imabrit
|
posted on October 14, 2000 09:19:12 PM new
Somebody kindly infected me with this virus.I have current virus sofware but still managed to pick it up.
Anyway how do I get rid of this thing I have
cleaned off some of the infected files.
Others I have to delete only problem is that winsoc32.dll is infected too.
I do not want to do a total re-boot of my system and loose all my data as it will take me days to get it back together,
Where can I download a clean winsock32.dll.
How do you get rid of it.
THANK YOU PLEASE PLEASE HELP
Adrian
|
mrpotatoheadd
|
posted on October 14, 2000 09:22:50 PM new
You could try here:
http://support.microsoft.com/servicedesks/fileversion/dllinfo.asp?sd=MSDN
edited to add... here's another place to look:
http://ftpsearch.lycos.com/?form=medium
[ edited by mrpotatoheadd on Oct 14, 2000 09:25 PM ]
|
imabrit
|
posted on October 14, 2000 09:56:35 PM new
Thanks I did a search there too found it but it does not tell me where to download it
at.
Funny I have 2 different virus programmes one picks up a lot more infected programmes than the others that cannot be
cleaned.
It looks like I will have to spend all day tomorrow re-installing everything on my computer.
Anyone know how to save explorer email and save ebud data.
Adrian
|
mrpotatoheadd
|
posted on October 14, 2000 10:06:26 PM new
If you go to the Microsoft site and do a search, click on the "more information" link, and it will tell you which .cab file on your WinXX CD you can find the dll in.
If you are using eBud 2.41, click TOOLS>BACKUP EBUD DATA and it will create a file in the eBud directory called "backup.dat".
|
Libra63
|
posted on October 14, 2000 10:07:27 PM new
I don't think you can save your email unless you put it on a disc and then that would be infected, but when you do your software restore then your ISP keeps your new email until you open it. You wouldn't want to keep the email anyway because of the virus. Print out what you want then redo your computer. When I reboot I don't lose anything and I do it often. How do you know you have that virus? I have never had one so I don't know how it would act. I guess I am just lucky.
I am keeping my fingers crossed that I never get one. Good Luck
|
dman3
|
posted on October 14, 2000 10:09:19 PM new
good luck doing this with out doing a fdisk
the winsock32.dll is in use while the computer is running and cant be removed and replaced and when its off it cant be had to remove.
if you down load a new one with your infected computer the new one will be infected too  its a catch 22 .
my confusion is this a TROJAN is not a virus
and usually only effect a program or some parts of some programs the most common TROJAN is a maccro that will cause a program to perform redundent sinceless tasks.
or will turn all your key board short cuts into alt < control> delete or F1 or something annoying but not deadly enough to require deleteing the whole HD to fix.
True viruses causes and forces your whole hard drive to over write its self in a way to make your whole computer useless in a day or a week some are just naggingly slow and might take a months just slowly over weeks makeing you think your nuts.
if you have infected or changed dll files in your windows directory this is not a TROJAN at all a TROJAN is a program routin that when placed in the right folder will replace that routin in that program.
look at a trojan like a web page with a java script for a scrolling menu some one creates a java script you wanted a better java scrolling menu so I send you this program tell you put this inplace of your java script makeing no changes but my script is a trojan now all the link on your menu lead to my sales or instead of a scrolling menu you now have a naked belly danceing java script on your web page this is a trojan but you wouldnt need to delete your whole web page to get rid of it just the script I gave you would need to be removed.
on the other hand if my java script was a virus your whole web site might be over writen and now be just all naked belly dancers and nothing you had is left and with out a back up of the orginal you must delete it all and start over.
so if you have changed dll files chances are you are gona need to install the dreaded Restore CD which completely re formates your HD and starts from store bought condition. point two is if you have more then one drive all drives will need to be cleaned not only that any floppys you have used in your computer since you had this will need to be tossed out dont even try to put these back in and formate or clean them they will only infect your HD all over
when you get a real Virus that the virus scan didnt catch before it was sucessfully ran when you do clean the infected parts of the HD you have to put the restore CD in to get back all parts that were delelted any ways virus cleaning dont really clean infected parts it delets all files that show change in size since you install the virus program all it deletes must be reinstalled for your computer to run again this includes windows its self.
sometime its faster starting over new since it can take months before you find every program that had peices deleted.and 90% of the time you find the files you wanted to save were the one frist infected thats what a virus is about do the most damage in the fastest ammount of time
Sorry to here you got this and good luck which ever way you decide to get this out of your computer.
WWW.dman-n-company.com
|
imabrit
|
posted on October 14, 2000 10:23:22 PM new
Its an email virus called PE_MTX.A,that repeats itself and infects others.I was informed by another customer who I emailed it too and he spent the next 3 hours rebooting his computer.
Trend Micro tells you how to get rid of it but I cannot find it in the directory's you are supposed to delete.
But I do have it in some,it converts itself into an mtx_.EXE file.
Then corrupts the wsock32.dll
I have over 17000 emails stored on this computer plus thousands of email addresses.
Ebud has 2 years of data on it and from what you are telling me I am stuck up a creeek without a paddle.
I can get a fresh dll off my other two computers as they are not infected.As long as I can find a source.
Will re-check MSN tomorrow its 1.30 am been at this since 8pm and getting no where.
I need to get rid of it as I can be sending it to all my customers.
Adrian
|
bhearsch
|
posted on October 14, 2000 11:07:22 PM new
Hello Adrian. I'm sorry to hear about your problems and hope you can salvage some of your info. You can download a fresh winsock32.dll here:
http://www.1reviews.com/dll/winsockdll.shtml or http://solo.abac.com/dllarchive/
Blanche
[ edited by bhearsch on Oct 15, 2000 09:34 AM ]
|
bhearsch
|
posted on October 14, 2000 11:16:14 PM new
Adrian, I just found a site that has offers a solution for this virus and it doesn't appear that you'll need to reformat your hard drive.
http://www.antivirus.com/pc-cillin/vinfo/virusencyclo/default5.asp?VName=PE_MTX.A
Blanche
|
dscntr1
|
posted on October 15, 2000 09:50:25 AM new
Adrian,
If the other suggestions fail:
You CAN replace wsock32.dll with a clean copy stored in the Win98_01.cab, (02, 03) etc (or Win95_01.cab etc) files on your computer. But you must first reboot to MSDOS and do it from there. You cannot do it from within Windows.
Here's how:
Once you are in DOS, change directory to C:\Windows\Options\Cabs. (To change directory, type "cd windows" (without the quotes) then press enter. Then the same for Options & Cabs.) If that directory is not on your computer, then just get out your Windows CD and you can find the .cab files in the \Win98 directory.
To ensure that you are in the proper directory, at the dos prompt type "dir/p" (again and always, without the quotes) then press enter. Scroll through the directory listing until you have found files named "Win98_XX.cab" (where XX is a 2-digit #.) Make a note of the FIRST "Win98_XX.cab" file in the list. Specifically, make note of the 2-digit # "XX".
When you have found the proper directory type the following command at the dos prompt (NOTE: in the following command where it says "Win98_XX.cab", change the "XX" for the number you made a note of above. Also BE SURE to proofread the command you type very carefully before you press enter. If you type it wrong, it just won't work.)
[Even if the following command is in two lines in this post, type it all before proofreading and pressing enter. Also, if while you are typing this command it flows over to the next line that's okay]:
"extract /a /e /l c:\windows\system Win98_XX.cab wsock32.dll"
Proofread, then press enter.
If you get a prompt that says something like "Would you like to Overwrite the existing file", type "y" or "yes" then press enter if you have to.
You will see it scrolling through the entire list of Win cabs until it finds a clean copy of wsock32.dll. Then it will extract that file and overwrite the corrupt file with the clean one.
When you have seen that the above has occurred and you are again at the dos prompt with a flashing cursor, press "Ctrl", "Alt" and "Del" keys all at once to reboot into Windows. (It's okay to do that in MSDOS.)
For future reference:
This works for any Windows file or driver you want to replace. Extracting from the cab files is VERY HANDY when you know what file you are looking for and saves A LOT of money by preventing service calls to have someone to come out and do this very thing for you! You don't even have to remember the syntax of the command (the \a \e and etc): at the dos prompt, just type "extract" by itself and press enter and the instructions are automatically displayed for you! (You have to actually be in the directory where the file "Extract.exe" is located.)
Hope this helps and that I was clear enough in the instructions. I didn't want to assume that you were familiar with dos commands.
Gary
[P.S.: Dos can be fun, but NEVER, NEVER, NEVER type "del *.*" unless you ABSOLUTELY know what you are doing.]
|
bhearsch
|
posted on October 15, 2000 09:54:22 AM new
Adrian, were you able to get rid of the PE_MTX.A virus without reformatting? I'm sure you already know this but if you're using Outlook Express your emails will be stored in a Windows *.dbx* file. I periodically copy any important emails from these files to a floppy disk as a backup in case I have problems.
Please keep us informed of your progress in getting rid of this virus.
Blanche
|
imabrit
|
posted on October 15, 2000 09:58:39 AM new
Well it turned out to be a lot easier to get rid of than I was led to believe.It took me about 6 hrs of messing around.But its finally gone and I lost nothing either.
Some of the sites that told you how to get rid of it I found did not work.
But I finally got rid of it with MCcaffee anti virus.By cleaning and deleting files,rebooting and then going through the process again.
So all is fine.
thanks for the help
Adrian
|
bhearsch
|
posted on October 15, 2000 10:10:38 AM new
That's a relief!! Adrian, I have been using a program called GOBACK that works better than any antivirus software out there. Basically, it allows you to go back to a time BEFORE the problem occurred. The only drawback is the 8 to 10 percent of hard drive space that is needed for the program to function optimally. I highly recommend it for anyone who cannot afford to lose important data. http://www.adaptec.com/products/overview/goback.html
Blanche
|
imabrit
|
posted on October 15, 2000 10:28:00 AM new
Was I ever relieved so Know I can enjoy the rest of a gorgeous Sunday afternoon here in
Florida.
First thing a siesta......
Adrian
|
dman3
|
posted on October 15, 2000 10:29:35 AM new
Im not sure I would call 6 hours of messing around easy but sure glad you got rid of this with a min loss of data.
for me 6 hours would be for ever seems to me with so much stuff you dont want to lose it back up system of some type might be a worthy investment for you.
this way next time there is a problem you can simply remove everything and run your system back up if you did a daily back up you would lose only your last few hours of data the restored HD would be look like your computer did 24 hours or less ago before the virus and take a matter of 20 to 40 mins to fix.
WWW.dman-n-company.com
|
