_WW_000014
51_A-09
BlocksXP\Support\VALUEADD\VALUEADD_ALL_EN_SP1_00001302_A-
01
***** ML2.SRT
BlocksXP\Support\HP_Odometer\HP_Odometer_1_7_XP_1246-01
BlocksXP\Support\HPSysInfo\HPSysInfo_ALL_WW_00000741_F-08
BlocksXP\Support\MenuShowDelay\Menu_Show_Delay_ALL_WW_XP_0
000-01
BlocksXP\Support\Norton\Preload_NortonAV2003_ALL_EN_000012
10_A-01
BlocksXP\Support\OPK_SUPPORT\SUPPORT_ALL_EN_SP1_00001302_A
-01
BlocksXP\Support\RecoverySuite\RecoverySuite_ALL_WW_000014
51_A-06
BlocksXP\Support\VALUEADD\VALUEADD_ALL_EN_SP1_00001302_A-
01
*****
Seems I have ths System32.exe infection help??
?
 
D

Doug Knox MS-MVP

Yes, System32.exe was the virus, it was not a valid Windows File. In
addition to the Symantec instructions, see www.dougknox.com, Win XP Fixes,
Clean KWBot.Worm Registry Entries for a small tool that automates the
Registry cleaning process.

--
Doug Knox, MS-MVP Windows XP/ Windows Smart Display
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
 
S

Skorpion(CET)

My C:\WINDOWS\system32\System32.exe is infected with
Backdoor.Sdbot. Norton Antivirus 2004 can't repair,
quarantine or delete it. I guess it is bad to remove the
file, even if I could somehow. My idea is to somehow
replace it with the original from the WinXP_Pro_SP1 CD.
But I can't find the original there and even if I do, is
it just to replace it or will I have to boot from the cd?
How to do?
Click to expand...

Check the following link:
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.sysxxx.htm
l
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

Backdoor.sdbot 1
TROJAN HORSE VIRUS INFECTED .EXE FILE 2
Trojan.Proscks, I can't clean, quarantine, or delete 4
STDE9.exe missing 1
Backdoor.SDBot.Gen virus - suggestions please 1
what is C:\WINDOWS\system32\rundll32.exe? 1
Rogue virus again? 3
Unfixable Virus?!! 4

Top