problem: wininet.dll & shlwapi.dll

Infantile SG

hi guys,
i need some help here..
my AVG found my wininet.dll was infected with virus and it recommended me
to quarantine and del away the file..
then i try finding the file but to no avail.

so i replace it with the same wininet.dll from my laptop.
now i try to open normal application but cannot except my firefox
and AVG.. as for the rest the prompt said that
"The procedure entry point SHRegGetValueW cound not be located in the dynamic link library SHLWAPI.dill."

and i try replacing shlwapi.dll with the one i have in my laptop,
it said access denied, file in use.

hope you guys can help me out with this.. thanks..

ndmmxiaomayi SG

You can't remove wininet.dll because it's needed by Windows to work properly. This virus is very sneaky, I have to say, as it replaces the Windows copy of wininet.dll.

I'm afraid that I have to re-direct you to another website for professional help.

http://forum.malwareremoval.com/

By the way, did you update XP? As far as I know, users who have not updated XP will get this false positive from AVG.

If you've updated, please go to the forum and ask for professional help. I can't help more on this, and deleting the wrong files will result in reinstalling of XP.

Infantile SG

Originally posted by Infantile:
"The procedure entry point SHRegGetValueW cound not be located in the dynamic link library SHLWAPI.dill."
[/b]

thanks.. but i already replaced the wininet.dll file.. and now its
shlwapi.dll that is giving me the problem.. sayind the above quote..
do you have any idea on how to solve it? thanks..

ndmmxiaomayi SG

Replacing doesn't mean your system is clean. Monitor for a more few more days.

As for shlwapi.dll, it could be a virus is there and is using that file, that's why you can't replaced it.

Infantile SG

ok thanks.. i think i solved it..
i used my winXP cd and copy and paste both files(wininet.dl_ & shlwapi.dl_)
into my C:\windows\system32\
the current infected files wininet.dll and shlwapi.dll, i deleted them...
after that i rename the files i copied from my winXP cd to wininet.dll and shlwapi.dll..
and when i boot up in safe mode.. everything is working perfectly fine..
its weird.. can't use the wininet.dll from my laptop but can from the cd..
btw... i did everything in the system recovery console.. thats why i'm able to delete the shlwapi.dll..

btw.. thanks mayi for your help!

ndmmxiaomayi SG

Remember to update your XP, AVG gives false positive if XP is not updated. Wink