virus on wininet.dll - can't solve

September 22, 2005 at 06:40:40
Specs: xp professional, amd athlon 1400/ 256 ram

Hi,

I am running a windows xp professional os, and AVG identified a virus on C:\Windows\system32\wininet.dll. The virus found is W32/Nsag.

I moved the virus to the vault but upon a restart i got the following message: "the application failed to initiate properly. Click to terminate the program" This means none of the programs load on start-up and programs such as IE do not load - they produce the same message.

I have read many posts and downloaded smitRem.exe and ran it. It identified the problem with wininet.dll but then showed this message "A good copy of wininet.dll was not found" "Please consult your advisor to obtain a tool to determine more locations to look in".

I have left my PC in safe mode and would really be grateful of any help or advice people could offer.

I am stuck as to how to resolve this problem.

Many thanks


See More: virus on wininet.dll - cant solve

Report •


#1
September 22, 2005 at 09:14:01

Have you tried restoring the file from AVG's vault? Perhaps it was a false positive by AVG.

Report •

#2
September 22, 2005 at 11:29:34

Hi, I have tried that - but nothing changes, still get the virus message and cant load up programs.

Can you suggest anything else?

Many thanks


Report •

#3
September 22, 2005 at 12:09:01

You could use XP's repair using your XP CD. Have you checked in msconfig>startup to see if something similiar to your warning is listed? If it is, try disabling it and restart the computer to see if that solves the problem. Have you tried doing a system restore to point before the problem began? I know that you usually have to turn system restore off to get rid of a virus/trojan, but sometimes it works to use it.

Report •

Related Solutions

#4
September 22, 2005 at 12:28:17

Thanks for your help. I have tried to perform a system restore but that didn't help. I am going to try a repair using XP CD.

I still need to remove the virus itself as AVG did not finish that. Can you recomend something to remove that?


Report •

#5
September 22, 2005 at 13:55:18

I have seen a few AV softwares in the last few weeks report C:\Windows\system32\wininet.dll.

It is not a virus.

It is a legit windows file. Make the file exempt from being scanned in the exceptions.


Report •

#6
September 23, 2005 at 15:38:41

This may help?

# Find wininet.dll and rename it to wininet.dl
# Wait a few moments. A new, clean version of wininet.dll should appear
# Reboot the system and disinfect or delete the infected wininet.dl file

http://www.viruslist.com/en/viruses/encyclopedia?virusid=84462

Updating Windows to SP2 if you don't have it will restore a good wininet.dll file.



Report •

#7
September 24, 2005 at 04:13:31

I have had exactly the same problem, except even when i restore it from the vault i still cannot load by dialler program or any other program that uses the net (expect games and AVG!) since i now seem to be missing mspwl32.dll, netbios.dll and svrapi.dll. I expect that this can be fixed by downloading copies and then moving them into the systems folder?
Help much appreciated!

Report •

#8
September 25, 2005 at 17:08:27

wininet.dll is an essential Windows system file, however, some viruses replace this file with their own version so that they are very hard to detect. I just fixed one of these for a client this morning. You need to replace the file with a genuine copy. I used a copy from one of the other machines on the network but if you can't do that you should be able to find it in the i386 setup folder.
The fake version will create other virus/spyware files and put them in startup lists. Make sure you get rid of these too or you'll be back to square one.

Report •

#9
September 25, 2005 at 22:02:02

I encountered a similar problem with wininet.dll on a Windows XP Home system. Norton Antivirus 2005 reported the file was infected with W32_Desktophijack (that is the same infection as the one AVG reports as Win32/Nsag).

The system had an uninfected version of wininet.dll in c:\i386, but I was unable to delete the infected version or copy the uninfected one over it. The suggestion posted here to rename wininet.dll to wininet.dl worked, though. I was then able to reboot and remove wininet.dl.

Interestingly the file sizes and timestamps on the infected and uninfected copies matched, though they didn't have the same MD5 checksums.

I've posted my notes on what I found on the infected system at http://support.moonpoint.com/security/viruses/w32_desktophijack/wininet_rb091705.php where I've also posted the infected and uninfected versions of the file.


Report •

#10
September 26, 2005 at 09:59:38

Hi,

I had the same problem this past weekend.

I spent 9-12 hours on the subject and came to the conclusion that a few have posted above.

Anyway, just delete wininet.dll or rename it, and go to this site: http://www.dll-files.com/dllindex/dll-files.shtml?wininet

Download wininet.dll from there and paste it into the folder C:\Windows\System32\ and then restart your computer into the normal mode. The access denied error should be gone, and you will be able to access the Internet through Internet Explorer again.

I hope this helps,
Joey


Report •

#11
September 28, 2005 at 17:42:10

hey guys...i downloaded a new wininet.dll cuz i had the same problem but since i downloaded it my internet keeps cutting out...like my modem thing or whatever just starts flashing for abit then it goes back to normal,i wait a couple mins then it does it again...very fustraiting...it does this rarley when everything was good...does this have something to do with the prgram wininet.dll that i downloaded?or is it that my computer sucks...is there anything i can do to fix this problem?


i downloaded the wininet.dll from
http://www.dll-files.com/dllindex/dll-files.shtml?wininet
another poster put that in saying it worked for him so i did it...


Report •

#12
October 2, 2005 at 00:03:45

It is possible that other Windows System files may be damaged, to attempt a repair go to Start > Run and type cmd
After doing this enter the following two commands in this order, SFC /Purgecache followed by SFC /ScanNow
Performing these operations may take several minutes and will require your Windows XP install disc unless a copy of the i386 folder from an install disc is located on your hard disk (usually c:\i386).

If you are still having an issue at this point you may require to reregister certain dll libraries.
Go to Start and open the run box, in order to register the dll's we must use the following syntax

regsvr32 nameof.dll

Start off by entering the following into the run dialog - regsvr32 softpub.dll
Then register the following dll files by opening the run box again and typing regsvr32 and the name of the following files (one at a time).

Wintrust.dll, Initpki.dll, Dssenh.dll, Rsaenh.dll, Gpkcsp.dll, Sccbase.dll, Slbcsp.dll, Mssip32.dll, and Cryptdlg.dll.


Report •

#13
October 16, 2005 at 16:00:54

Hi there.

I have had the same problem with my computer. AVG kept reporting a "virus" to me - and i kept ignoring it, until one day i just thought, what the hell i'll go and delete it. Instead of deleting it through AVG however, i went straight to the file itself and deleted wininet.dll, not realising it was a vital windows component. Afterwards, obviously, a load of programs on my computer wouldn't work and i got the "application failed to initiate" message. in a panic, i searched on the net for the file and found it on the site mentioned above. downloaded it, and reinstalled, and everything is fine again.

Except MSN messenger. as soon as i got it all sorted, i opened msn and tried to sign in. However when i clicked on the 'sign in' button, it just indented and then nothing happened. I've tried removing MSN and then re-downloading and installing it about five times, and nothing has worked. I've tried a system restore, but for some reason I can't go to any date past October, and even then it's only the 16th (today) that i can access. I am currently using windows messenger, but it's getting really irritating and I want my normal msn back!

Does anyone have any ideas?


Report •

#14
October 17, 2005 at 20:04:13

I tried renaming wininet.dll and it wouldn't let me do it. A message pops up saying: "cannot rename wininet: access is denied.. make sure the disk is not full or write-protected and that the file is not currently in use"

Any advices? Thanks!!!



Report •

#15
October 18, 2005 at 11:59:40

I am a computer engineer and i had the same problem this afternoon. The way i solved it was ran avg to identify the virus, and where the file was. The thing is NSAG replaces the original wininet.dll with its own infected modified file which windows excepts. I ran regedit, did a search to find all locations of wininet.dll and deleted the registry entries. Rebooted windows xp and went into windows\system32 and deleted wininet.dll which windows allowed me to do as it did not to use the wininet.dll file. I then went to command prompt and explored the windows cd and expanded and copied the wininet.dll file back to windows\system32. Then i ran regsvr32_wininet.dll to tell windows to reuse the wininet.dll file and everything (touch wood) still works. Will monitor this pc, it may need wiping if the problems get any worse, though the problem is not apparent at the moment.

Report •


Ask Question