Win98se file kernel32.dll has a virus-- how do I replace file with a good one?

Question

I have a desktop with win 98se. I have purged w32.weird virus from over 2,000 files. There is one more virus with the name 'backdoor.netdevil in the file 'kernel32.dll' in the windows system folder next to the real kernel32.dll file. The difference is the file size and the icon of the copycat file. I have copied the same file from an uninfected win98se system and would like to remove both the good and bad file and replace them with the uninfected file. Can I accoplish this from the C prompt or should I use a system disk to do it through dos? Does anyone have experience in this matter? Ron Pease.

irelynnmisses · Answer

You can get AVG from here...

http://www.grisoft.com/us/us_dwnl_free.php

Your best bet would be to try an anti-virus program rto remove this. While your at it DL HIJACKTHIS from here ...

http://www.merijn.org/files/HijackThis.exe

When DLed you can Click on SCAN then click SAVE then copy and paste your log here so we can take a look at it. sometives certain problems can be diagnosed and/or fixed thrue HIJACKTHIS. Or we can instruct you on how to fix the problem manually.

misses

rjp46 · Answer

Sorry I forgot to add the file in the last reply. Logfile of HijackThis v1.97.7 Scan saved at 9:25:26 PM, on 12/20/03 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\SA3DSRV.EXE C:\WINDOWS\SYSTEM\MSTASK.EXE C:\PROGRAM FILES\COMMON FILES\EPSON\EBAPI\SAGENT2.EXE C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE C:\WINDOWS\SYSTEM\DDHELP.EXE C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\SYSTEM\RNAAPP.EXE C:\WINDOWS\SYSTEM\TAPISRV.EXE C:\WINDOWS\TASKMON.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\MOUSE\SYSTEM\EM_EXEC.EXE C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\CPQEADM.EXE C:\COMPAQ\INTERNET\CISRVR.EXE C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\VSSTAT.EXE C:\WINDOWS\SYSTEM\CIJ3P2PS.EXE C:\PROGRAM FILES\VERIZON ONLINE\DIAL 4.0\VISUALIPINSIGHT\IPCLIENT.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\PROGRAM FILES\VERIZON ONLINE\DIAL 4.0\VISUALIPINSIGHT\IPMON32.EXE C:\WINDOWS\SYSTEM\KERNEL32.DLI C:\WINDOWS\SYSTEM\E_S0EIC1.EXE C:\WINDOWS\SYSTEM\DEVLDR32.EXE C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\BTTNSERV.EXE C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE C:\PROGRAM FILES\NORTON UNINSTALL DELUXE\SYMMON.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\PROGRAM FILES\COMPAQ\ON-SCREEN DISPLAY\OSD.EXE C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.presario.net/scripts/redirectors/presario/srchredir.dll?c=2c99&lc=0409&s=search&i=enu R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.presario.net/scripts/redirectors/presario/srchredir.dll?c=2c99&lc=0409&s=search&i=enu R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.presario.net/scripts/redirectors/presario/srchredir.dll?c=2c99&lc=0409&s=search&i=enu R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://desktop.presario.net/scripts/redirectors/presario/deskredir.dll?c=2c99&lc=0409&s=consumer&i=enu R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.presario.net/scripts/redirectors/presario/srchredir.dll?c=2c99&s=search&query=%s&i=enu O1 - Hosts: 217.116.231.7 aimtoday.aol.com O1 - Hosts: 217.116.231.7 aimtoday.aol.com O1 - Hosts: 217.116.231.7 aimtoday.aol.com O1 - Hosts: 217.116.231.7 aimtoday.aol.com O1 - Hosts: 217.116.231.7 aimtoday.aol.com O1 - Hosts: 217.116.231.7 aimtoday.aol.com O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\PROGRAM FILES\MYWAY\MYBAR\1.BIN\MYBAR.DLL O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\PROGRAM FILES\MYWAY\MYBAR\1.BIN\MYBAR.DLL O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS	askmon.exe O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [EM_EXEC] c:\mouse\system\em_exec.exe O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe O4 - HKLM\..\Run: [EACLEAN] C:\Program Files\Compaq\Easy Access Button Support\eaclean.exe O4 - HKLM\..\Run: [Aureal A3D Interactive Audio Init] A3dInit.exe O4 - HKLM\..\Run: [Compaq Internet Setup] C:\Compaq\Internet\InetWizard.exe /RUN O4 - HKLM\..\Run: [CISrvr Program] C:\COMPAQ\INTERNET\CISRVR.EXE O4 - HKLM\..\Run: [AvconsoleEXE] C:\Program Files\Network Associates\McAfee VirusScan\avconsol.exe /minimize O4 - HKLM\..\Run: [VsecomrEXE] C:\Program Files\Network Associates\McAfee VirusScan\VSECOMR.EXE O4 - HKLM\..\Run: [VsStatEXE] C:\Program Files\Network Associates\McAfee VirusScan\VSSTAT.EXE /SHOWWARNING O4 - HKLM\..\Run: [Service Connection] c:\cpqs\bwtools\bwtray.exe O4 - HKLM\..\Run: [CompaqPrinTray] PrinTray.exe O4 - HKLM\..\Run: [CIJ3P2PSERVER] CIJ3P2PS.EXE O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [IPInSightLAN 01] 'C:\PROGRAM FILES\VERIZON ONLINE\DIAL 4.0\VISUALIPINSIGHT\IPClient.exe' -l O4 - HKLM\..\Run: [IPInSightMonitor 01] 'C:\PROGRAM FILES\VERIZON ONLINE\DIAL 4.0\VISUALIPINSIGHT\IPMon32.exe' O4 - HKLM\..\Run: [kernel32] C:\WINDOWS\SYSTEM\KERNEL32.DLI O4 - HKLM\..\Run: [EPSON Stylus Photo 820 Series] C:\WINDOWS\SYSTEM\E_S0EIC1.EXE /P29 'EPSON Stylus Photo 820 Series' /O5 'LPT1:' /M 'Stylus Photo 820' O4 - HKLM\..\Run: [Winsock2 driver] DEVLDR32.EXE O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP O4 - HKLM\..\Run: [NInit] C:\Program Files\Norton Uninstall Deluxe\NINIT.EXE O4 - HKLM\..\Run: [NSystemMonitor] C:\PROGRAM FILES\NORTON UNINSTALL DELUXE\SYMMON.EXE O4 - HKLM\..\RunServices: [Aureal A3D Interactive Audio] sa3dsrv.exe O4 - HKLM\..\RunServices: [HC Reminder] hc.exe O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [SAgent2ExePath] C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe O4 - HKCU\..\RunOnce: [Winsock2 driver] DEVLDR32.EXE O4 - Startup: PowerReg Scheduler.exe O8 - Extra context menu item: AltaVista Home - http://jump.altavista.com/avie5/home O8 - Extra context menu item: AV Search This Term - http://jump.altavista.com/avie5/search O8 - Extra context menu item: AV Translate this Web Page - http://jump.altavista.com/avie5/babelfish O8 - Extra context menu item: AV Translate Selection - http://jump.altavista.com/avie5/babelfish O9 - Extra 'Tools' menuitem: &AltaVista Home (HKLM) O9 - Extra button: Translate (HKLM) O9 - Extra 'Tools' menuitem: AV &Translate (HKLM) O9 - Extra 'Tools' menuitem: &Find Pages Linking to this URL (HKLM) O9 - Extra 'Tools' menuitem: Find Other Pages on this &Host (HKLM) O9 - Extra button: AIM (HKLM) O12 - Plugin for .swf: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\NPSWF32.dll O12 - Plugin for .mov: C:\PROGRA~1\INTERN~1\PLUGINS
pqtplugin.dll O12 - Plugin for .mpeg: C:\PROGRA~1\INTERN~1\PLUGINS
pqtplugin3.dll O16 - DPF: Win32 Classes - file://c:\windows\Java\classes\win32ie4.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab O16 - DPF: {f760cb9e-c60f-4a89-890e-fae8b849493e} - O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

irelynnmisses · Answer

or here..   Hijackthis http://www.merijn.org/files/HijackThis.exe

rjp46 · Answer

I used AVG to remove the initial virus, but it couldn't get rid of the backdoor.netdevil virus from windows system file kernel32.dll file. If I could just delete the file with the virus in it I would be in good shape. but it sayes it is write protected when I try it from windows explorer.

irelynnmisses · Answer

Do this, Download HIJACKTHIS frtom here..

Download 'Hijack This!'. http://www.tomcoyote.org/hjt/
Unzip, doubleclick HijackThis.exe, and hit "Scan". then SAVE.. then copy and paste the entire log here for analysys. Please do not fix anything until advised to sdo so. Most of what is listed you will need.

misses

irelynnmisses · Answer

You can check the boxes next to these and have hijackthis fix them...

O1 - Hosts: 217.116.231.7 aimtoday.aol.com

O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\PROGRAM FILES\MYWAY\MYBAR\1.BIN\MYBAR.DLL

O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\PROGRAM FILES\MYWAY\MYBAR\1.BIN\MYBAR.DLL

O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\PROGRAM FILES\VERIZON ONLINE\DIAL 4.0

\VISUALIPINSIGHT\IPClient.exe" -l

O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\PROGRAM FILES\VERIZON ONLINE\DIAL 4.0\VISUALIPINSIGHT\IPMon32.exe"

O4 - HKLM\..\Run: [kernel32] C:\WINDOWS\SYSTEM\KERNEL32.DLI

O4 - HKLM\..\Run: [Winsock2 driver] DEVLDR32.EXE <--trojan

O4 - HKCU\..\RunOnce: [Winsock2 driver] DEVLDR32.EXE <--trojan

O16 - DPF: Win32 Classes - file://c:\windows\Java\classes\win32ie4.cab

O16 - DPF: {f760cb9e-c60f-4a89-890e-fae8b849493e} -

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

When done, reboot. Then find and delete:
c:\windows\java\my.css

irelynnmisses · Answer

Oh yeah,, navigate your way and delete these files/folders

C:\WINDOWS\SYSTEM\DEVLDR32.EXE

C:\WINDOWS\SYSTEM\KERNEL32.DLI

then after reboot scan again and post new log to make sure you are clean.

misses

rjp46e · Answer

Well, I did all you told me to do but the virus kept generating more virus files in the c drive and in windows temp, so I ran AVG once more to clean, then uninstalled AVG virus scan and installed Norton AV 2003 Pro. It found the virus in a file called scanregw.exe and removed the file. Since that time no virus has been found. I reloaded windows 98 to replace corrupted files but norton antivirus won't open and msconfig.exe won't run. And probably other programs as well. Am doing a scan disk and defrag as we speak. Am running out of answrs.

Virus & Spyware

Was this post helpful?