Skip to main content
Start a Conversation

Unsolved

This post is more than 5 years old

rjp46e

9 Posts

10107

December 20th, 2003 22:00

Win98se file kernel32.dll has a virus-- how do I replace file with a good one?

I have a desktop with win 98se. I have purged w32.weird virus from over 2,000 files. There is one more virus with the name "backdoor.netdevil in the file "kernel32.dll" in the windows system folder next to the real kernel32.dll file. The difference is the file size and the icon of the copycat file. I have copied the same file from an uninfected win98se system and would like to remove both the good and bad file and replace them with the uninfected file. Can I accoplish this from the C prompt or should I use a system disk to do it through dos? Does anyone have experience in this matter?

Ron Pease.

irelynnmisses

53 Posts

December 20th, 2003 22:00

You can get AVG from here...

http://www.grisoft.com/us/us_dwnl_free.php

Your best bet would be to try an anti-virus program rto remove this.  While your at it DL HIJACKTHIS from here ... 

http://www.merijn.org/files/HijackThis.exe

 

When DLed  you can Click on SCAN then click SAVE then copy and paste your log here so we can take a look at it.  sometives certain problems can be diagnosed and/or fixed thrue HIJACKTHIS.  Or we can instruct you on how to fix the problem manually.

 

misses

rjp46

19 Posts

December 21st, 2003 00:00

Sorry I forgot to add the file in the last reply.

Logfile of HijackThis v1.97.7

Scan saved at 9:25:26 PM, on 12/20/03

Platform: Windows 98 SE (Win9x 4.10.2222A)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL

C:\WINDOWS\SYSTEM\MSGSRV32.EXE

C:\WINDOWS\SYSTEM\MPREXE.EXE

C:\WINDOWS\SYSTEM\mmtask.tsk

C:\WINDOWS\SYSTEM\SA3DSRV.EXE

C:\WINDOWS\SYSTEM\MSTASK.EXE

C:\PROGRAM FILES\COMMON FILES\EPSON\EBAPI\SAGENT2.EXE

C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE

C:\WINDOWS\SYSTEM\DDHELP.EXE

C:\WINDOWS\EXPLORER.EXE

C:\WINDOWS\SYSTEM\RNAAPP.EXE

C:\WINDOWS\SYSTEM\TAPISRV.EXE

C:\WINDOWS\TASKMON.EXE

C:\WINDOWS\SYSTEM\SYSTRAY.EXE

C:\MOUSE\SYSTEM\EM_EXEC.EXE

C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\CPQEADM.EXE

C:\COMPAQ\INTERNET\CISRVR.EXE

C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\VSSTAT.EXE

C:\WINDOWS\SYSTEM\CIJ3P2PS.EXE

C:\PROGRAM FILES\VERIZON ONLINE\DIAL 4.0\VISUALIPINSIGHT\IPCLIENT.EXE

C:\WINDOWS\SYSTEM\SPOOL32.EXE

C:\PROGRAM FILES\VERIZON ONLINE\DIAL 4.0\VISUALIPINSIGHT\IPMON32.EXE

C:\WINDOWS\SYSTEM\KERNEL32.DLI

C:\WINDOWS\SYSTEM\E_S0EIC1.EXE

C:\WINDOWS\SYSTEM\DEVLDR32.EXE

C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\BTTNSERV.EXE

C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE

C:\PROGRAM FILES\NORTON UNINSTALL DELUXE\SYMMON.EXE

C:\WINDOWS\SYSTEM\WMIEXE.EXE

C:\PROGRAM FILES\COMPAQ\ON-SCREEN DISPLAY\OSD.EXE

C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.presario.net/scripts/redirectors/presario/srchredir.dll?c=2c99&lc=0409&s=search&i=enu

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.presario.net/scripts/redirectors/presario/srchredir.dll?c=2c99&lc=0409&s=search&i=enu

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.presario.net/scripts/redirectors/presario/srchredir.dll?c=2c99&lc=0409&s=search&i=enu

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://desktop.presario.net/scripts/redirectors/presario/deskredir.dll?c=2c99&lc=0409&s=consumer&i=enu

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.presario.net/scripts/redirectors/presario/srchredir.dll?c=2c99&s=search&query=%s&i=enu

O1 - Hosts: 217.116.231.7 aimtoday.aol.com

O1 - Hosts: 217.116.231.7 aimtoday.aol.com

O1 - Hosts: 217.116.231.7 aimtoday.aol.com

O1 - Hosts: 217.116.231.7 aimtoday.aol.com

O1 - Hosts: 217.116.231.7 aimtoday.aol.com

O1 - Hosts: 217.116.231.7 aimtoday.aol.com

O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\PROGRAM FILES\MYWAY\MYBAR\1.BIN\MYBAR.DLL

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX

O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\PROGRAM FILES\MYWAY\MYBAR\1.BIN\MYBAR.DLL

O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun

O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe

O4 - HKLM\..\Run: [SystemTray] SysTray.Exe

O4 - HKLM\..\Run: [EM_EXEC] c:\mouse\system\em_exec.exe

O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe

O4 - HKLM\..\Run: [EACLEAN] C:\Program Files\Compaq\Easy Access Button Support\eaclean.exe

O4 - HKLM\..\Run: [Aureal A3D Interactive Audio Init] A3dInit.exe

O4 - HKLM\..\Run: [Compaq Internet Setup] C:\Compaq\Internet\InetWizard.exe /RUN

O4 - HKLM\..\Run: [CISrvr Program] C:\COMPAQ\INTERNET\CISRVR.EXE

O4 - HKLM\..\Run: [AvconsoleEXE] C:\Program Files\Network Associates\McAfee VirusScan\avconsol.exe /minimize

O4 - HKLM\..\Run: [VsecomrEXE] C:\Program Files\Network Associates\McAfee VirusScan\VSECOMR.EXE

O4 - HKLM\..\Run: [VsStatEXE] C:\Program Files\Network Associates\McAfee VirusScan\VSSTAT.EXE /SHOWWARNING

O4 - HKLM\..\Run: [Service Connection] c:\cpqs\bwtools\bwtray.exe

O4 - HKLM\..\Run: [CompaqPrinTray] PrinTray.exe

O4 - HKLM\..\Run: [CIJ3P2PSERVER] CIJ3P2PS.EXE

O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\PROGRAM FILES\VERIZON ONLINE\DIAL 4.0\VISUALIPINSIGHT\IPClient.exe" -l

O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\PROGRAM FILES\VERIZON ONLINE\DIAL 4.0\VISUALIPINSIGHT\IPMon32.exe"

O4 - HKLM\..\Run: [kernel32] C:\WINDOWS\SYSTEM\KERNEL32.DLI

O4 - HKLM\..\Run: [EPSON Stylus Photo 820 Series] C:\WINDOWS\SYSTEM\E_S0EIC1.EXE /P29 "EPSON Stylus Photo 820 Series" /O5 "LPT1:" /M "Stylus Photo 820"

O4 - HKLM\..\Run: [Winsock2 driver] DEVLDR32.EXE

O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP

O4 - HKLM\..\Run: [NInit] C:\Program Files\Norton Uninstall Deluxe\NINIT.EXE

O4 - HKLM\..\Run: [NSystemMonitor] C:\PROGRAM FILES\NORTON UNINSTALL DELUXE\SYMMON.EXE

O4 - HKLM\..\RunServices: [Aureal A3D Interactive Audio] sa3dsrv.exe

O4 - HKLM\..\RunServices: [HC Reminder] hc.exe

O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe

O4 - HKLM\..\RunServices: [SAgent2ExePath] C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe

O4 - HKCU\..\RunOnce: [Winsock2 driver] DEVLDR32.EXE

O4 - Startup: PowerReg Scheduler.exe

O8 - Extra context menu item: AltaVista Home - http://jump.altavista.com/avie5/home

O8 - Extra context menu item: AV Search This Term - http://jump.altavista.com/avie5/search

O8 - Extra context menu item: AV Translate this Web Page - http://jump.altavista.com/avie5/babelfish

O8 - Extra context menu item: AV Translate Selection - http://jump.altavista.com/avie5/babelfish

O9 - Extra 'Tools' menuitem: &AltaVista Home (HKLM)

O9 - Extra button: Translate (HKLM)

O9 - Extra 'Tools' menuitem: AV &Translate (HKLM)

O9 - Extra 'Tools' menuitem: &Find Pages Linking to this URL (HKLM)

O9 - Extra 'Tools' menuitem: Find Other Pages on this &Host (HKLM)

O9 - Extra button: AIM (HKLM)

O12 - Plugin for .swf: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\NPSWF32.dll

O12 - Plugin for .mov: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll

O12 - Plugin for .mpeg: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin3.dll

O16 - DPF: Win32 Classes - file://c:\windows\Java\classes\win32ie4.cab

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab

O16 - DPF: {f760cb9e-c60f-4a89-890e-fae8b849493e} -

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

irelynnmisses

53 Posts

December 21st, 2003 00:00

or here..

 

Hijackthis

http://www.merijn.org/files/HijackThis.exe

rjp46

19 Posts

December 21st, 2003 00:00

I used AVG to remove the initial virus, but it couldn't get rid of the backdoor.netdevil virus from windows system file kernel32.dll file. If I could just delete the file with the virus in it I would be in good shape. but it sayes it is write protected when I try it from windows explorer.  

irelynnmisses

53 Posts

December 21st, 2003 00:00

Do this, Download HIJACKTHIS frtom here..

Download 'Hijack This!'. http://www.tomcoyote.org/hjt/
Unzip, doubleclick HijackThis.exe, and hit "Scan".  then SAVE.. then copy and paste the entire log here for analysys. Please do not fix anything until advised to sdo so. Most of what is listed you will need.

 

misses


 

irelynnmisses

53 Posts

December 21st, 2003 02:00

You can check the boxes next to these and have hijackthis fix them...

O1 - Hosts: 217.116.231.7 aimtoday.aol.com

O1 - Hosts: 217.116.231.7 aimtoday.aol.com

O1 - Hosts: 217.116.231.7 aimtoday.aol.com

O1 - Hosts: 217.116.231.7 aimtoday.aol.com

O1 - Hosts: 217.116.231.7 aimtoday.aol.com

O1 - Hosts: 217.116.231.7 aimtoday.aol.com

O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\PROGRAM FILES\MYWAY\MYBAR\1.BIN\MYBAR.DLL

O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\PROGRAM FILES\MYWAY\MYBAR\1.BIN\MYBAR.DLL

O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\PROGRAM FILES\VERIZON ONLINE\DIAL 4.0

\VISUALIPINSIGHT\IPClient.exe" -l

O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\PROGRAM FILES\VERIZON ONLINE\DIAL 4.0\VISUALIPINSIGHT\IPMon32.exe"

O4 - HKLM\..\Run: [kernel32] C:\WINDOWS\SYSTEM\KERNEL32.DLI

O4 - HKLM\..\Run: [Winsock2 driver] DEVLDR32.EXE  <--trojan

O4 - HKCU\..\RunOnce: [Winsock2 driver] DEVLDR32.EXE <--trojan

O16 - DPF: Win32 Classes - file://c:\windows\Java\classes\win32ie4.cab

O16 - DPF: {f760cb9e-c60f-4a89-890e-fae8b849493e} -

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab


When done, reboot. Then find and delete:
c:\windows\java\my.css

irelynnmisses

53 Posts

December 21st, 2003 02:00

Oh yeah,, navigate your way and delete these files/folders

C:\WINDOWS\SYSTEM\DEVLDR32.EXE

C:\WINDOWS\SYSTEM\KERNEL32.DLI

then after reboot scan again and post new log to make sure you are clean.

 

 

misses

rjp46e

9 Posts

December 25th, 2003 03:00

Well, I did all you told me to do but the virus kept generating more virus files in the c drive and in windows temp, so I ran AVG once more to clean, then uninstalled AVG virus scan and installed Norton AV 2003 Pro. It found the virus in a file called scanregw.exe and removed the file. Since that time no virus has been found. I reloaded windows 98 to replace corrupted files but norton antivirus won't open and msconfig.exe won't run. And probably other programs as well. Am doing a scan disk and defrag as we speak. Am running out of answrs.

Was this post helpful?

View All

No Events found!

Top