Ad-Aware caught a Trojan for me this morning, but this machine has been unstable since. Just had a BSOD, and on boot-up I get this message;

'' winlogon.exe - unable to locate component.

X This application has failed to start because sfc.os.dll was not found. Re-installing the application may fix this problem ''

Any clues? I'm somewhat of a 'puter dunce I'm afraid..

jamesg1213


Ad-Aware caught a Trojan for me this morning, but this machine has been unstable since. Just had a BSOD, and on boot-up I get this message;

'' winlogon.exe - unable to locate component.

X This application has failed to start because sfc.os.dll was not found. Re-installing the application may fix this problem ''

Any clues? I'm somewhat of a 'puter dunce I'm afraid..

SFC relates to the system virus checker but this startup entry could be a spoof and may have been introduced by the malware that has been removed by AdAware.

If you use CCleaner you will be able to remove any unwanted start-up entries you may have that were written by the malware thereby supressing the message.

Also this may help in the case of the sfc.os.dll

http://pcsupport.about.co...ound-missing-error.htm

Run a full virus check on the computer as well being as AdAware is only a spam/malware checker, not a full AV program.

Thanks JB, that was quick! I'll run CCleaner, re-start, and see what happens.

jamesg1213


Thanks JB, that was quick! I'll run CCleaner, re-start, and see what happens.

Too quick, I hadn't finished...lol.

Ha! I'm back, CCleaner didn't do the job, I'll check that link now, thanks. I run AVG and Malwarebytes in addition to AdAware, neither of them have found anything since this morning.

jamesg1213


Ha! I'm back, CCleaner didn't do the job, I'll check that link now, thanks. I run AVG and Malwarebytes in addition to AdAware, neither of them have found anything since this morning.

What windows version are you on?

Copy the spare sfc_os.dll file from the dllcache folder into system32 if you are on XP.  And you should be good to go.

Yep, XP SP 2 - yer a star JB, I'll try that next.

It is common for malware to attack the Window File Protection mechanism of which sfc_os.dll is a part.

The trojan may have been spoofing this file when AdAware deleted it will have been unable to delete it during that session so would quarantine it until next reboot therefore Windows would not have detected it had gone missing and replaced it from the dllcache as it would if it had been accidentally deleted.

Therefore you'll have to copy it manually from the dllcache folder or if that one got zapped too then you'll have to locate it from your Windows CD.

Once you have it back again you can from a command prompt type SFC /scannow (have your Windows CD ready) and it will replace any nobbled system files with verified good ones.  Of course you can't do that until you have SFC working properly again with a good version of sfc_os.dll back in place.

I've got a good one from my XP partition if you cannot locate one, only thing is my XP version is SP3

Drop me an email if you need it.

You can try HiJackThis (downloadable free from CNET) but be careful with it. You can accidentally delete something important if you don't know what you are doing. If you know the exact name of what you want to get rid of though it should be easy. If not you can submit your log to the HiJack this forums and let the smart dudes there help you figure it out. Also if you haven't tried to remove it using the methods you have already described in safe mode, shut down, boot up in safe mode and try again. Sometimes that will get rid of particularly stubborn computer critters. Cheers.