wsock32.dll non-extract

[SWCS]

This computer was hit by W95.Hybris.worm. Norton IS cleaned it out. Can dial up on modem, shows that it's connected to the Internet, but can't access any web sites. This worm corrupts wsock32.dll. Have tried to extract a clean copy, but I get this message: "Could not extract the current file. The process cannot access the file because it is being used by another process." Any ideas?

SWCS

[Paul Komski]

If you had the worm you also have (or had) w95.hybris.gen (http://securityresponse.symantec.com/avcenter/venc/data/w95.hybris.gen.html) which page also gives intructions on how to replace the wsock

[pcwiz]

Also, you could try WinsockXPFix if you have Windows 2000 or XP.(http://www.spychecker.com/program/winsockxpfix.html). It worked for me after spyware corrupted the winsock registry stuff.

[SWCS]

If you had the worm you also have (or had) w95.hybris.gen (http://securityresponse.symantec.com/avcenter/venc/data/w95.hybris.gen.html) which page also gives intructions on how to replace the wsock

I checked out the w95.hybris.gen info in the last couple of days. Most of it applied to Windows 95 and 98, if I'm correct. What is this thing about a "spiral"? I followed the instructions on wsock32.dll replacement, but something is using the .dll. Therefore, I can't replace it.

[SWCS]

pcwiz,

The computer is running Windows ME. I've tried the self-extraction file, winsockme.exe, but the process using wsock32.dll blocks it.

SWCS

[Paul Komski]

Have you tried deleting the file in safe mode first. Then just copy and paste the previously extracted copy (say onto a floppy) into position.

The spiral is a graphic placed on the desktop by a plugin.

WinME is very similar to the way Win95 and Win98 are affected; and it stores the wsock32.dll in the same precopy1.cab file on the installation CD.

[Paul Komski]

To save you the trouble, the attached zip file contains the wsock32.dll from my installation disk for WinME.

[SWCS]

Paul,

Thanks for the zip file. I have tried the extraction method through msconfig, the self-extraction file, and the copy/paste method in Safe Mode, but it just won't take. Something is using the file - "Cannot dlete WSOCK32. The specified file is being used by Windows."

SWCS

Edit: I just noted in the properties that this file was created yesterday. So I did another extraction, and it created a new wsock32.dll file today. So, if the wsock32.dll is new and clean, why can this computer connect to the Internet but can't navigate on the Internet? Is it the other winsock.dll? Or what is going on?

[Paul Komski]

Windows explorer itself can be the culprit that is "opening a file". So having booted to safe mode dont open anything but type cmd in the run box. Then navigate to the relevant directory and try deleting the file from there. If, by any chance, that doesnt work you will need to boot to a boot floppy diskette and once again navigate to the folder and delete the file from there.

Post back if you are unsure of how to navigate and delete files in DOS.

Once connected can you use any internet aware application such as a mail client, messaging service, etc - or is the problem only with accessing web pages?

[SWCS]

Paul,

I was able to extract both the wsock32.dll and winsock.dll successfully through safe mode through msconfig. I verified that through Windows Explorer in the file properties of each .dll. - new file created today. But the problem still exists.

I am able to connect to the Internet, but cannot navigate by putting in a URL. I discovered that I can navigate by IP address. DNS settings are all okay. I uninstalled Norton IS because that firewall could be corrupt or the program itself may be interfering, but that did no good. I've tried IE and Firefox, but neither work.

Any ideas? Or should I close this thread and open one in the Internet forum?

SWCS

[SWCS]

Paul,

I just did a Windows ME restore installation. It didn't help.

SWCS

[Paul Komski]

Clean installation? and if "I discovered that I can navigate by IP address" is still the case would indicate likey problems with your ISP's DNS server. Can you ping the server? The address(es) can be found if you run winipcfg from the run box.

[SWCS]

Paul,

I did a restore installation. I did not wipe the HD and do a clean install.

I can navigate by IP address, but the computer cannot navigate by URL in either of two ISPs that I've tried.

I can ping the server using the IP address but not the URL.

SWCS

[Paul Komski]

Not sure I know what you mean by a restore installation.

Some things worth consideration:
Manually enter your DNS server information into your network internet settings.
Remove TCP/IP and your DUN and then reinstall both of them.
Check your hosts file.

Also read http://www.tek-tips.com/faqs.cfm?pid=779&fid=4625 (although mainly winxp orientated) which has a few ideas to consider.

Which ISP are you connecting to and how.

[SWCS]

What I call a restore installation is a WIN ME installation without erasing the programs and files on the computer. Some call it a repair. The WIN ME disk notes that I have an OS already on the computer, so it just installs over that OS without touching the programs and files.

I have attempted to connect to www.charter.net (via cable) and www.mwt.net (via dial-up). Have worked with both ISP help desks to no resolution.

I'll try the things you suggested on Mon. Thanks for the link.

SWCS

[SWCS]

Paul,

Bingo! The WinsockXP Fix worked! Thank you so very much.

What can I do in return?

SWCS

[Paul Komski]

What can I do in return?
he he - pray it doesnt happen again.

BTW - which specific thing did the trick please?

[SWCS]

The WinsockXP Fix did the trick! When I ran it, it recognized the Windows ME and ran a fix on all the appropriate parts of the connectivity. I notified the ISP help desk of this neat little program, thanks to you.

Pray? I was praying for you through this.

SWCS