Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Unknown File In Winsock Lsp


  • This topic is locked This topic is locked
2 replies to this topic

#1 MrMikie

MrMikie

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:07:27 PM

Posted 01 January 2008 - 06:27 AM

This problem appears to be a common item. I did a scan with HiJack This v2.0.2. Of all the items detected, most all of which are okay on my computer. However, one item is questionable. The HJT log entry is "O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll". Nothing is being detected by any of the AV/AS, etc., softwares are detecting anything. Only HJT. The dll file NWPROVAU.DLL is valid and is required to run; part of the Windows OS. NWPROVAU.DLL is "client service for NetWare provider and authentication package DLL. And, I have the latest version of this dll file (v5.1.2600.3015) based on the last MS update to NetWare (MS06-066/KB923980). I did a scan with Spybot (v1.5.1.18) and nothing was detected. However, I did open the Winsock LSPs in Spybot and found this:
--- Spybot - Search & Destroy version: 1.5 (build: 20071005) ---
Namespace Provider 3: NWLink IPX/SPX/NetBIOS Compatible Transport Protocol
GUID: {E02DAAF0-7E9F-11CF-AE5A-00AA00A7112B}
Filename: %SystemRoot%\System32\nwprovau.dll
Description: Microsoft Windows NT/2k/XP Novell Netware name space provider
DB filename: %SystemRoot%\system32\nwprovau.dll
DB protocol: NWLink IPX/SPX/NetBIOS*

I did a scan of my registry for the CLSID/GUID and nothing was found for the CLSID/GUID. I did a Google seach for this CLSID/GUID and I didn't find anything that helped. I have been unable to determine what this CLSID/GUID is related to ... an application, whatever. I don't know if this is just a quirk with HJT or if there is, in fact, something amiss. I have run WinSock XP Fix (v1.2) and LSP Fix (v1.1) with nothing being detected or fixed. The problem still remains. My computer, from what I can tell so far, appears to be operating normally. Can anyone help please? Thanks.

BC AdBot (Login to Remove)

 


#2 SifuMike

SifuMike

    malware expert


  • Staff Emeritus
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:04:27 AM

Posted 07 January 2008 - 12:34 AM

However, one item is questionable. The HJT log entry is "O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll".




That file is valid and the log is fine. :thumbsup:

http://www.bleepingcomputer.com/startups/n....dll-13129.html
http://www.castlecops.com/lsp-255.html
If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#3 SifuMike

SifuMike

    malware expert


  • Staff Emeritus
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:04:27 AM

Posted 11 January 2008 - 11:02 PM

Since your problem appears to be resolved, this thread will now be closed. If you need this topic reopened, please contact me or a member of the HJT Team and we will reopen it for you. Include the address of this thread in your request. If you should have a new issue, please start a new topic. This applies only to the original topic starter. Everyone else please begin a New Topic.
If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users