I did unzip the file before burning to CD. I tried to copy the file from the d drive to the c:\windows\system32, but I kept getting the message "the system cannot find the path specified".
I had already tried the method of searching that you mentioned. I found several of the wininet.dll files, and starting with the newest, tried to copy them, but only got the message, "the system cannot find the path specified".
The file wininet.dll that you get from the download is zipped so it needs to be unzipped first before you put it on the CD.
You can probably find an old one on your PC that will work. Boot into Safe Mode (F8) and select Command Prompt from the menu. It should boot into a black cmd screen. Type:
cd \
dir /s /a wininet.dll
It will search for a while and eventually show every wininet.dll file on your pc.
Pick the one with the newest date and let's says it's in C:\Windows\i386.
copy \windows\i386\wininet.dll \windows\system32
Then reboot into regular mode.
If that doesn't work and you need to copy the file from your CD you can boot into regular mode. You won't get a desktop but if you do CTRL + ALT + DEL and select Task Manager you should be able to File, New Task(run), cmd, OK and that should give you a black cmd window where you can type:
copy d:\wininet.dll c:\windows\system32
(I assumed the CD ROM is the D: drive in the above example, if it's somewhere else then change the D to match the correct drive)
You should also get the smitfraudfix per the sticky 1752 post at the top of the forum and run it too.
If it's on the CD and you have extracted it to \smitfraudfix then the command to move it would be:
Copy D:\smitfraudfix C:\
C:\smitfraudfix\smitfraudfix.cmd
Then just follow the instructions from the 1752 post.
I think I have found part of the problem - why I am getting the message "the system cannot find the path specified". - I looked for the system32 dir, and didn't find it in windows, I found it in winnt instead.
So, I went back through and did the dir search for the old wininet.dll file, and was able to copy and when I rebooted, it completed the reboot process and appears to be ok so far. I am finishing my norton install now, and am going to run a complete scan. Interestingly, when my desktop loaded, I got a balloon in the bottom right corner that appears to be one of those windows alerts, however, at closer inspection I realize it has some spelling/grammar errors - it says,"...click to download the mostup-to-date antipsyware...". Hmmmm. Wish I had paid closer attention - because I am almost positive that I clicked that balloon yesterday when all this started going wrong!
Thanks so much for your help! I'll be back if I continue to have problems.
Scan done at 16:22:41.53, Mon 05/08/2006 Run from C:\Documents and Settings\Owner\Desktop\SmitfraudFix\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600]
mbseverson
9 Posts
0
May 8th, 2006 17:00
I did unzip the file before burning to CD. I tried to copy the file from the d drive to the c:\windows\system32, but I kept getting the message "the system cannot find the path specified".
I had already tried the method of searching that you mentioned. I found several of the wininet.dll files, and starting with the newest, tried to copy them, but only got the message, "the system cannot find the path specified".
Missy
RKinner
2 Intern
•
5.9K Posts
0
May 8th, 2006 17:00
The file wininet.dll that you get from the download is zipped so it needs to be unzipped first before you put it on the CD.
You can probably find an old one on your PC that will work. Boot into Safe Mode (F8) and select Command Prompt from the menu. It should boot into a black cmd screen. Type:
cd \
dir /s /a wininet.dll
It will search for a while and eventually show every wininet.dll file on your pc.
Pick the one with the newest date and let's says it's in C:\Windows\i386.
copy \windows\i386\wininet.dll \windows\system32
Then reboot into regular mode.
If that doesn't work and you need to copy the file from your CD you can boot into regular mode. You won't get a desktop but if you do CTRL + ALT + DEL and select Task Manager you should be able to File, New Task(run), cmd, OK and that should give you a black cmd window where you can type:
copy d:\wininet.dll c:\windows\system32
(I assumed the CD ROM is the D: drive in the above example, if it's somewhere else then change the D to match the correct drive)
You should also get the smitfraudfix per the sticky 1752 post at the top of the forum and run it too.
If it's on the CD and you have extracted it to \smitfraudfix then the command to move it would be:
Copy D:\smitfraudfix C:\
C:\smitfraudfix\smitfraudfix.cmd
Then just follow the instructions from the 1752 post.
Ron
mbseverson
9 Posts
0
May 8th, 2006 18:00
I think I have found part of the problem - why I am getting the message "the system cannot find the path specified". - I looked for the system32 dir, and didn't find it in windows, I found it in winnt instead.
So, I went back through and did the dir search for the old wininet.dll file, and was able to copy and when I rebooted, it completed the reboot process and appears to be ok so far. I am finishing my norton install now, and am going to run a complete scan. Interestingly, when my desktop loaded, I got a balloon in the bottom right corner that appears to be one of those windows alerts, however, at closer inspection I realize it has some spelling/grammar errors - it says,"...click to download the mostup-to-date antipsyware...". Hmmmm. Wish I had paid closer attention - because I am almost positive that I clicked that balloon yesterday when all this started going wrong!
Thanks so much for your help! I'll be back if I continue to have problems.
Missy
mbseverson
9 Posts
0
May 8th, 2006 19:00
I performed the smitfraudfix and here is my log.
SmitFraudFix v2.41
Scan done at 16:22:41.53, Mon 05/08/2006
Run from C:\Documents and Settings\Owner\Desktop\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600]
»»»»»»»»»»»»»»»»»»»»»»»» Killing process
»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files
C:\country.exe Deleted
C:\tool2.exe Deleted
C:\tool3.exe Deleted
C:\uniq Deleted
C:\winstall.exe Deleted
C:\WINNT\system32\intell321.exe Deleted
Problem while deleting C:\WINNT\system32\oleext.dll
C:\Program Files\secure32.html Deleted
C:\Program Files\SpySheriff\ Deleted
»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files
»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning
Registry Cleaning done.
»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll
C:\WINNT\system32\wininet.dll infected !
Searching wininet.dll backup file...
C:\WINNT\$hf_mig$\KB834707\SP2QFE\wininet.dll
C:\WINNT\$hf_mig$\KB867282\SP2QFE\wininet.dll
C:\WINNT\$hf_mig$\KB883939\SP2QFE\wininet.dll
C:\WINNT\$hf_mig$\KB890923\SP2QFE\wininet.dll
C:\WINNT\$hf_mig$\KB896688\SP2QFE\wininet.dll
C:\WINNT\$hf_mig$\KB896727\SP2QFE\wininet.dll
C:\WINNT\$hf_mig$\KB905915\SP2QFE\wininet.dll
C:\WINNT\$hf_mig$\KB912812\SP2QFE\wininet.dll
C:\WINNT\$NtServicePackUninstall$\wininet.dll
C:\WINNT\$NtUninstallKB834707$\wininet.dll
C:\WINNT\$NtUninstallKB867282$\wininet.dll
C:\WINNT\$NtUninstallKB883939$\wininet.dll
C:\WINNT\$NtUninstallKB890923$\wininet.dll
C:\WINNT\$NtUninstallKB896688$\wininet.dll
C:\WINNT\$NtUninstallKB896727$\wininet.dll
C:\WINNT\$NtUninstallKB905915$\wininet.dll
C:\WINNT\$NtUninstallKB912812$\wininet.dll
C:\WINNT\ServicePackFiles\i386\wininet.dll
C:\WINNT\SoftwareDistribution\Download\deacd5ed46f67b73e81aaf6e4e9180ec\sp2gdr\wininet.dll
C:\WINNT\system32\wininet.dll
File Found : C:\WINNT\$hf_mig$\KB912812\SP2QFE\\wininet.dll
System Version : 6.0.2900.2861
BackUp Version : 6.0.2900.2861
Wininet.dll Remplacement (reboot necessary)
»»»»»»»»»»»»»»»»»»»»»»»» Reboot
C:\WINNT\system32\oleext.dll Deleted
»»»»»»»»»»»»»»»»»»»»»»»» End
Is there any problem with it not being able to delete the oleext.dll file?
RKinner
2 Intern
•
5.9K Posts
0
May 8th, 2006 19:00
I think it was able to go back in and delete it on the second try so shouldn't be a problem.
Sorry about the \Windows problem but most people have XP Home and that's where it usually is unless it was an upgrade from Win2K.
Glad you figured it out. Can you now post an HJT log?
Ron
RKinner
2 Intern
•
5.9K Posts
0
May 8th, 2006 21:00
HJT = HijackThis which is what this forum usually works with. See the FAQ at the top of the forum or go directly to:
http://forums.us.dell.com/supportforums/board/message?board.id=si_hijack&message.id=4987
Ron
mbseverson
9 Posts
0
May 8th, 2006 21:00