wininet.dll infected with desktophijacker

JPM74JPM74
edited July 2005 in Spyware & Virus Removal
I have a system that has the w32.desktophijacker virus......I have cleaned out all the registry entries yet still norton finds he virus in wininet.dll but cannot repair, quarantine or delete the file......I have also tried in safe mode......I have tried renaming the file and also tried copying the same file from winnt\i386 but it wont copy over since windows is using the file......again this was also tried in safe mode.
Any ideas on how to repair or replace this file?

Comments

  • DexterDexter Vancouver, BC Canada
    edited June 2005
    Wininet.dll gets installed by Internet Explorer. If you have access to another computer running the same version of Internet Explorer on the same OS, you could copy that wininet.dll file to some portable media such as a floppy or CD or USB stick, and then transfer it to your computer. You should be able to rename the existing wininet.dll file to wininet.OLD. Then copy the good version from your portable media into your C:\WINNT\system32 directory.

    If that works, then I recommend you reintalls Internet Explorer to make sure all files are clean.

    Let me know if that doesn't work. Also, if you cannot get a copy of wininet.dll from another computer, send me a Private Message and let me know what OS and version of IE you have, and I will see what I can do...

    Let us know if that works or not.

    Dexter...
  • griffin01
    edited June 2005
    I dont knw if I can help much but when my wininet.dll file got infected i started to look for a new one and I came across a website that had a lot of system dll's and had serveral different kinds of wininet.dll for the differnt versions. I dled it but I never used it so I dont knw if the files are legit/clean. If someone could verify it that would be great. I think it says the dll's are provided AS-IS. here is the site http://www.dldll.com/

    like i said i dont knw anything about the dll's they have for download but someone here might be able to verify them be clean/legit. hope this helps.
  • DexterDexter Vancouver, BC Canada
    edited June 2005
    griffin01 wrote:
    I dont knw if I can help much but when my wininet.dll file got infected i started to look for a new one and I came across a website that had a lot of system dll's and had serveral different kinds of wininet.dll for the differnt versions. I dled it but I never used it so I dont knw if the files are legit/clean. If someone could verify it that would be great. I think it says the dll's are provided AS-IS. here is the site http://www.dldll.com/

    like i said i dont knw anything about the dll's they have for download but someone here might be able to verify them be clean/legit. hope this helps.


    I don't know much about that sitem the one I have used and recommended inthe past is http://www.dll-files.com/ They are the same idea though.

    The only thing to be cautious of with download sites like that is that that you never know 100% for sure if the file you are getting is completely reputable. If you Google "download wininet.dll", you will find dozens of sites like those which offer system files for download. There is always the chance that one of them is hosting infected files to spread their own spyware or trojans. Many people use sites like these, but they do disclaim their sites by saying "use at your own risk." If it was my system, I would try to get a version of the file from another system I had access to, or a friend or someone else who's advice and assistance I trusted.

    Go ahead and try a site like this if you wish, but use at your own risk. :)

    Dexter...
  • JPM74JPM74
    edited June 2005
    Thanks for replying Dexter. However the problem is that windows is using the file and therefore wont allow me to rename it. Also if I try to copy and paste the file from the i386 directory so that it overwrites the one in the system32 folder it wont allow it since again it says windows is using the file. I have tried this in normal mode and also in safe mode(without networking). Any other suggestions? It's running win2k
  • happy62780
    edited July 2005
    The problem that you are having now is that Windows will not release the file for editing. What I had to do in a similar situation is boot up the PC using Windows UBCD and replace the file. You could also boot up using a Win98 boot disk and delete it using DOS. The best place to get a Win98 boot disk is www.bootdisk.com . Hope this helps.
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited July 2005
    Hi JPM74.

    Dexter has been very busy so he asked me to take over for him. It's been a while since your last post. If you are still in need of help can you bring me up to date with the problems that you are having?
Sign In or Register to comment.