Windows Forum

Ask something
Discussion Locked

INFECTED DLL FILE

0 helpful
11 replies

by galehickey2

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I had a wsock32.dll file that was "trojanized".Got a good file and went into safemode and attemted
to delete bad file-no soap-box poped up that windows uses it and could not be deleted. Tried the same thing with copying. Same thing. Was under the impression that windows was not running in safemode. At any
rate I have win98 and if you could me I would apreciate it. I could care less about my situation other than I don't want to send something to someone else that would attach itself and mess their computer up.
THANKS-

11 replies

by russ werner

If your intent is to just replace this file, boot from a Win98 boot disk, then delete it and copy your new file into it's location.
I would seriously be considering a fdisk, format, and reload of my system, but then again, that is just me...
Anyways, hope it helps...

by tbradley

Some trojans will set the file attributes to prevent deletion or copying

as caller 1 above said, boot with a win95 or win98 bootdisk, then change to the c:\windows\command directory and type
"attrib -r -s -h c:\windows\system\*.dll

put thefull path the the dll in question, and the *.dll should be replaced by the full name of the dll.

by barmaley

There is easier way.
Run SFC (System File Checker) utility
Start/Run - type SFC
Choose "Extract one file from installation disk"
type the file name (with extention)
click Start
specify location of installation files and click OK

Hope it helps, it helped me a lot

by dmiles

Locate the ske.exe,ska.dll,and wsock32.dll,rename the wsock32.ska as wsock32.dll,you will have to delete and rename the file in dos mode
there is a utility that you can use located at the following site-http://www.akis.It/martynas/virus/e-mail/happy99/index

by invisibleboss

Several viral attacks may corrupt the files you mentioned ("Trojans" are just a group). As you don't mention the virus name found, I can't give an exact solution, as more than the mentioned file(-s) may be corrupted. "Happy99", though, is the most common to infect this way.

Follow this link at Symantec and find the tool suited for your "removal":
http://www.sarc.com/avcenter/tools.list.html
Read (copy) the instructions before attempting to clean your system.

Once again, this shows how important it is to have a good and updated antivirus program running at all time. An updated program have a database not older than 1-2 weeks!

I'm rather surpriced that most attacs I see, is from "old" well known viruses....

Hoping you get rid of the problem this time.

This discussion is closed to new replies.