No Wininet.dll..!!!!!

[Terry]

Win Xp Home
AVG anti-virus

My son's PC found a virus whilst searching on GOOGLE, via AVG named
something like...."Trojan Dropper".
A box appeared and asked if he wished to delete file...which he "believes"
he did delete, and from then on problems occurred:
1) Unable to run MS Autoroute...States "unable to run due to wininet.dll
file missing" !!!!!!
2) PC desktop has a white background now !!!!!
3) Unable to run Internet explorer, but can run Outlook express.

After thorough search for WININET.DLL on his PC & XP Home CD, not a single
entry found..unlike my PC shows several entries of it.

He tried "system restore" ...still the same problems.

He has deleted the AVG vault files that were there (3).

He contacted me to see if I had any ideas as he lives away from me, so some
of the information is a little "sketchy" I am sorry to say.

Help appreciated please.

Terry

 

[David H. Lipman]

From: "Terry" <[email protected]>

| Win Xp Home
| AVG anti-virus
|
| My son's PC found a virus whilst searching on GOOGLE, via AVG named
| something like...."Trojan Dropper".
| A box appeared and asked if he wished to delete file...which he "believes"
| he did delete, and from then on problems occurred:
| 1) Unable to run MS Autoroute...States "unable to run due to wininet.dll
| file missing" !!!!!!
| 2) PC desktop has a white background now !!!!!
| 3) Unable to run Internet explorer, but can run Outlook express.
|
| After thorough search for WININET.DLL on his PC & XP Home CD, not a single
| entry found..unlike my PC shows several entries of it.
|
| He tried "system restore" ...still the same problems.
|
| He has deleted the AVG vault files that were there (3).
|
| He contacted me to see if I had any ideas as he lives away from me, so some
| of the information is a little "sketchy" I am sorry to say.
|
| Help appreciated please.
|
| Terry
|

This will probably restore an older version of the DLL but an older version *may* be better
than none at all.

Insert the WinXP CDROM in the CD drive. Let's assume "D:"

expand D:\i386\WININET.DL_ %windir%\system32\WININET.DLL

 

[Guest]

Are sure he is searching properly??
I have several files also.

 

[Terry]

Thank you Dennis
According to my son he has searched several times for this file entries.

Terry (eastern UK)

 

[Terry]

Tahks David

I have forwarded your email to him, as he was unable to "expand" that
suggested line.....yes that is on his XP CD, but do we need to enter DOS
mode or some other means to carry out that expansion??

I am retired so I am trying to gather all information possible for him as he
is working long hours. It is his home PC that has this problem.

Terry

 

[GTS]

There are several current malware items which infect Wininet.dll (including
PSGuard and Smitfraud Trojan) and can be difficult to remove. You are
likely to find that if you do replace this file it is promptly reinfected
and removed again due to active parasites. (I recently serviced a machine
doing exactly that). Note that antivirus programs may detect and delete
the infected file while being completely unaware of the active parasite
causing the problem. David's advice is one good way to try to replace it.
I replaced it successfully by copying it from another XP machine at the same
service pack level.

Your son should run (at least) the following 3 programs preferably in Safe
Mode.
Ad-Aware - http://www.lavasoftusa.com
Spybot - http://www.safer-networking.org/
CWShredder - http://www.spywareinfo.com/~merijn/downloads.html

 

[David H. Lipman]

From: "Terry" <[email protected]>

| Tahks David
|
| I have forwarded your email to him, as he was unable to "expand" that
| suggested line.....yes that is on his XP CD, but do we need to enter DOS
| mode or some other means to carry out that expansion??
|
| I am retired so I am trying to gather all information possible for him as he
| is working long hours. It is his home PC that has this problem.
|
| Terry

There is NO DOS mode in WinXP. There is a Command Prompt. I don't think it makes a
difference but he'll get better feedback if the command line is executed within a Command
Prompt.

An alternate to the EXPAND.EXE command is the EXTRACT.EXE command...

extract D:\i386\WININET.DL_ %windir%\system32\WININET.DLL

 

[Guest]

Worst come to worse he can repair install WinXP from his main CD. He will
need his Serial number and original Windows CD.

The best thing is to do a complete clean install but he should make sure he
backed up his own data and that he has other information such as ISP details,
POP3/SMTP etc etc. Serial numbers are also required for everything.

Also, he will need CDs for application packages such as Office etc.

hth

 

[David H. Lipman]

From: "GTS" <x>

| There are several current malware items which infect Wininet.dll (including
| PSGuard and Smitfraud Trojan) and can be difficult to remove. You are
| likely to find that if you do replace this file it is promptly reinfected
| and removed again due to active parasites. (I recently serviced a machine
| doing exactly that). Note that antivirus programs may detect and delete
| the infected file while being completely unaware of the active parasite
| causing the problem. David's advice is one good way to try to replace it.
| I replaced it successfully by copying it from another XP machine at the same
| service pack level.
|
| Your son should run (at least) the following 3 programs preferably in Safe
| Mode.
| Ad-Aware - http://www.lavasoftusa.com
| Spybot - http://www.safer-networking.org/
| CWShredder - http://www.spywareinfo.com/~merijn/downloads.html

CWShredder does not target anything but Cool Web Search variants. Ad-ware SE v1.06 and
SpyBot S&D v1.4 have new signatures for the SmitFraud.C Trojan and the various associated
malware.

The SmitFraud Trojan and the W32/Alemod virus --
http://vil.nai.com/vil/content/v_134451.htm overwrite WININET.DLL with a copy of the
infectors own DLL.

The following tool will clean the SmitFraud Trojan and the W32/Alemod virus (and *many*
other infectors) but will NOT replace the WININET.DLL file with a good version

Download SmitFraud.exe from the URL --
http://www.ik-cs.com/programs/virtools/SmitFraud.exe

Execute; SmitFraud.exe { Note: You must accept the default of C:\McAfee }
Choose; Unzip
Choose; Close

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to enable WGET.EXE to download the needed McAfee related files.

Execute; c:\mcafee\clean.bat
{ or Double-click on 'Clean Link' in c:\mcafee }

A final report in HTML format called C:\mcafee\ScanReport.HTML will be generated. At the
end of the scan, it will be displayed in your browser (Opera, FireFox or Internet Explorer).
It is suggested that you move the report out of c:\mcafee before performing another scan.
It would be a good idea to scan in Safe Mode and in Normal Mode and save a copy of the HTML
report for each session.

 

[Terry]

GTS
Thanks...forwarded to my Son.

Terry

There are several current malware items which infect Wininet.dll (including
PSGuard and Smitfraud Trojan) and can be difficult to remove. You are
likely to find that if you do replace this file it is promptly reinfected
and removed again due to active parasites. (I recently serviced a machine
doing exactly that). Note that antivirus programs may detect and delete
the infected file while being completely unaware of the active parasite
causing the problem. David's advice is one good way to try to replace it.
I replaced it successfully by copying it from another XP machine at the same
service pack level.

Your son should run (at least) the following 3 programs preferably in Safe
Mode.
Ad-Aware - http://www.lavasoftusa.com
Spybot - http://www.safer-networking.org/
CWShredder - http://www.spywareinfo.com/~merijn/downloads.html

 

[Terry]

David
Appreciated...I have forwarded to my son.

Important point to mention to this group is that I have now found out when
he tried "system restore" ...that failed due to "missing Wininet.dll file"

Terry

 

[GTS]

You're welcome.
--

GTS
Thanks...forwarded to my Son.

Terry

 

[GTS]

Terry - Be careful re. System Restore. It is likely to be infected if the
Trojans I suspect are present. When your son is very certain that the
machine is clean, system restore should be disabled and then reenabled to
clean it.
--

 

[Kelly]

Calm down. First thing to do is reinstall the programs looking for the
..dll. Other than that:
http://www.dll-files.com/dllindex/dll-files.shtml?wininet

--

All the Best,
Kelly (MS-MVP/DTS&XP)

Troubleshooting Windows XP
http://www.kellys-korner-xp.com