Recently I upgraded Microsoft/xp to Service Pack 1 plus
some other critical updates. After the SP1 install had
finished a reboot was necessary. When disabling the
network adapter (before reboot), I received a message that
said I could not disable because something? was still
connected. I pulled the network cable and shutdown.
After rebooting and plugging the network cable back in,
the connection was reestablish. However, somehow the ICF
firewall had been deselected and turned off. I disabled
the network adapter, reestablished the ICF firewall,
enabled the network adapter and all seemed fine, but...
Later I notice traffic leaving my system and going to one
specific IP address within my ISP's network. Thankfully,
this traffic was being dropped. Note the following dates
and time:
Nov 1, 22:14 - System Restore shows a checkpoint for xp
SP1.
Nov 1, 23:36 - First occurrence of this outbound traffic.
Since, then I have installed a third-party firewall and
have gathered the following info: The protocol is UDP and
the source & destination ports are the same - either 137
(NETBIOS-NS Browsing request of NetBIOS over TCP/IP) or
138 (NETBIOS-DGM Browsing datagram response of NetBIOS
over TCP/IP). This traffic always occurs immediately
after enabling the network connection to my ISP. It also
occurs periodically while connected. The associated
application program is ntoskrnl.exe. Please advise!
Today while looking at the Event System Log file I came
across a 1 year old Warning: "The protected system file
c:\windows\system32\vbscript.dll could not be verified as
valid because Windows File Protection is terminating. Use
the SFC utility to verify the integrity of the file at a
later time.". So, I ran the SFC utility. This generated
a number of System Information log entries. I have 5
files with bad or no signatures which cannot be restored.
The files in c:\windows\system32\ are:
ctl3d32.dll
mfc42.dll
oembios.bin
oembios.sig
oembios.dat
Any help greatly appreciated.
PS. NAV/2004 scans do not detected any viruses.