|
wsock32.dll (5.1.2600.0)
Bevat in software |
|---|
| Naam: | Windows XP Home Edition, Deutsch |
|---|
| Vergunning: | commercieel |
|---|
| De verbinding van de informatie: | http://www.microsoft.com/windowsxp/ |
|---|
De details van het dossier |
|---|
| De weg van het dossier: | C:\WINDOWS\system32 \ wsock32.dll |
|---|
| De datum van het dossier: | 2002-08-29 14:00:00 |
|---|
| Versie: | 5.1.2600.0 |
|---|
| De grootte van het dossier: | 23.552 bytes |
|---|
De knoeiboel van de controlesom en van het dossier |
|---|
| CRC32: | 692BCCD3 |
|---|
| MD5: | 26F3 9A4B 55C7 DEEB D258 8F4E 9B63 3E83 |
|---|
| SHA1: | C758 9388 4760 9646 C1B9 BCDA ECFB D91B CF5D 65C1 |
|---|
Het middelinformatie van de versie |
|---|
| Firmanaam: | Microsoft Corporation |
|---|
| De beschrijving van het dossier: | Windows Socket-32-Bit-DLL |
|---|
| Het werkende systeem van het dossier: | Windows NT, Windows 2000, Windows XP, Windows 2003 |
|---|
| Het type van dossier: | Dynamic Link Library (DLL) |
|---|
| De versie van het dossier: | 5.1.2600.0 |
|---|
| Interne naam: | wsock32.dll |
|---|
| Wettelijk auteursrecht: | © Microsoft Corporation. Alle Rechte vorbehalten. |
|---|
| Originele filename: | wsock32.dll |
|---|
| De naam van het product: | Betriebssystem Microsoft® Windows® |
|---|
| De versie van het product: | 5.1.2600.0 |
|---|
wsock32.dll werd gevonden in de volgende rapporten:
|
|
|---|
W97M.Suppl.A / W95.Suppl.16384.A |
|---|
OngeveerW97M.Suppl.A / W95.Suppl.16384.A
...spreads a Microsoft Word 97 macro virus that hooks Winsock32 APIs, by replacing the Wsock32.dll system file. The payload overwrites the...
Technische details
...executed on the next Windows startup to delete the dropped Dll.lzh file, renames Wsock32.dll to Wsock33.dll in the %System% folder, and then renames the Dll.tmp to Wsock32.dll....
...All the other APIs are redirected to Wsock33.dll, which is the renamed Wsock32.dll file. Every time a user sends an...
De instructies van de verwijdering
...file can safely be deleted. The worm's .dll, the bad Wsock32.dll, is detected as W95.Suppl.16384.A....
...W97M.Suppl.A and W95.Suppl.16384.A. Restore the Wsock32.dll file. For specific details on each...
...computer in Safe Mode." 5. Restoring the Wsock32.dll file To restore the Wsock32.dll...
...show the Hidden and System files, then restore Wsock33.dll to its original name, Wsock32.dll. Configuring Windows to show...
...Renaming Wsock33.dll file back to Wsock32.dll Using Windows Explorer, navigate...
Bron: http://securityresponse.symantec.com/avcenter/venc/data/w97m.suppl.html |
|---|
Troj.Polyglot |
|---|
Technische details
...Upon the next system reboot, it will also rename the Wsock32.dll file to Nlhvld.dll and replace it with Proclib16.dll....
...Internet) connection activity. This Trojan hooks four WSOCK32 API functions: connect, recv, send, and closesocket....
De instructies van de verwijdering
...Restarting to MS-DOS mode ensures that Wsock32.dll is not loaded (Wsock32.dll is used for Internet connections)....
...the WindowsSystem folder. Type dir wsock32.dll to check the size of Wsock32.dll....
...replaced it with Proclib16.dll. To restore the original Wsock32.dll, type copy nlhvld.dll Wsock32.dll...
Bron: http://securityresponse.symantec.com/avcenter/venc/data/troj.polyglot.html |
|---|
W32.Notech |
|---|
OngeveerW97M.Suppl.A / W95.Suppl.16384.A
...W32.Notech is a worm component that is found in infected Wsock32.dll files placed in the same folder as Internet Explorer....
Technische details
...W32.Notech is found in infected Wsock32.dll files, where the worm intercepts all the send requests....
...This will delete the infected Wsock32.dll from the system on the next reboot....
Bron: http://securityresponse.symantec.com/avcenter/venc/data/w32.notech.html |
|---|
W32.Netlip.Worm |
|---|
Technische details
...It also copies: C:\%System%WSOCK32.DLL to...
...C:\%system%Wsock32.old C:\%windir%Wsock32.dll NOTES:...
...Then it modifies C:\%windir%Wsock32.dll by hooking the send() function of Wsock32.dll As a result, the worm's hooked routine...
...[Rename] NUL=C:WINDOWSSYSTEMWSOCK32.dll C:WINDOWSSYSTEMWSOCK32.dll=C:WINDOWSWSOCK32.dll...
...As a result, the next time that you start Windows, C:\%system%Wsock32.dll is replaced with C:\%windir%Wsock32.dll...
De instructies van de verwijdering
... NUL=C:WINDOWSSYSTEMWSOCK32.dll C:WINDOWSSYSTEMWSOCK32.dll=C:WINDOWSWSOCK32.dll...
...[Rename] NUL=C:WINDOWSSYSTEMWSOCK32.dll C:WINDOWSSYSTEMWSOCK32.dll=C:WINDOWSWSOCK32.dll...
Bron: http://securityresponse.symantec.com/avcenter/venc/data/w32.netlip.worm.html |
|---|
Happy99.Worm Removal Tool |
|---|
OngeveerW97M.Suppl.A / W95.Suppl.16384.A
...is designed to safely remove Happy99.Worm (a.k.a. W32.Ska) files and restore the WSOCK32.DLL in Windows systems. FIXHAPPY accomplishes the...
...installs itself to the system. Restores WSOCK32.DLL. Happy99.Worm modifies WSOCK32.DLL...
...Happy99.Worm adds this Windows Registry entry if WSOCK32.DLL is in use when the worm attempts to modify it (i.e. a user is online or connected...
...is displayed if the tools successfully removed SKA.EXE, SKA.DLL files and restore WSOCK32.DLL file. Although the FIXHAPPY.EXE...
Bron: http://securityresponse.symantec.com/avcenter/venc/data/fix.happy99.worm.html |
|---|
PHP.Sysbat |
|---|
OngeveerW97M.Suppl.A / W95.Suppl.16384.A
...Finally, the Trojan tries to delete C:WindowsSystemWsock32.dll. Type: Trojan Horse...
De beoordeling van de bedreiging
...Deletes files: C:WindowsSystemWsock32.dll Modifies files:...
Technische details
...It then attempts to delete the C:WindowsSystemWsock32.dll file. Finally, the Trojan displays...
De instructies van de verwijdering
...were infected by the Trojan. Replace the Wsock32.dll file, if necessary. Write-up by:...
Bron: http://securityresponse.symantec.com/avcenter/venc/data/php.sysbat.html |
|---|
W95.Hybris.gen |
|---|
Technische details
...When the worm attachment is executed, the Wsock32.dll file is modified or replaced....
...Once the worm has infected wsock32.dll, it has the ability to monitor the Internet connection as well as incoming and outgoing...
...the temporary executable. In this way, Wsock32.dll is infected with the actual worm body....
...difficult but possible to repair. If Wsock32.dll is being used by the system, the worm cannot modify it....
...The worm hooks onto the following exports of Wsock32.dll: send()...
De instructies van de verwijdering
...detected, do the following: When Wsock32.dll is detected as infected, choose Repair....
...NOTE: If NAV cannot repair Wsock32.dll when Windows is in normal mode, then try to repair it in Safe Mode.This is particularly...
...To extract a new copy of the Wsock32.dll file: This is necessary only if...
...Windows 2000/XP, because these systems' File Protection feature should prevent the Wsock32.dll file from being overwritten (unless File Protection was disabled)....
...extract /a d:win98precopy1.cab wsock32.dll /L c:windowssystem If Windows is installed in...
...extract /a x:win98precopy1.cab wsock32.dll /L c:windowssystem If you are using Windows 95,...
...extract /a x:win95win95_02.cab wsock32.dll /L c:windowssystem If you see an error message...
Bron: http://securityresponse.symantec.com/avcenter/venc/data/w32.hybris.gen.html |
|---|
W95.MTX Fix Tool |
|---|
OngeveerW97M.Suppl.A / W95.Suppl.16384.A
...W95.MTX Fix Tool repairs the Wsock32.dll by removing the virus code....
...If Wsock32.dll is in use at that time, the tool makes a copy of Wsock32.dll and this copy is repaired....
...When the computer is restarted, the Wsock32.dll will be replaced with the clean copy....
Bron: http://securityresponse.symantec.com/avcenter/venc/data/w95.mtx.fix.tool.html |
|---|
W95.Babylonia |
|---|
Technische details
...similar to the W95.CIH virus. Wsock32.dll modifications Another very important detail...
...The virus adds a very short hook routine to the "Send" API of Wsock32.dll similar to the Happy99 worm....
Bron: http://securityresponse.symantec.com/avcenter/venc/data/w95.babylonia.html |
|---|
W32.Icecubes.Worm.B |
|---|
Technische details
...the worm does the following: Creates a copy of Wsock32.dll and names this copy Wsock32.inf....
...Appends part of its code to the last section of Wsock32.inf, and hooks into the send() export function....
...Creates a file named Wininit.ini, which causes Windows to replace Wsock32.dll with the modified Wsock32.inf file after the computer is restarted....
......
Bron: http://securityresponse.symantec.com/avcenter/venc/data/w32.icecubes.worm.b.html |
|---|
|
|
![[filename.info logo]](/img/logo.png){kind=logo}
![[cn wsock32.dll]](/img/nix.gif){kind=small}
