I had Norton Internet 2000 installed, and thought I had installed Internet 2001 as well but it appears not, yesterday I did something I never do! I opened a strange file and promptly infected myself. I quarantined 2 other mails in my temp folder, and have since deleted them, but the one I opened has attached itself to C:Windows\system\wsock32.dll, and the virus program is unable to delete this as its a system file. Anybody know how to remove this file and or re-install it with as little pain as possible. I am running Windows 98 second addition. Apparently this worm attaches itself to e-mails but is much more subtle than Melissa or the Loveletter, and is in the top ten of viruses at the moment! Although its threat to the system are said to be low, its one to watch for....delete any mail about Snow White and with Screensaver .scr attachments, I wonder how it came to me?
------------------ Henry Barker #1924 akaKaftan SignCraft AB Stockholm, Sweden. A little bit of England in a corner of Stockholm www.signcraft.se info@signcraft.se
Posted by Steve King (Member # 771) on :
I received the same virus here at work a few months back, which without knowing it at the time I sent to my house. I was lucky at work and was able to clean the virus off with Norton 2001 and then reload win98. I wasn't so lucky at home and I had to wipe my hard drive clean and then reload everything from scratch.
The first thing that I would do is back up all of your data files and then try a reload. That's about the best of my knowledge on viruses.
Good Luck, Steve
------------------ Steve King Taylor Signs Ltd. Calgary, Alberta Hey, we just turned 100 Years old!
Posted by John Deaton (Member # 925) on :
I checked Norton's site, and this was all it said about removal: Use Norton AntiVirus to repair the infected WSOCK32.DLL. Other files detected as W95.Hybris contain only the virus body and must be deleted. Don't know if this helps any, but hopefully. A friend of mine recently got the loveletter virus, and I had to help him get it cleaned out. NOrton had removal instructions on their site that was easy to follow.
------------------ John Deaton III Deaton Signs&Grafix 109 N. Cumberland Ave.,Harlan, Ky. 40831 606-573-9101
The WSOCK32.DLL file can be restored from backup. This can be done by:
Windows 98/2000/ME - Click the START MENU|RUN, type SFC and click OK. - Choose Extract one file from the installation disk - Type C:\WINDOWS\SYSTEM\WSOCK32.DLL in the box and click Start. - In the Restore from box type C:\WINDOWS\OPTIONS\CABS or browse to the Win98 directory on your Windows98 CD-ROM - Click OK and follow remaining prompts
Wsock32.dll file exists within the Precopy1.cab cabinet file on the Windows 98 CD-ROM.
"The best things in life aren't things" Art Buchwald
Posted by Mike Pipes (Member # 1573) on :
Check out www.datafellows.com and look in the Virus Information Center.. they have Hybris listed right there, pretty detailed information about it including exactly what it does and how you can remove it manually.
I'm actually dealing with the MTX virus on my dad's computer right now. That's a sneaky little bugger cause ya cant delete its files under windows cause they are in use by windows, but without a StartUp disk (naturally Dad has never made one) WinME wont boot into DOS where you could delete them. hehe.. looks like I get to edit the registry by hand.. =)
------------------ Mike Pipes Digital Illusion Custom Graphics Lake Havasu City, AZ http://www.stickerpimp.com
Posted by Henry Barker (Member # 174) on :
Thanks everybody!
A very big thank you to Mike at Translab! I owe you one!
I had done what some of the others suggested, i.e gone to Norton and checked, etc and deleted the temp files that just had the "virus body". But it was the wsock32.dll that was a problem, as its in the System files and you can't just delete it, or copy and paste a new, but thanks to you, I went in to my Win 98 CD, I couldn't restore it from there, and didn't have the options\cabs file you mentioned, but made one, and then "extracted" a new wsock32.dll from there and then restored from the c:\windows\options\cab location, so I am clean again, and next time I get a mail from Snow white inviting me to look at a sexy screensaver I will trash it instead of being inquisitive!!
Thanks again...and for those that don't have it buy Norton 2001 or something similar!
------------------ Henry Barker #1924 akaKaftan SignCraft AB Stockholm, Sweden. A little bit of England in a corner of Stockholm www.signcraft.se info@signcraft.se
Posted by whitey2 (Member # 1265) on :
Henry i have had that same email (snow white) sent to me about a dozen times, even got it twice in one day, fortunately Nortons anti-virus picked it up before I could open it....just wish I knew where it came from.
------------------ Neil White Sign Magic Melton, VIC Australia whitey@primus.com.au
Posted by Henry Barker (Member # 174) on :
It probably comes from someone you know well!! That's how it works but they have no idea they are sending it. Its a worm virus that can update itself via its own plug-ins that it downloads from Newsgroups when you are connected to the net, it then randomly sends itself out to other people in your address book, but not from you it just uses your list of e-mail addresses to propogate, like a parasite....It must be fun coming up with these things...if you have a warped sense of humour. I had Norton Anti-Virus 2000 installed and it didn't pick it up, I thought I had installed Norton 2001 which I had bought some time ago, but obviously not, you know how it is when you're stressed, so it was just by coincidence that I found it yesterday, while updating my virus protection!
------------------ Henry Barker #1924 akaKaftan SignCraft AB Stockholm, Sweden. A little bit of England in a corner of Stockholm www.signcraft.se info@signcraft.se
Posted by Mike Pipes [in a cubicle] (Member # 1841) on :
Ever notice the huge number of computer virii floatin around yet the anti-virus software companies manage to keep track of them all and even have a fix just minutes after the virus is released?
Makes ya think, doesnt it?
Oddly enough, the MTX virus my dad had also infects the wsock32.dll file but my dad's version wasnt even touched. I had copied the file from my own machine to replace the one he had, but his wasnt even infected! MTX just decided to infect other programs instead.. all is well though.
------------------ Mike Pipes -----trapped in a box with a computer and a slice of cheese-----
