Win XP System File Protection

This is a discussion on Win XP System File Protection within the Tech Board forums, part of the Community Boards category; You can delete a system file in XP nothing will prevent you. But after a second or two the file ...

  1. #1
    System Novice siavoshkc's Avatar
    Join Date
    Jan 2006
    Location
    Tehran
    Posts
    1,231

    Question Win XP System File Protection

    You can delete a system file in XP nothing will prevent you. But after a second or two the file will be regenerated by Windows. Why its this way?
    I've installed Norton Anti Virus on my uncle's PC. It warns him each time it dials up for internet. It says IPv9.dll is infected and deleted automatically. But AV doesn't know that its a system file and will be regenerated by OS. The problem is that it seems that the regenerated file is also infected. What can I do with it?

    [Edit] The System Restore was disabled on his PC.
    Last edited by siavoshkc; 08-14-2007 at 08:37 AM.
    Learn C++ (C++ Books, C Books, FAQ, Forum Search)
    Code painter latest version on sourceforge DOWNLOAD NOW!
    Download FSB Data Integrity Tester.
    Siavosh K C

  2. #2
    Frequently Quite Prolix dwks's Avatar
    Join Date
    Apr 2005
    Location
    Canada
    Posts
    8,047
    So . . . are the "deleted" system files actually deleted and then re-created? I find it more likely that the "delete" command in Windows XP checks to see if the system attribute on a file is set, and if it is, aborts the deletion. Try booting up into DOS and deleting it.

    Or you could obtain an un-infected IPv9.dll from somewhere and try copying that over the existing file.

    Also consider the fact that antivirus programs can mess up, and flag an uninfected file as infected. If this is the case, it usually does it reproducably, and if your antivirus program is common (Norton is certainly very common!), then the manufacturer of the program which uses IPv9.dll is probably aware of this and may mention it on their website. If they do, then just ignore the warning. I'm sure you can configure Norton to ignore certain files when it does scans.

    Or . . . maybe a malware program is actually re-creating the file. I don't see why Windows would re-create a file, but a malware program certainly could.

    How could you detect this? I'd try replacing the file with a file of zero bytes. If it remains in place, then something is actually detecting when the file disappears and copying it back again. You could do this with something as simple as
    Code:
    #include <stdio.h>
    
    int main(void) {
        FILE *fp = fopen("IPv9.dll", "w");
        if(!fp) perror("Couldn't open dll");
        else fclose(fp);
    
        return 0;
    }
    If that program fails, then either the malware program is smart and it also examines the file size, or Windows is just preventing the file from being deleted in the first place.
    dwk

    Seek and ye shall find. quaere et invenies.

    "Simplicity does not precede complexity, but follows it." -- Alan Perlis
    "Testing can only prove the presence of bugs, not their absence." -- Edsger Dijkstra
    "The only real mistake is the one from which we learn nothing." -- John Powell


    Other boards: DaniWeb, TPS
    Unofficial Wiki FAQ: cpwiki.sf.net

    My website: http://dwks.theprogrammingsite.com/
    Projects: codeform, xuni, atlantis, nort, etc.

  3. #3
    System Novice siavoshkc's Avatar
    Join Date
    Jan 2006
    Location
    Tehran
    Posts
    1,231
    This is not malware that regenerates the file. Its Windows. I don't know how and why it is like this. You can go and delete Spider game executive to see it yourself. It does this to its all files.
    Learn C++ (C++ Books, C Books, FAQ, Forum Search)
    Code painter latest version on sourceforge DOWNLOAD NOW!
    Download FSB Data Integrity Tester.
    Siavosh K C

  4. #4
    Kernel hacker
    Join Date
    Jul 2007
    Location
    Farncombe, Surrey, England
    Posts
    15,677
    Yes, it's Windows File Protection - it covers a list of files that Windows keeps safe for you and restores when/if you delete them. It is, however, disabled in safe-mode, so if you really want to remove the file, try rebooting into safe mode, delete the file and reboot again, and it should be gone.

    --
    Mats

  5. #5
    Registered Abuser
    Join Date
    Jun 2006
    Location
    Toronto
    Posts
    591
    As far as I know, Windows File Protection works as DWK suggested, it will usually prompt you that the file is a system file and cannot be deleted, and will not delete it at all. If the file is being deleted and regenerated, that definately sounds more like a malware program (and yes it can infect anything, even spiders.exe).

  6. #6
    verbose cat
    Join Date
    Jun 2003
    Posts
    209
    It might be a good idea to pull up your task manager to see what processes are running, type each process (like svchost.exe) into google or yahoo or your search engine of choice and look over the responses you get. Most of them should come up as either Microsoft Windows processes for this or that, some might come up for QuickTime or JavaUpdate or your soundcard, video card, etc.

    If you find anything that turns out to be malware, you can probably also find information on how to get rid of it by looking through the search results.

    It might also be a good idea to run virus scans (there are free scans available via the web and in my experience some scanners will pick up things that others will miss), as well as a malware scanner like AdAware and Spybot S&D (these two are free). I haven't used Norton Anti-virus since it was installed from floppy discs and I have read lots of bad stuff about it, but then I'm sure I could find bad stuff about McAfee too.

    I use AVG and haven't had any problems with it thus far (couple years and counting).

    I had a problem "infection" a while back that used 3 processes that kept watch on each other and restarted any of them that I tried to End Task before I could get to the other two. The processes kept coming back with slightly different filenames too, so I couldn't just write a 0-byte .exe file to prevent it from running. It also had several files in the windows folders that would be regenerated if any of those processes were running... it was irritating and tenacious, and I admired it's beauty even as I slew it using Google and Safemode. :o)

    Your situation reminds me of that.
    abachler: "A great programmer never stops optimizing a piece of code until it consists of nothing but preprocessor directives and comments "

  7. #7
    System Novice siavoshkc's Avatar
    Join Date
    Jan 2006
    Location
    Tehran
    Posts
    1,231
    Thanks Mats.

    As far as I know, Windows File Protection works as DWK suggested, it will usually prompt you that the file is a system file and cannot be deleted, and will not delete it at all.
    Why don't you try it yourself? Windows warns you for a system file but deletes it.

    It might be a good idea to pull up your task manager to see what processes are running, type each process (like svchost.exe) into google or yahoo or your search engine of choice and look over the responses you get. Most of them should come up as either Microsoft Windows processes for this or that, some might come up for QuickTime or JavaUpdate or your soundcard, video card, etc.
    Its very easy for me to identify a malware in processes. But many malwares hide themselves or come as a system process.

    The infection of IPv9.dll is "infostealer" trojan that is not a severe threat.
    Learn C++ (C++ Books, C Books, FAQ, Forum Search)
    Code painter latest version on sourceforge DOWNLOAD NOW!
    Download FSB Data Integrity Tester.
    Siavosh K C

Popular pages Recent additions subscribe to a feed

Similar Threads

  1. File transfer- the file sometimes not full transferred
    By shu_fei86 in forum C# Programming
    Replies: 13
    Last Post: 03-13-2009, 12:44 PM
  2. Basic text file encoder
    By Abda92 in forum C Programming
    Replies: 15
    Last Post: 05-22-2007, 01:19 PM
  3. help with text input
    By Alphawaves in forum C Programming
    Replies: 8
    Last Post: 04-08-2007, 04:54 PM
  4. C++ std routines
    By siavoshkc in forum C++ Programming
    Replies: 33
    Last Post: 07-28-2006, 12:13 AM

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21