Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Weird Shortcut in C: (snqn) and suspected Ramnit?


  • Please log in to reply

#91
RKinner

RKinner

    Malware Expert

  • Expert
  • 24,625 posts
  • MVP
Can you get the other copy?

C:\Windows\winsxs\amd64_microsoft-windows-time-service_31bf3856ad364e35_6.1.7600.16385_none_e49c555686fbabd6\w32time.dll

Might have to change owner to get it.
  • 0

Advertisements


#92
roadran

roadran

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 142 posts
Yes I did, but alast, nothing.
  • 0

#93
RKinner

RKinner

    Malware Expert

  • Expert
  • 24,625 posts
  • MVP
Right click on Computer and select Manage then Services and Applications and then Services. Find Windows Time if it is there. Right click on it and select Properties then:

Is there a Display Name? Should say:

Windows Time

Is there a description? It should say:

Maintains date and time synchronization on all clients and servers in the network. If this service is stopped, date and time synchronization will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.


Path to Executable:

C:\Windows\system32\svchost.exe -k LocalService

Service Status:

Started

On the Logon page:

Check: This Account

It should say Local Service. Even if it does, Change it to:

NT AUTHORITY\LocalService

Delete the two password entries

Then Apply. (It should change back to Local Service and readd the passwords.) It should tell you it will take effect after you restart the service.

Go back to the General page and Stop the service then Start the service.

Report any errors you get.
  • 0

#94
roadran

roadran

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 142 posts
No errors other than the usual "Settings can't be saved" Do you want me to run SFC to check the files?
  • 0

#95
RKinner

RKinner

    Malware Expert

  • Expert
  • 24,625 posts
  • MVP
When exactly do you get the Savings can't be Saved? Was then when you were in the Services Menu or when you tried to set the time?

You can run SFC anytime.
  • 0

#96
roadran

roadran

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 142 posts
When i try to sync.
  • 0

#97
RKinner

RKinner

    Malware Expert

  • Expert
  • 24,625 posts
  • MVP
Try Process Monitor again. This time before you save it, set a filter :

Filter, Filter, change Architecture to Path. Change Is to Contains. Type in Time in the next box. Include stays the same. Hit Add then Apply and OK.

That should just leave the critical lines in the file and make it easier to read. Then Save, click Events displayed..

CSV, OK
  • 0

#98
roadran

roadran

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 142 posts
Ok, here it is.

Attached Files

  • Attached File  LOG.zip   28.31KB   140 downloads

  • 0

#99
roadran

roadran

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 142 posts
SFC Check found corrupt files... Here is the log.

Attached Files

  • Attached File  CBS.log   1023.8KB   117 downloads

  • 0

#100
RKinner

RKinner

    Malware Expert

  • Expert
  • 24,625 posts
  • MVP
SFC said it repaired our friend w32time.dll:
2012-03-16 21:19:40, Info CSI 000002ef [SR] Repairing 1 components
2012-03-16 21:19:40, Info CSI 000002f0 [SR] Beginning Verify and Repair transaction
2012-03-16 21:19:40, Info CSI 000002f1 [SR] Cannot repair member file [l:22{11}]"w32time.dll" of Microsoft-Windows-Time-Service, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2012-03-16 21:19:40, Info CSI 000002f2 [SR] Repaired file \SystemRoot\WinSxS\Manifests\\[l:22{11}]"w32time.dll" by copying from backup
2012-03-16 21:19:40, Info CSI 000002f3 Repair results created:
POQ 124 starts:
0: Create File: File = [l:242{121}]"\SystemRoot\WinSxS\amd64_microsoft-windows-time-service_31bf3856ad364e35_6.1.7600.16385_none_e49c555686fbabd6\w32time.dll", Attributes = 00000080
1: Move File: Source = [l:166{83}]"\SystemRoot\WinSxS\Temp\PendingRenames\080ea306dc03cd0118370000ec0bf00f.w32time.dll", Destination = [l:242{121}]"\SystemRoot\WinSxS\amd64_microsoft-windows-time-service_31bf3856ad364e35_6.1.7600.16385_none_e49c555686fbabd6\w32time.dll"



Don't suppose it made any difference.

Odd thing I see in your ProcessMon log is that it look in Syswow64 and in System (not System32) before finding it in Windows.

Mine just looks in System32. I will try to get my friend with a 64 bit system to do the same thing and send me the log.
The other thing I see is what looks like a write to the CMOS to set the time there. That may be where it is failing since the writes to the registry all look good.

Can you boot into the BIOS setup and set the time manually? Does it take?
  • 0

Advertisements


#101
roadran

roadran

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 142 posts
Yes, I can change it in the BIOS manually.
  • 0

#102
RKinner

RKinner

    Malware Expert

  • Expert
  • 24,625 posts
  • MVP
I assume this is the Sony Vgn-nw265f we are working on. Go to

http://esupport.sony...=3#/downloadTab

Under Motherboard should be two entries.

Intel® 5 Series 6 Port SATA AHCI Controller / ICH9M-E/M SATA AHCI Controller Driver Update

and

Intel® Chipset Driver

See if you can download, save and install (right click and run as admin) either or both of them.


Ron

PS. We are going on a trip tomorrow. Won't get back until Friday. Will take my computer but don't know if I will have web access or not so replies may be slow.
  • 0

#103
roadran

roadran

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 142 posts
Have fun on your vacation1 :)

I installed them... No affect what so ever.
  • 0

#104
RKinner

RKinner

    Malware Expert

  • Expert
  • 24,625 posts
  • MVP
Go in to regedit to

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W32Time

and anywhere you see

@%SystemRoot%\system32\w32time.dll

change it to

@%SystemRoot%\w32time.dll (if there is more info on the line that should stay the same)

Also check HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W32Time\TimeProviders\NtpClient
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP