Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Smitfrad virus has me stumped! Please help! [RESOLVED]


  • This topic is locked This topic is locked

#1
crowfoot

crowfoot

    Member

  • Member
  • PipPip
  • 14 posts
After attempting to resolve this problem through the advise on this wonderful forum, I have been unable to make much headway, and would greatly appreciate your assistance in solving this problem.

I've read your "Before You Post" instructions and tried a few things suggested in the forum but am unable to make much progress so I hope you can help.

I am running Win 98 SE, my browser is IE 5.0 (i'm unable to access anything in the IE format so I'm using Netscape 7.1 presently).

So far I've done the following:

- installed and ran Kapersky AV ver 5.0.372 which cleaned a lot of stuff but not all as I am now receivng a pop-up saying the Lovesan virus from address68.145.227.111 is attacking my computer but has been successfully repelled

- installed the Smitfrad.reg fix which has apparently wiped out my WININET.dll file as I don't think there was a problem there before. (I've done a file search and no WININET files were found and "show all hidden files" has been activated through My Computer). This got rid of the message about the virus on the desktop but the blue screen is still there and none of my icon items work when I click on them ie.) "Explorer has performed an illegal operation... etc."

- enabled all start-up functions and produced a Hijack This log which I will post below

- downloaded and tried to run cleanup.exe, Adaware, Cw shredder, and Spybot but none of them will function because the required WININET.dll "was not found" to run the programs.

In addition, when I first turn on the computer and after the desktop loads I get the following pop-up message: "Cannot find Import, dll maybe missing, corrupt, or wrong SHLWAPI.dll, function 'SHRegGETPath A'" (error 120). A file search shows there are two SHLWAPI.dll file extensions in my directory, so I don't know what's going on here.

To say I'm more than a little bit frustrated with this problem and Internet Explorer would be an understatement! If and when iI get these problems corrected I think I'll switch to the Firefox browser as I understand it is much more secure. Your advise on this would also be appreciated.

So, here is my most recent Hijack This log:

Logfile of HijackThis v1.99.1
Scan saved at 9:11:24 AM, on 6/26/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.00 (5.00.2614.3500)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY ANTI-VIRUS PERSONAL\KAVSVC.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY ANTI-VIRUS PERSONAL\KAV.EXE
C:\WINDOWS\SYSTEM\HOOKDUMP.EXE
C:\PROGRAM FILES\WINDOWS MEDIA COMPONENTS\TOOLS\REXPROXY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\MY DOCUMENTS\HIJACK THIS\HIJACKTHIS.EXE
C:\WINDOWS\NOTEPAD.EXE
C:\PROGRAM FILES\NETSCAPE\NETSCAPE\NETSCP.EXE
C:\WINDOWS\NOTEPAD.EXE
C:\HIJACK THIS\HIJACKTHIS NEW 062505.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = http://
R1 - HKCU\Software\Microsoft\Internet Explorer,www = http://
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://rense.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 213.152.119.34:14524
F1 - win.ini: run=C:\WINDOWS\svcinit.exe C:\WINDOWS\SYSTEM\SERVICES\MSXMIDI.EXE C:\WINDOWS\SYSTEM\SERVICES\MSXMIDI.EXE C:\WINDOWS\SYSTEM\SERVICES\MSXMIDI.EXE C:\WINDOWS\SYSTEM\SERVICES\IR.EXE C:\WINDOWS\SYSTEM\SERVICES\MSXMIDI.EXE
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.../7_1/home.html"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\b0diltfu.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_02.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\b0diltfu.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {7B55BB05-0B4D-44fd-81A6-B136188F5DEB} - (no file)
O2 - BHO: CeresObj Class - {00000049-8F91-4D9C-9573-F016E7626484} - C:\WINDOWS\CERES.DLL (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [RegSvr32] C:\WINDOWS\SYSTEM\msmsgs.exe
O4 - HKLM\..\Run: [AntivirusGold] C:\Program Files\AntivirusGold\AntivirusGold.exe /h
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\Run: [OEMCleanup] C:\WINDOWS\OPTIONS\OEMRESET.EXE
O4 - HKLM\..\Run: [Upgrade Service] C:\WINDOWS\winupd.exe
O4 - HKLM\..\Run: [PCDRealtime] C:\WINDOWS\realtime.exe
O4 - HKLM\..\Run: [cmssSystemProcess] c:\windows\system\cmss.exe
O4 - HKLM\..\Run: [Golum] C:\WINDOWS\SYSTEM\golum\services.exe
O4 - HKLM\..\Run: [xpsystem] C:\WINDOWS\SYSTEM\SERVICES\MSXMIDI.EXE
O4 - HKLM\..\Run: [DKTime] C:\WINDOWS\SYSTEM\dktime.exe
O4 - HKLM\..\Run: [mmeodfd] c:\windows\system\mmeodfd.exe
O4 - HKLM\..\Run: [load32] C:\WINDOWS\SYSTEM\winldra.exe
O4 - HKLM\..\Run: [MSN Messenger] C:\WINDOWS\SYSTEM\msmsgs.exe
O4 - HKLM\..\RunServices: [SchedulingAgent] c:\windows\SYSTEM\mstask.exe
O4 - HKLM\..\RunServices: [kavsvc] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe"
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKCU\..\Run: [xxyy] C:\WINDOWS\SYSTEM\XXYY\CPGKIMGC.EXE
O4 - HKCU\..\Run: [xpsystem] C:\WINDOWS\SYSTEM\SERVICES\MSXMIDI.EXE
O4 - HKCU\..\Run: [DKTime] C:\WINDOWS\SYSTEM\dktime.exe
O4 - HKCU\..\Run: [Apwheel] C:\WINDOWS\SYSTEM\6080.EXE
O4 - HKCU\..\Run: [Intel system tool] C:\WINDOWS\SYSTEM\hookdump.exe
O4 - Global Startup: Windows Media PowerPoint Helper.lnk = C:\Program Files\Windows Media Components\Tools\nsppthlp.exe
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://*.windowsupdate.microsoft.com
O15 - Trusted Zone: http://*.windowsupdate.com
O15 - Trusted Zone: *.searchmeup.cc
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.searchmiracle.com (HKLM)
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.my-internet.info (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: *.searchmeup.cc (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted IP range: 213.159.117.133 (HKLM)
O15 - Trusted IP range: 195.190.118.157 (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone (HKLM)
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akama...meInstaller.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windup...edceabcca450006
O16 - DPF: {0D9590E8-D4E9-4822-954B-784CDAF94F2D} (vdiewer control) - http://www.tunacash....ViewerCab02.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefend...bitdefender.cab
O16 - DPF: {BB86B550-9B1A-4666-824C-E78F0CD0CC4C} (ShortCut Class) - http://yasibozi.com/...keShortCut2.cab
O19 - User stylesheet: C:\WINDOWS\system\vossfu.jfk (file missing)
O20 - Winlogon Notify: style2 - C:\WINDOWS\Q17583396_DISK.DLL (file missing)

Thank-you very much for any assistance you can provide in helping me resolve these problems.
  • 0

Advertisements


#2
Guest_thatman_*

Guest_thatman_*
  • Guest
Hi crowfoot

Please read through the instructions before you start (you may want to print this out).

Download Pocket Killbox and unzip it; save it to your Desktop.

Please RIGHT-CLICK here and go to Save As (in Internet Explorer it's "Save Target As") in order to download Metallica’s reg file. Save it to your desktop.

Please download and install AD-Aware.
Check Here on how setup and use it - please make sure you update it first. Don't run yet.

Please set your system to show all files; please see here if you're unsure how to do this.

Download CWShredder (there is a link in my signature), unzip it, and save it on the Desktop. Please do not run it yet,

Reboot into Safe Mode: please see here if you are not sure how to do this.

Please go offline, close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items:
R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = http://
R1 - HKCU\Software\Microsoft\Internet Explorer,www = http://
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://rense.com/
O2 - BHO: (no name) - {7B55BB05-0B4D-44fd-81A6-B136188F5DEB} - (no file)
O2 - BHO: CeresObj Class - {00000049-8F91-4D9C-9573-F016E7626484} - C:\WINDOWS\CERES.DLL (file missing)
O4 - HKLM\..\Run: [AntivirusGold] C:\Program Files\AntivirusGold\AntivirusGold.exe /h
O4 - HKLM\..\Run: [Upgrade Service] C:\WINDOWS\winupd.exe
O4 - HKLM\..\Run: [cmssSystemProcess] c:\windows\system\cmss.exe
O4 - HKLM\..\Run: [Golum] C:\WINDOWS\SYSTEM\golum\services.exe
O4 - HKLM\..\Run: [xpsystem] C:\WINDOWS\SYSTEM\SERVICES\MSXMIDI.EXE
O4 - HKLM\..\Run: [DKTime] C:\WINDOWS\SYSTEM\dktime.exe
O4 - HKLM\..\Run: [mmeodfd] c:\windows\system\mmeodfd.exe
O4 - HKLM\..\Run: [load32] C:\WINDOWS\SYSTEM\winldra.exe
O4 - HKCU\..\Run: [xxyy] C:\WINDOWS\SYSTEM\XXYY\CPGKIMGC.EXE
O4 - HKCU\..\Run: [xpsystem] C:\WINDOWS\SYSTEM\SERVICES\MSXMIDI.EXE
O4 - HKCU\..\Run: [DKTime] C:\WINDOWS\SYSTEM\dktime.exe
O4 - HKCU\..\Run: [Intel system tool] C:\WINDOWS\SYSTEM\hookdump.exe
O15 - Trusted Zone: *.searchmeup.cc
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.searchmiracle.com (HKLM)
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.my-internet.info (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: *.searchmeup.cc (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted IP range: 213.159.117.133 (HKLM)
O15 - Trusted IP range: 195.190.118.157 (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone (HKLM)
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windup...edceabcca450006
O16 - DPF: {0D9590E8-D4E9-4822-954B-784CDAF94F2D} (vdiewer control) - http://www.tunacash....ViewerCab02.cab
O16 - DPF: {BB86B550-9B1A-4666-824C-E78F0CD0CC4C} (ShortCut Class) - http://yasibozi.com/...keShortCut2.cab
O19 - User stylesheet: C:\WINDOWS\system\vossfu.jfk (file missing)

Click on Fix Checked when finished and exit HijackThis.

Now run Metallica’s reg file

Clean out temporary and TIF files. Go to Start > Run and type in the box: cleanmgr. Let it scan your system for files to remove. Make sure all are checked and then press *ok* to remove:

Run CWShredder to fix your CWS problem.

Run AD-Aware se

Run killbox and click the radio button that says Delete a file on reboot. For each of the files you could not delete, paste them one at a time into the full path of file to delete box and click the red circle with a white cross in it.
The program will ask you if you want to reboot; say No each time until the last one has been pasted in whereupon you should answer Yes.
C:\WINDOWS\SYSTEM\HOOKDUMP.EXE
C:\Program Files\AntivirusGold\AntivirusGold.exe /h
C:\WINDOWS\winupd.exe
c:\windows\system\cmss.exe
C:\WINDOWS\SYSTEM\golum\services.exe
C:\WINDOWS\SYSTEM\SERVICES\MSXMIDI.EXE
C:\WINDOWS\SYSTEM\dktime.exe
c:\windows\system\mmeodfd.exe
C:\WINDOWS\SYSTEM\winldra.exe
C:\WINDOWS\SYSTEM\XXYY\CPGKIMGC.EXE.
Let the system reboot.

Please run the following free, online virus scans.
http://www.pandasoft...n_principal.htm
[b]Please post the logs From Panda, Ewido HJT.log
We will need them to remove previous infections that have left files on your system.

Kc :tazz:
  • 0

#3
crowfoot

crowfoot

    Member

  • Topic Starter
  • Member
  • PipPip
  • 14 posts
Thank-you for your prompt response, thatman!!!

I have tried to the best of my ability to follow your instructions but I'm still having a couple of problems.

I am able to do everything up until the point where you request I run Ad Aware. I cannot open this program and get this when I try: "error starting program
WININET.DLL, was not found."

As well, when I run Killbox I get no option or pop-up box prompting me for a YES or NO response to reboot my computer after entering the files into the file box. "Delete on Reboot" option was selected and there is no "Delete 'the file' on Reboot" option on my program??? I suspect they are one and the same, but when I entered the files indicated I get the following pop-ups ONLY:

A Delete On Reboot pop-up:- File will be Deleted on Next Reboot. I pressed the OK option and another pop-up appears as follows:- Reboot Needed: You will need to Reboot to Complete the Replace. Then no further options appear.

This doesn't make sense to me as we're trying to eliminate these files and NOT replace them??? Am I doing something wrong or could this be associated with the WININET.DLL problem above?

I am attaching a new HiJack This log to show the limited progress I have made:

Logfile of HijackThis v1.99.1
Scan saved at 5:54:00 PM, on 6/26/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.00 (5.00.2614.3500)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY ANTI-VIRUS PERSONAL\KAVSVC.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY ANTI-VIRUS PERSONAL\KAV.EXE
C:\PROGRAM FILES\WINDOWS MEDIA COMPONENTS\TOOLS\REXPROXY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\NETSCAPE\NETSCAPE\NETSCP.EXE
C:\HIJACK THIS\HIJACKTHIS NEW 062505.EXE

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 213.152.119.34:14524
F1 - win.ini: run=C:\WINDOWS\SYSTEM\SERVICES\MSXMIDI.EXE C:\WINDOWS\SYSTEM\SERVICES\MSXMIDI.EXE C:\WINDOWS\SYSTEM\SERVICES\MSXMIDI.EXE C:\WINDOWS\SYSTEM\SERVICES\IR.EXE C:\WINDOWS\SYSTEM\SERVICES\MSXMIDI.EXE
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.../7_1/home.html"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\b0diltfu.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CNETSCAPE%5CNETSCAPE%5Csearchplugins%5CSBWeb_02.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\b0diltfu.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [RegSvr32] C:\WINDOWS\SYSTEM\msmsgs.exe
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\Run: [OEMCleanup] C:\WINDOWS\OPTIONS\OEMRESET.EXE
O4 - HKLM\..\Run: [PCDRealtime] C:\WINDOWS\realtime.exe
O4 - HKLM\..\Run: [MSN Messenger] C:\WINDOWS\SYSTEM\msmsgs.exe
O4 - HKLM\..\RunServices: [SchedulingAgent] c:\windows\SYSTEM\mstask.exe
O4 - HKLM\..\RunServices: [kavsvc] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe"
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKCU\..\Run: [Apwheel] C:\WINDOWS\SYSTEM\6080.EXE
O4 - Global Startup: Windows Media PowerPoint Helper.lnk = C:\Program Files\Windows Media Components\Tools\nsppthlp.exe
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://*.windowsupdate.microsoft.com
O15 - Trusted Zone: http://*.windowsupdate.com
O15 - Trusted Zone: *.searchmiracle.com (HKLM)
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.my-internet.info (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: *.searchmeup.cc (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted IP range: 213.159.117.133 (HKLM)
O15 - Trusted IP range: 195.190.118.157 (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone (HKLM)
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akama...meInstaller.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefend...bitdefender.cab
O20 - Winlogon Notify: style2 - C:\WINDOWS\Q17583396_DISK.DLL (file missing)

Internet Explorer remains unfunctional and I'm still unable to open any files with the Icons on my Desktop.

Hope you have some suggestions as to what I can do to resolve these problems!

Thanks again for your time and effort in this regard!
  • 0

#4
Guest_thatman_*

Guest_thatman_*
  • Guest
Hi crowfoot

Try this reinstall windows over your existing copy that will give us back the missing file's we will then remove the malware

Kc :tazz:
  • 0

#5
crowfoot

crowfoot

    Member

  • Topic Starter
  • Member
  • PipPip
  • 14 posts
Hello thatman,

Unfortunately, the company that built my computer did not include a copy of Windows so I'm kind of stuck.

Sorry to make this problem more complicated than it already is.

I was going download a wininet.dll file from dll-files.com but I'm not sure if it's the right one, or if in doing so, I might create more trouble than I already have.

Any suggestions?

Crowfoot
  • 0

#6
crowfoot

crowfoot

    Member

  • Topic Starter
  • Member
  • PipPip
  • 14 posts
Hello thatman,

Unfortunately, the company that built my computer did not include a copy of Windows so I'm kind of stuck.

Sorry to make this problem more complicated than it already is.

I was going download a wininet.dll file from dll-files.com but I'm not sure if it's the right one, or if in doing so, I might create more trouble than I already have.

Any suggestions?

Crowfoot
  • 0

#7
Guest_thatman_*

Guest_thatman_*
  • Guest
Hi crowfoot

Search your system for wininet.dll you should havesome on the system
Let me know where you find that file.

Kc :tazz:
  • 0

#8
crowfoot

crowfoot

    Member

  • Topic Starter
  • Member
  • PipPip
  • 14 posts
Hello thatman,

Did a file search and no wininet.dll file was found. However, there is a winnet16.dll in the directory but I don't think that's what we want.

Crowfoot.
  • 0

#9
crowfoot

crowfoot

    Member

  • Topic Starter
  • Member
  • PipPip
  • 14 posts
thatman,

I do have a set of Norton 2002 Anti Virus rescue disks that may possibly help but again I'm unsure whether or not they would be of any use.

Also, the search done with win*.dll gives me the following list of .dll files:

Winsock.dll
Winmm.dll
Winnet16.dll
Wintrust.dll
Win32s16.dll
Win87em.dll
Winalign.dll
Winaspi.dll
Winmgmtr.dll
Win32s16.dll

Crowfoot
  • 0

#10
Guest_thatman_*

Guest_thatman_*
  • Guest
Hi crowfoot

The company you got the system from no copy off win 98.

Can you look in C:\windows\options see if you have this folder.

Kc :tazz:
  • 0

Advertisements


#11
crowfoot

crowfoot

    Member

  • Topic Starter
  • Member
  • PipPip
  • 14 posts
Hello thatman,

No, the company is no longer in business.

There is no folder for Win 98, only a ton of Win98 zip files and related zip files of varying size (approx. 100 files).

Crowfoot
  • 0

#12
Guest_thatman_*

Guest_thatman_*
  • Guest
Hi crowfoot

I dont use 98 some of the malware file's I need to delete are now related to your wininet.dll meaning the have replaced the file.

I will need to think over this before we can fix this problem.

Back soon

Kc :tazz:
  • 0

#13
crowfoot

crowfoot

    Member

  • Topic Starter
  • Member
  • PipPip
  • 14 posts
OK

Thx for the effort, thatman!

Crowfoot
  • 0

#14
Guest_thatman_*

Guest_thatman_*
  • Guest
Hi crowfoot

Do you know any one that has the win98 cd

Kc :tazz:
  • 0

#15
crowfoot

crowfoot

    Member

  • Topic Starter
  • Member
  • PipPip
  • 14 posts
Hello thatman,

Unfortunately, I don't!

Almost, thought you forgot about me, lol!!!

I've checked with dll-files.com but the only wininet.dll file they have apparently is for Win32 v.6.00.2600.0000 and I believe I need the Win32, v5.00.2614.3500 Internet Extension for Win98 SE.

There's various Warez sites where serials and cracks can be found for Win98 SE but I don't know if the software is availiable on-line. Nor, do I know if this would be of any help in resolving this problem.

Crowfoot.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP