[Matt_T]

I use AVG Free Edition and lately it's been reported that the following files are "Changed":

user32.dll
shell32.dll
ntoskrnl.dll

all of them in C:\WINDOWS\system32\

Should I be worried? I don't know.

What do I need to do if so?

Many thanks...

Matt

[Advertisements]

Those files are often changed by windows update, so if you ran windows update and then got the message, no, don't worry.

[gerryf]

Those files are often changed by windows update, so if you ran windows update and then got the message, no, don't worry.

[Matt_T]

Thanks for this.

I haven't run Windows Update lately though.

The three files have been coming up as 'changed' for about 7 days now. AVG scans every day.

Six days ago it found and deleted a virus, but the 'changed' thing was happening the day before that virus was found.

Meanwhile, 'shell32.dll' has been coming up on its own as 'changed' for at least a month now.

Are further investigations needed? Or are things still OK d'you think?

Thanks for helping!

Matt

[gerryf]

find the files

right click them, choose properties, choose VERSION tab....

copy the info down and report back

[Matt_T]

Ok here goes.....

user32.dll Ver: 5.1.2600.2622
shell32.dll Ver: 6.0.2900.2620
ntoskrnl.exe Ver: 5.1.2600.2622

[Matt_T]

Ok here goes.....

user32.dll Ver: 5.1.2600.2622
shell32.dll Ver: 6.0.2900.2620
ntoskrnl.exe Ver: 5.1.2600.2622

[gerryf]

they all look good to me...more recent than mine, but I don;t have sp2 on this machine

[Matt_T]

Great. Many thanks.

[Matt_T]

A quick PS (if that's OK).

I've been having no luck eradicating WindUpdates spyware from my PC too.

I've posted info and a HJT log in the Spyware Forum on two occasions but had no replies.

Am I doing anything wrong? I think I've followed all the posting rules.

Just wondered if you had any tips. No worries if not.

Thanks again for all your help

[gerryf]

A polite bump is always acceptable

Also, join Geekstogo and become a spyware fighter! Those folks are overworked....

[Matt_T]

Cheers.

But if the fight against spyware is down to my scarce techie knowledge, we're in trouble for sure(!).

Matt

[StarHawk]

Matt asked above

I use AVG Free Edition and lately it's been reported that the following files are "Changed":

user32.dll
shell32.dll
ntoskrnl.dll

If you know these files are staying unchanged don't worry. This is a minor Bug in AVG which is easily fixed. It is probably caused by an incorrect data file AVG creates and uses, avg7qt.dat. If you find this file and delete it AVG will recreate it the next time you scan your system and these files should quit showing up as "Changed". This file should be located at C:\.

I hope this helps

StarHawk

Edited by StarHawk, 04 May 2005 - 12:23 PM.