Replacing system files.

[nfanrekurb]

command.exe and asappsrv.dll have been infected with som s*** and I need to replace them with the originals. Where do I find them on my windows cd?clamav_report_031206_161943.txt

[cluberti]

Actually, the best thing to do first is to make sure you're clean from infection - that way when you replace those files with good ones from the CD, there's no chance they'll get overwritten with infected versions again. Second, pop in your Windows product CD and run the command "sfc /scannow" - this will check all binaries that are protected on your machine, and replace anything that doesn't checksum with the original version.

The other thing that you can do, if that doesn't work, is find the compressed file on the Windows product CD in the i386 folder, and decmpress it (if compressed) and copy it over to the hard disk. I'd suggest doing this only if sfc doesn't work.

[neo]

Actually, the best thing to do first is to make sure you're clean from infection - that way when you replace those files with good ones from the CD, there's no chance they'll get overwritten with infected versions again. Second, pop in your Windows product CD and run the command "sfc /scannow" - this will check all binaries that are protected on your machine, and replace anything that doesn't checksum with the original version.

The other thing that you can do, if that doesn't work, is find the compressed file on the Windows product CD in the i386 folder, and decmpress it (if compressed) and copy it over to the hard disk. I'd suggest doing this only if sfc doesn't work.

Right use sfc /scannow and put XP original disc in drive

[TheFlash428]

The files should be found in the i386 folder on the XP CD, as compressed files--but I agree that ensuring the system is clean first and running sfc is the way to go.

[Camarade_Tux]

which command.exe ??

There's no such file : command.com, cmd.exe but no command.exe. You're getting fooled.

For asappsrv.dll, browse to its location, right-click on it, properties, version tab. What do you see ?

If there's no version tab, then that's not a microsoft file.

[cluberti]

That's the reason I recommended making sure the machine is clean, because neither asappsrv.dll (spyware) or command.exe (trojan/worm virus!!!) are Microsoft files. That machine is (very much so) not clean, so cleaning it and running sfc is the best way to start.

[nfanrekurb]

Note the system is XP home nor.

When I try to run this command with my dell xp home cd it demands I put in a nor pro sp2 cd, so I did but it just prompted me and said it was wrong cd. If there is no other ways of cleaning it I would like to just reinstall windows.

The two files in question was identified by windows as sytem files and was therefore not removed by clamwin. But when i saw the folder name I understood they where far from it. So I have removed these now, but i think the system I's far from clean.

Edited December 4, 2006 by nfanrekurb