virus on wsock32.dll - cant replace or delete

[rynok]

I have a virus called W95.Hybris.gen that I Norton cannot fix. Since it is a W98 system file I cannot replace or delete it. Is there anything I can do to fix this besides reinstalling W98?

Thanks,

Ryno

 

[jaywallen]

Just had a friend who experienced this problem. Did Norton at least 'disinfect' the file? InoculateIT PE does, but it leaves the file dead in the water.

Did you try System File Checker to see if it will replace the file for you? My acquaintance reported that SFC wouldn't run properly on his system after the hybris infection. I don't know if hybris sacked the SFC or not.

You can delete the file by booting straight to DOS (either with a Win98 startup diskette or by using the Ctrl key to invoke the startup menu and choosing "Command Line Only&quot then deleting the file using the "Del" command. (Don't forget to use the truncated path / filename specification if the path to the file is a long filename or has spaces in it.) Then you could manually extract the file from the CAB to the specified location.

You could also try uninstalling all networking functions, rebooting and then re-installing them -- but, in any case, you have to be sure the system is disinfected first.

Good luck!

Regards,
Jim

 

[RaymondY]

I agree with jaywallen! Just used a similar procedure to delete the MTX virus from a work machine. However they may want to check the internet to make sure the virus does not hide anything in your registry. They MTX virus that I finally got rid of has a registry entry that ran the program during boot up.

 

[corkyg]

Some yo-yo tried to pass that to me last night, but I recognized the M.O. and scanned it immediately. McAfee found the W32/hybris.gen@M worm. I deleted it quickly before anyone had a chance to run DWARFS4YOU.EXE.

Go to McAfee's library, look that up and they have a specific procedure ypou can use to get rid of the faulty files. Here's the essence:

Removal Instructions
Use specified engine and DAT files for detection and removal.

Windows 95/98 systems require rebooting to MS-DOS mode and scanning with the command line scanner SCANPM in order to clean such files as EXPLORER.EXE and TASKMON.EXE.

The WSOCK32.DLL file can be restored from backup. This can be done by:

Windows 98/2000/ME
- Click the START MENU|RUN, type SFC and click OK.
- Choose Extract one file from the installation disk
- Type C:\WINDOWS\SYSTEM\WSOCK32.DLL in the box and click Start.
- In the Restore from box type C:\WINDOWS\OPTIONS\CABS or browse to the Win98 directory on your Windows98 CD-ROM
- Click OK and follow remaining prompts

Wsock32.dll file exists within the Precopy1.cab cabinet file on the Windows 98 CD-ROM.
------------------------------------
How come NAV doesn't provide such things?