|
|
WMI.DLL file needs replacing
4:22 PM EST 3/10/05
On our NT 4.0 Webserver, there is a file that has been infected with the
backdoor.trojan. We run symantec Corporate 9.0. It detects the file but
can do nothing with it as it is in use. Can this file be replaced and if
so how? This server is also being used as an email server.
Thank you
|
|
|
|
|
|
Re: WMI.DLL file needs replacing
12:38 PM EST 3/14/05
as a reply to Janet Howard.
Thank you christiehill for the link to Symantec. I had already done what they said to. What I need to know now is if the wmi.dll file can actually be replaced and if it can how can it be replaced.
|
|
|
|
|
|
Re: WMI.DLL file needs replacing
1:20 PM EST 3/16/05
as a reply to Janet Howard.
I asked one of our Windows system administrators about this and he responded that he would try the following:
1. Set any Windows Management Instrumentation services that are running to "disabled", reboot, then replace the file, then start the services and set it/them for automatic again.
2. Boot into safe mode. Replace the file. Reboot back into regular mode.
3. Try updating the wmicore files using Microsoft's installer located here:
http://www.microsoft.com/downloads/details.aspx?FamilyID=afe41f46-e213-4cbf-9c5b-fbf236e0e875&DisplayLang=en
|
|
|
|
|
|
Re: WMI.DLL file needs replacing
11:40 AM EST 3/17/05
as a reply to Steve Roggenkamp.
Option 3. should work very well. With the smaller NT-only version wmint4.exe at http://www.microsoft.com/downloads/thankyou.aspx?FamilyID=c174cfb1-ef67-471d-9277-4c2b1014a31e&displaylang=en&Hash=H5S8RC5, and probably with the 95/98/NT version, there is an option to reinstall the core WMI components.
1. should work, if you can get a copy of the file from another installation.
About 2. though, unfortunately NT does not have a Safe Mode. If your NT is installed on a FAT partition, you can access its files with a DOS boot disk. If you have NTFS, the closest you can come is to boot from a Windows 2000 installation CD, if available, and use the Recovery Console on the NT files. Or you can temporarily place your NT drive in another computer with NT, 2000, or XP and replace the file there.
Franklin
|
|
|
|
