Extracting .cab I.E. files

[nuffsed]

Hi Folks

I've had a trojan (Troj/Agent-BN) that I think is gone now..But I cannot log-in to hotmail, or access any sites where my hotmail address is registered. I also cannot upload to ebay via TurboLister.

Mozella is not affected but I am advised by ebay staff that I have a corrupt Internet Explorer .cab file i.e. "Imagehlp.dll".

It seems I need to extract a .cab file from somewhere and replace the installed corrupted version.

I use XP SP2....

Can anyone give me a link to information that is not too complex? My head just goes numb when faced with gobbledygook lol.

Cheers nuff :(

[Scarecrow Man]

The correct way is,

extract filename.cab /a C:\WINDOWS\SYSTEM32\Imagehlp.dll

You would replace filename.cab with the actual name of the .cab file it is located in. I do not know which one it is located in, but if you or someone else can find out where, you can use that syntax.

but you may want to take a look at this link first.

http://support.microsoft.com/?kbid=194177

Also, I found a copy of this file in C:\WINDOWS\ServicePackFiles\i386.

You can try this:

copy C:\WINDOWS\ServicePackFiles\i386\magehlp.dll C:\WINDOWS\SYSTEM32\

you can type these commands into the start menu and it will complete the task.

[nuffsed]

Hi Scarecrowman...

I had to try your "Run Copy" but XP wouldnt recognise"Copy".. :) However I have to go back to the drawing board, having discovered that Troj/Agent-BN has been stopping my spyware progs from updating...I have had to uninstall Spyware Blaster, Spybot S&D, XoftSpy. I have been able to reinstall XoftSpy via Mozilla and it has autoupdated twice since installation 18 hrs ago...AVG has also auto-updated.

After hours of experiments and scanning with XoftSpy..I now seem to be able to get repeated clean XoftSpy scans , so long as I don't enter "search-soft.net" (Troj/Agent-BN associated site) into Internet Explorer Blocked sites!!...Then XoftSpy finds and "removes" the bug, and the search-soft.net entry placed in I.E. Blocked sites dissappears.!

Short of ideas now....

Time for a break! :)

nuff 4 now :)

[Scarecrow Man]

OK. Go to Start > Run and type

cmd

at the prompt type,

copy C:\WINDOWS\ServicePackFiles\i386\imagehlp.dll C:\WINDOWS\SYSTEM32\

If you believe your computer has a virus, reboot in safe mode with networking, and go to TrendMicro Housecall. Do a scan and tell us what you find.

I would also like you to try this and let us know how this goes.

[nuffsed]

Oh dear...the trials of a novice lol..

It just so happens that the Tro/Agent-BN turned up around the same time as I downloaded the latest Priority MSN update.

I wrote to MSN immediately, regarding my inability to log on to MSN or any site where my hotmail was registered.

I then became obsessed with removing Troj/Agent.

I forgot all about my mail to MSN, as they didn't reply for a week.

All my security software...Spyware Blaster, Spybot S&D, XoftSpy, AVG were unknown to me, failing to update.

XoftSpy were sending mails with sugestions, including deleting registry entries, (beyond me)...XoftSpy cure

Remove these registry keys:

Troj/Agent-BN registry key Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\search-soft.net

Troj/Agent-BN registry key Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\63.219.181.7

....and even ebay got into the act, telling me I had a corrupted Imagehlp.dll file.

I also kept getting a warning from SpySweeper that my Browser may have been highjacked.

Certain programs seemed to be triggering the reappearance of the Trojan...these I one by one tracked down by doing hours of scanning. Each one uninstalled and cleared I.E. temp files and System restore.

I had just read your latest message , when I recieved a reply from MSN......

1. Click ‘Start ‘ then ‘Run’

2. Type ‘regsvr32 softpub.dll initpki.dll wintrust.dll’ (without apostrophes) and click ‘OK’

a. Click ‘OK’ to the message stating that the .dll files have been registered

b. Click ‘OK’ to the message stating that the .dll files have been registered

c. Click ‘OK’ to the message stating that the .dll files have been registered

regsvr32 softpub.dll initpki.dll wintrust.dll

NEXT:

Please flush the DNS as well

1. Click 'Start', and then click 'Run'

2. In the 'Open' box, type 'ipconfig /flushdns' (without the apostrophes), and then click ‘OK'

BINGO!!!! all sorted.... happy bunny...but several pounds lighter from confused stress lol

Sincere thanks for your efforts...I only hope someone finds this tale useful.

If I enter search-soft.net into I.E. Blocked zone, XoftSpy reports Troj/Agent present and "removes" it...I look into I.E. Blocked sites and the entry is deleted.

So now XoftSpy appears just to be reporting the "Blocked" entry, as a Trojan!

But all seems well.

Best wishes and thanks again.

nuffsed :)