dont know whats going on (W98)

[mayton82]

I have recently noticed several diffrent things going on in my system, including new apps showing up. It seems that it is a virus that my scanner can't pick up, the virus prevents me from shuting down till my usb devices are unplugged. The virus also has infected run32dll.exe, which constantly tries to access the internet (thank god for zone alarm.) I also noticed a program in end task the last time my computer decided not to shut down that was called winoldap, I have no idea what program that is, all I know is my usb chain is completly unstable and several system files keep going corrupt (kernel32.dll,ole32.dll,user.exe,explorer.exe,and iexplorer.exe) after 4 hours of computer time I start to notice the computer errors. Thanks for your time, Mayton82

[tekk]

TIt could be a virus try downloading AVG anti-virus (www.grisoft.com) in my experience this will pick up most viruses other anti-virus miss, its not the best but good for unlikely viruses, if this doesnt pick anything up i can only think of one harsh thing to fix it (the dreaded format) and the file winoldap is to do with winamp so try uninstalling that before anything else

Goodluck

[mayton82]

Thanks for the help, but I dont have winamp and never had it. How could I have an active app that never existed and only shows up when my computer start to crash. Sounds more like a virus than an app. I rewrote kernel32.dll ole32.dll and explorer.exe in dos and have a batch file setup to re-write then during startup. Since I did that the problems are less often. Im using command anti-virus (www.commandcom.com) thanks Mayton82

[supered55]

Try the free virus scan in the left hand column, its a good un

[reghakr]

Run the online scan so you can determine a name.

Are you receiving these corrupt files error messages from running System File Checker? SFC cannot always be trusted.

Try renaming the winoa386.mod file in the c:\windows\system directory.

To re-install that file, Use Winzip or similar to extract a file named winoa386.new from the cab files on the original CD or
c:\windows\options\cabs if available. In Win98SE, the file is located in the c:\windows\options\cabs
\WIN98_51.CAB file. After extracting, rename the file to WINOA386.MOD and move it top the C:\WINDOWS\SYSTEM
directory.

go to Start>Run, type msconfig, click the startup tab and check here for unknown programs. Post back with the list.


reghakr

<P ID="edit"><FONT class="small">Edited by reghakr on 04/19/02 18:00.</FONT></P>

[mayton82]

Thanks for your help. Except SFC is not finding these three files corrupt, it thinks they are fine. Im going to try replaceing winoa386.mod in a day or two, next time my computer restarts. The reason I feel the computer has an unknown virus is the fact that an app (which another user has identified as a winamp app) was showing up as my computer crashed and I could not identify what applications it was, which according to bigalows pocket refrence my computer is acting like it either has a backdoor running (which zone alarm should catch unless it is running with aim, yahoo. or ie) or I have a polymorphic virus, which becomes visible as the computer crashes. Im a computer tech and im having this trouble I've never seen anything like this befor. I've setup a batch file to run at startup everytime to replace files that are most commonly to cause a crash, and all three are major system files. I have tried reinstalling the app that was mention to be the reason of the crash and sent detailed bug reports to every app that I have that always crashes my computer, all other techs seem to think its a virus because of the way it waits. After the batch file replaces the three main files the computer works fine for 4 or 5 days. Well thanks again for your time Mayton82

[Smitty]

Winoldap and Winoa386.mod errors:
http://www.greatis.com/regrun3download.htm#beta (http://www.computerhope.com/issues/ch000456.htm>http://www.computerhope.com/issues/ch000456.htm</a>

winoldap.exe
Remote)

cached page
http://216.239.35.100/search?q=cache:kJnu2difsWcC:www.security.nnov.ru/search/document.asp%3Fdocid%3D148+winoldap+%2Btrojan&hl=en (http://216.239.35.100/search?q=cache:hfxu7uf7XwYC:www.cai.com/virusinfo/encyclopedia/descriptions/j/jsoffensive.htm+winoldap+%2Btrojan&hl=en>http://216.239.35.100/search?q=cache:hfxu7uf7XwYC:www.cai.com/virusinfo/encyclopedia/descriptions/j/jsoffensive.htm+winoldap+%2Btrojan&hl=en</a>

cached)

Smitty

[mayton82]

Im now wondering what the win376.mod file does, can you give me some insight. Thanks Mayton82

[reghakr]

mayton82

It's the Non-Windows application component for 386 enhanced mode which means it handles all DOS applications.....exe, .com, .bat

For example, you can't use the MS-DOS Prompt if winoa386.mod is not there.

What program is telling you that files are corrupt?

Have you tried going to Start>Run, and type vcmui?

reghakr

<P ID="edit"><FONT class="small">Edited by reghakr on 04/20/02 12:26.</FONT></P>

[mayton82]

Yes I did try vcmui. I have no software conflicts at all that was the first thing I checked. The software I use the most, and consecuently causes the most errors is aol instant messenger(aim) and internet explorer(ie). AIM tends to corrupt kernel32.dll the most. I have considered uninstalling aim and trying to rewrite aim express and have it load everytime windows starts, but the express version has fewer options than the standared version. IE tends to corrupt kernel32.dll and explorer.exe the most but has been known to currupt user.exe to the point that I cant restart without extracting the file in dos and placing it back in the windows folder. I have IE6 and I had IE5.5 both versions caused this error. The hard drive itself is fine, I use spinrite due to the fact that it has repaired a dying drive once already and since then it still has the drive in good condition. So the software has won my attention, but AIM and IE are the only applications that cause errors, and only when both have been running for several days strait and neither company can anser the question. Both point me in the other directionand both suggest a possible virus infection. Ole32.dll has only been the cause of an error twice but I still mentioned it Thanks Mayton82