I've been struggling with an apparent rootkit infection on a machine that NIS 2009 can't remove.
The initial symptoms started with an infection involving randomly named windows\system32 dll's with the prefix Uac*.dll and Norton warnings about an unresolved security threat. It only identified it as a generic trojan.
Currently the Norton Product Tamper Protection setting is turned off (not by me!) and Norton won't turn it back on. The application hangs if I try.
The Quick Scan works (and finds nothing) but the Full scan stops after what appears to be a Quick Scan.
I get a Norton popup that SONAR can't be loaded. Also upon login, Norton pops up with what appears to be an attempt to fix itself by reloading files online, but is unable to do so.
Also Windows XP has invoked Data Execution Prevention to close the Windows Logon UI.
Based on the procedures I see in other threads here, I've run scans by Malwarebytes (which removed what appears to be an unrelated issue), and SysProt, and a GMER rootkit scan. I've attached logs from the later two. There currently are dll's that reappear in system32 with the prefix vsfoce*.dll, and the log shows several randomly named .sys files in the system32\drivers folder. These are not visible in the file system, not even in Recovery Console mode.
The environment is Windows XP Multimedia edition and NIS 2009.
Any advice you can provide would be appreciated.
- Jim