Norton deleted System32.dll!!

[Joe Reikket]

I scanned for viruses and Norton 2004 found one one
attached to theSystem32.exe file - i selected fix - but it
completely wiped out the file.

I restarted an safe mode and said the file was missing -

Thus i have to repair it.

Does anyone know what directory on the windows CD
system32.exe is?

I think i need to open up command.com and type copy
d:\direcorty\system32.exe c:\WINDOWS\System32.dll

Can anyone help me out? Will copying the system3s.exe file
from my cd fix the problem?

Thanks,

Joe

 

[Carey Frisch [MVP]]

"System32.exe" is a VIRUS file!

Remove remnants of KWBot.Worm from the Registry and File System
http://www.dougknox.com/xp/scripts_desc/xp_clean_kwbot.htm

Note: You'll have to disable your antivirus program before running the repair.

[Courtesy of MS-MVP Doug Knox]


--
Carey Frisch
Microsoft MVP
Windows XP - Shell

----------------------------------------------------------------------------


| I scanned for viruses and Norton 2004 found one one
| attached to theSystem32.exe file - i selected fix - but it
| completely wiped out the file.
|
| I restarted an safe mode and said the file was missing -
|
| Thus i have to repair it.
|
| Does anyone know what directory on the windows CD
| system32.exe is?
|
| I think i need to open up command.com and type copy
| d:\direcorty\system32.exe c:\WINDOWS\System32.dll
|
| Can anyone help me out? Will copying the system3s.exe file
| from my cd fix the problem?
|
| Thanks,
|
| Joe

 

[Doug Knox MS-MVP]

System32.exe is not a windows file. The command to run it is a left over
remnant from a virus.

http://securityresponse.symantec.com/avcenter/venc/data/w32.kwbot.c.worm.html

For automated removal of the remnants of this virus, see www.dougknox.com,
Win XP Fixes, Clean KWBot.Worm Registry Entries.

 

[Joe Reikket]

thanks guys - its all fixed up with no errors - you daved
my life!!

 

[Bruce Chambers]

Greetings --

You really don't want to get that file back. It's part of several
well-known viruses/worms. It is *not* a valid Windows file. Pay
particular attention to _all_ of the removal instructions:

W32.Kwbot.C.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.kwbot.c.worm.html

Additionally, MS-MVP Doug Knox has kindly scripted a tool that
should help:
http://www.dougknox.com/xp/scripts_desc/xp_clean_kwbot.htm


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH