Virus this morning - do I have a problem?

jamesg1213


Ad-Aware caught a Trojan for me this morning, but this machine has been unstable since. Just had a BSOD, and on boot-up I get this message;

'' winlogon.exe - unable to locate component.

X This application has failed to start because sfc.os.dll was not found. Re-installing the application may fix this problem ''

Any clues? I'm somewhat of a 'puter dunce I'm afraid..

SFC relates to the system virus checker but this startup entry could be a spoof and may have been introduced by the malware that has been removed by AdAware.

If you use CCleaner you will be able to remove any unwanted start-up entries you may have that were written by the malware thereby supressing the message.

Also this may help in the case of the sfc.os.dll

http://pcsupport.about.co...ound-missing-error.htm

Run a full virus check on the computer as well being as AdAware is only a spam/malware checker, not a full AV program.

jamesg1213


Thanks JB, that was quick! I'll run CCleaner, re-start, and see what happens.

Too quick, I hadn't finished...lol.

jamesg1213


Ha! I'm back, CCleaner didn't do the job, I'll check that link now, thanks. I run AVG and Malwarebytes in addition to AdAware, neither of them have found anything since this morning.

What windows version are you on?

Copy the spare sfc_os.dll file from the dllcache folder into system32 if you are on XP.  And you should be good to go.

It is common for malware to attack the Window File Protection mechanism of which sfc_os.dll is a part.

The trojan may have been spoofing this file when AdAware deleted it will have been unable to delete it during that session so would quarantine it until next reboot therefore Windows would not have detected it had gone missing and replaced it from the dllcache as it would if it had been accidentally deleted.

Therefore you'll have to copy it manually from the dllcache folder or if that one got zapped too then you'll have to locate it from your Windows CD.

Once you have it back again you can from a command prompt type SFC /scannow (have your Windows CD ready) and it will replace any nobbled system files with verified good ones.  Of course you can't do that until you have SFC working properly again with a good version of sfc_os.dll back in place.

You can try HiJackThis (downloadable free from CNET) but be careful with it. You can accidentally delete something important if you don't know what you are doing. If you know the exact name of what you want to get rid of though it should be easy. If not you can submit your log to the HiJack this forums and let the smart dudes there help you figure it out. Also if you haven't tried to remove it using the methods you have already described in safe mode, shut down, boot up in safe mode and try again. Sometimes that will get rid of particularly stubborn computer critters. Cheers.

Nope the sfc_os.dll is missing from system32 and the dllcache. I'll have a search for my disc, if not I'll take you up on that kind offer JB, thanks a lot for that.

Once you have the file I would run a boot time scan as well.  This should stop anything new appearing, fingers crossed.

jamesg1213


Just ran a search for the sfc_os.dll, and found one in C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e...whatever that is...should I copy this into the system32 folder?

As long as it of a reasonable date and prior to your infection.

As long as it of a reasonable date and prior to your infection.

Properties shows it originates from 2008 Wook, hopefully that's genuine.

Will do Cap'n Jon, you da man.

I've been here longer than that.

Oh, you're talking about that computer virus.

Never mind...

Crg


Virus...Trojan, it's all the same.

Except wearing a virus doesn't protect you against...  oh, never mind.

bapu

craigb

Crg


Virus...Trojan, it's all the same.

Except wearing a virus doesn't protect you against...  oh, never mind.

Me?

Wear a condominium 




I gotta hound dog

It is that Greg.

Just a footnote for them that's interested - Ad Aware was gradually crippling my PC, and I couldn't remove it, kept getting BSOD each time. Had to do a system restore in the end. Whether the Trojan forked up Ad Aware, or whether you should steer clear of their latest version, I dunno, but it's just taken me 3 hours to get the machine running again...