Member Avatar for sat27

Hi,

A couple of day ago, my norton anti virus alerted me that my comp had been infected by a trojan horse virus. It could not delete it but pointed me to in the director

C://windows/system 32/winlgs32.dll

Am unable to delete it manually.

I have windows XP service Pack 2, 256 MB RAM.

Have tried checking on the Net to find out what virus it is but can't find any winlgs32.dll . Can anyone help me with this? What is the name of the virus and how do I delete it.

  • 2 Contributors
  • 3 Replies
  • 135 Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by tayspen

Dani AI

Generated

Good outcome — the detection was removed and the thread shows the usual troubleshooting path. reported an antivirus alert that could not be deleted manually, and recommended using a removal utility plus a diagnostic log. That approach is sensible; the following checklist fills in the common follow‑up steps to make sure nothing was left behind.

  • Update the operating system and all security signatures before any further scans.
  • Run at least one full scan with a different, up‑to‑date on‑demand scanner as a second opinion.
  • Scan from a clean environment (safe mode or a bootable rescue USB) if any file resists removal while Windows is running.
  • Run an anti‑rootkit check and inspect drivers and services for unsigned or unfamiliar entries.
  • Review persistence points: startup entries, scheduled tasks, and installed drivers. Use a startup inspection utility to compare what should be present versus what is new or suspicious.

After those checks, take these practical steps. Clear old system restore points so a hidden copy of the malware cannot return, then create a new restore point once the machine is confirmed clean. Change all online passwords from a different, known‑clean device — assume credentials used on the infected system may be compromised. Back up important data, but scan backups before restoring them to the cleaned machine.

If the PC handled banking, email, or business credentials, treat it as potentially compromised: monitor accounts for unusual activity and consider a full operating system reinstall if any persistence or rootkit components are found. Keep any diagnostic logs produced during investigation; they help if a forensic review is needed later. Finally, if uncertainty remains, seek hands‑on help from a reputable technician rather than continuing by guesswork.

Recommended Answers

All 3 Replies

Member Avatar for tayspen

First download PocketKillBox

Download pocket killbox from http://www.thespykiller.co.uk/files/killbox.exe & put it on the desktop where you can find it easily.

Now Start killbox Copy the list of files below to the clipboard by selecting all of them with your mouse (Left click the start of the list and drag the mouse to the bottom of the list) and when they are all selected ( highlighted in blue) right click on any part of the blue area and say copy

In the Killbox, Go to the toolbar press file and select Paste from clipboard. The first file name will appear in the window and if the file exists it will appear in blue under that window then select standard file kill, press the red X button, say yes to the prompt and once the file deleted message comes up then press the red X again and continue to press untill the last file on the list appears in the window & it says deleted.

File list:

C:\windows\system 32\winlgs32.dll

-----------------------------------------------------------------------

That should take care of the file you said you could not delete. But there still is a chance you are still infected. If you want to make sure you are 100% clean. Please Download hijackThis. Extract it to its own folder. Then run it and select. Do system scan and save log. Post the contents of the log that pops up.

We will then work from there.

Member Avatar for sat27

Tks.

Before I tried your suggestion, I uninstalled Norton AV 2005 and set up Mcafee Virus scan 7.1. It detected and deleted the file.

Tks a lot anyway

Member Avatar for tayspen

Your welcome. Glad you got it all woked out :)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.