Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

duplicate .dll (8) files in system32


  • Please log in to reply
3 replies to this topic

#1 MexicanCutie

MexicanCutie

  • Members
  • 60 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Washington State
  • Local time:10:32 AM

Posted 17 December 2009 - 08:21 PM

Hi, my system32 folder has multiple duplicates of the same .dll file. Most of them have 8 duplicates. This is my 1st time looking in this file, so I'm not sure if that ok. My computer is a Dell Dimension 3000 and I have XP_Home Edition. As a side note I installed a 2nd HDD from my old Dell Dimension 2350. Maybe that is causing some of the problem. Thank you for your help.

MexicanCutie

Attached File  dll_probs.JPG   134.92KB   24 downloads

BC AdBot (Login to Remove)

 


#2 azfreetech

azfreetech

  • Members
  • 182 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Mesa, AZ
  • Local time:10:32 AM

Posted 19 December 2009 - 05:24 PM

Well the thing about DLLs is that different programs may each have their own version. WIth rootkit infections you may see what you are looking at because they insert their own DLLs and can even overwrite the system/program DLLs with their own nasty code.

I looked a little further in to this and researched some of the DLLs listed.

1. WOW32.dll - File that contains application programming interface (API) functions that allow 16-bit code to call 32-bit code.

2. WS2_32.dll - File that contains the Windows Sockets API used by most Internet and network applications.

3. ws2help.dll - listed on Threat Experts a mostly a threat

4. wscsvc.dll is a process belonging to Windows Security Center Service

5. wshext.dll - Microsoft Shell Extension for Windows Script Host

6. wshtcpip.dll - Windows Sockets Helper DLL

7. wsnmp32.dll - File that contains application programming interface (API) functions that allow SNMP manager applications to listen for SNMP manager requests and also send requests to and receive responses from SNMP agents. This is a needed file.

8. wsock32.dll - File that contains the Windows Sockets API used by most Internet and network applications to handle network connections.

9. wtsapi32.dll - File that contains application programming interface (API) functions that enable application programs to (1) manage terminal services, (2) set and retrieve user configuration information that is specific to terminal services, (3) use terminal services virtual channels, and more, in a terminal services environment.

10. wuauserv.dll - a process associated with Windows Update AutoUpdate Service from Microsoft Corporation.\r This file is part of wuauserv.dll is a process associated with Windows Update AutoUpdate Service from Microsoft Corporation.

11. wzcdlg.dll - a module relating to the Wireless Zero Configuration Service which is a part of the Microsoft Windows Operating System.

12. wzcsapi.dll - a process associated with Wireless Zero Configuration service API from Microsoft Corporation.

13. wzcsvc.dll - a module associated with Microsoft Windows Operating Systems from Microsoft Corporation.

So we can see that many of these appear to be valid but there are multiple instances of most of them. I would say take this and go over to the Am I Infected section and see what they have to say. You may have a rootkit infection.
DJ Digital Gem

I gave up on computers and now I just DJ!

#3 Stang777

Stang777

    Just Hoping To Help


  • Members
  • 1,821 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:11:32 AM

Posted 20 December 2009 - 02:52 AM

Just want to say that the ws2help.dll is a legit file. My system shows the description of that file to be Windows Socket 2 Helper for Windows NT, comes from Microsoft, was created on 8/23/01 and the size of the file is 20kb .

Even though I have all those files on my system, I only have ONE instance of each so I agree with the above post that your issue is probably related to infection and you should try to get help in the Am I Infected forum.

Btw, I doubt you installing that second hard drive has anything to do with the multiple files. I have installed a second hard drive from a different computer on several computers and never had that happen.

#4 hamluis

hamluis

    Moderator


  • Moderator
  • 56,565 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:11:32 AM

Posted 20 December 2009 - 10:42 AM

That graphic you posted...is pretty useless in determining what's going on, IMO.

The first thing that you need to determine...is whether those files are actual duplicates. To do so, you need to look at full filename (including extension), date created, date installed, and I would take a look at the Properties for any files which appear to be the same. In short, you need to compare them in a somewhat precise manner, IMO.

Details view is what I would use.

Louis




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users