Unknow file in WinsockLSP (file is avlibrary.dll)

Hello bartolo327 and welcome to the forums here at WTT!

Regarding the file in question, are you familiar with this software?

Hide the IP

It's likely related to that or something similar. Ring any bells?

Yes. Kind of. Not to long ago I was looking at some "Hide your IP sites" and half heartedly tried to see how they would work. I guess I may have opened this particular site. What is it and what is I have done to myself? I googled it and it appears to be some sort of mal-ware. There isn't a whole lot of information on avlibrary.dll Do you see anything else? My computer is running slow and poorly. Thank you so much for responding so quickly.

Don't think it's "malicious". Did you install the program? A file isn't going to just show up on your machine by doing research or going to the web site.

Yes apparently I installed something. It said free software but it must have been free trial use. They want money for it and there is other Hide IP software for free. I thought I select remove program from the Control Panel and removed it. I still haven't used this or any other software like it yet. I just ran a search and found this: Hide the IP 1K shortcut in C:\documents and settings Hide the IP File folder in C:\ Program files In the program folder: options document in notepad 1K in the program folder: an Application Extension (.dll) 9K called SpOrder.dll

Is it in your programs list? You want to uninstall from there if so.

We are going to use HJT to create a list of your currently installed programs.1. Open HijackThis and click on the Config… button in the "Other stuff" section (lower right hand corner).
2. Click on the Misc Tools button.
3. Click on the Open Uninstall Manager… button.
4. Click on the Save list… button.
5. Save the file uninstall_list.txt to a convinient location. This should open Notepad with the list.
6. Please Copy and Paste the list into your next reply.

Here is the uninstall list. I don't see Hide the IP. I did see the folder in the search window. Now that I open the program files folder I do see the Hide the IP folder. I guess I am ready to uninstall it from there. Give the word. 1st Multiformat Converter and CD Ripper 5.9 Adobe AIR Adobe AIR Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Reader 8.1.4 Adobe Shockwave Player 11 AM-DeadLink 3.3 Apple Mobile Device Support Apple Software Update Audacity 1.2.6 AVG 8.5 BitTorrent 5.0.9 Bonjour CCleaner (remove only) CCScore Critical Update for Windows Media Player 11 (KB959772) CuteFTP Data Lifeguard Dogz 5 ESSBrwr ESSCDBK ESScore ESSgui ESSini ESSPCD ESSPDock ESSSONIC ESSTOOLS essvatgt Eusing Free Registry Cleaner EZ Vinyl Converter 2.0.0 by MixMeister FreeZip Google Earth Google Updater HijackThis 2.0.2 HOT ALBUM MYBOX Hotfix for Windows Internet Explorer 7 (KB947864) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB952287) iDump (Build: 28) IE Privacy Keeper iPod Updater 2004-08-06 iTunes J2SE Runtime Environment 5.0 Update 6 kgcbase Kodak EasyShare software Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB928366) Microsoft .NET Framework 2.0 Service Pack 1 Microsoft Age of Empires Gold Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Internationalized Domain Names Mitigation APIs Microsoft Money 2003 Microsoft Money 2003 System Pack Microsoft National Language Support Downlevel APIs Microsoft Office Excel Viewer 2003 Microsoft Office PowerPoint Viewer 2003 Microsoft Picture It! Photo 7.0 Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visual C++ 2005 Redistributable Microsoft Word 2002 Microsoft Works 2003 Setup Launcher Microsoft Works 7.0 Microsoft Works Suite Add-in for Microsoft Word MobileMe Control Panel Mozilla Firefox (3.0.8) MSN MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB954430) MusicBridge MySpaceIM NCH Toolbox Uninstall netbrdg OfotoXMI Picasa 2 PokerStars RealPlayer Realtek AC'97 Audio Rhapsody Player Engine Security Update for Windows Internet Explorer 7 (KB928090) Security Update for Windows Internet Explorer 7 (KB929969) Security Update for Windows Internet Explorer 7 (KB931768) Security Update for Windows Internet Explorer 7 (KB933566) Security Update for Windows Internet Explorer 7 (KB938127) Security Update for Windows Internet Explorer 7 (KB939653) Security Update for Windows Internet Explorer 7 (KB942615) Security Update for Windows Internet Explorer 7 (KB944533) Security Update for Windows Internet Explorer 7 (KB950759) Security Update for Windows Internet Explorer 7 (KB953838) Security Update for Windows Internet Explorer 7 (KB956390) Security Update for Windows Internet Explorer 7 (KB958215) Security Update for Windows Internet Explorer 7 (KB960714) Security Update for Windows Internet Explorer 7 (KB961260) Security Update for Windows Internet Explorer 7 (KB963027) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows Media Player 9 (KB917734) Security Update for Windows XP (KB913433) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB953839) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954459) Security Update for Windows XP (KB954600) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB957095) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB958690) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960715) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB961373) SFR SHASTA Shockwave skin0001 SKINXSDK Skype™ 3.8 Spybot - Search & Destroy staticcr Switch tooltips Typing Tutor 7 Update for Windows XP (KB951072-v2) Update for Windows XP (KB951978) Update for Windows XP (KB955839) Update for Windows XP (KB967715) VC 9.0 Runtime VC 9.0 Runtime Visual C++ 2008 x86 Runtime - (v9.0.30729) Visual C++ 2008 x86 Runtime - v9.0.30729.01 VPRINTOL Window Washer Windows Media Format 11 runtime Windows Media Format 11 runtime Windows Media Player 11 Windows Media Player 11 Windows XP Service Pack 3 WinRAR archiver WIRELESS YouTube Uploader for CASIO ZipGenius 6 (6.0.3.1140) ZoneAlarm Pro Zoo Vet

Now that I open the program files folder I do see the Hide the IP folder. I guess I am ready to uninstall it from there

Well, that won't really "uninstall" anything. It will just delete the folder and contents, which is fine. The 010 entry will likely remain. Wonder if it's part of this program?

IE Privacy Keeper

Whatever you do, don't use HijackThis to fix the 010, as that will likely break your network.

No. It is still in there.

I knew it would be. I knew that removing the Hide the IP folder would not remove it.

How do we even know there is a connection with Hide The IP? I don't think it is.

My research tells me it is. And the fact that you now said you had the folder in your programs folder confirms that no?

If you don't trust my ability you are free to get help elsewhere.

Can you find who made avlibrary.dll?

You can try right clicking on the file and select properties. Click on the version tab and see what information is given.

You could also upload the file to be scanned for viruses if you think it may be malicious.

Go to http://virusscan.jotti.org, click on Browse, and upload the following file for analysis:

C:\WINDOWS\SYSTEM32\avlibrary.dll

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.

If Jotti is too busy you can try these.

http://www.kaspersky.com/scanforvirus.html
http://www.virustotal.com/en/indexf.html

How do I get it out of WinsockLSP and why would a file be made to go in there? Is there a way to download or install Winsock and then delete the existing Winsock with the unknown file? Thanks. unsure.gif

Safest way is to have LSPFix remove the entry, then delete the file.

"My research tells me it is. And the fact that you now said you had the folder in your programs folder confirms that no?"

Of course you are right again, it was from Hide The IP.


"If you don't trust my ability you are free to get help elsewhere."

Oh no it's not like that Teacher. You are my Guru. My Budda. I can't make this trip without ya.

I did go to http://virusscan.jotti.org, and the others http://www.kaspersky.com/scanforvirus.html
http://www.virustotal.com/en/indexf.html They all report no virus. Thank you for showing those!

Now with LSPFix it has a caveat : I know what I am doing (or enjoy reinstalling my operating system)
Clearly I don't know what I'm doing, so you think it will be alright to delete the avlibrary.dll?

Thanks again.

Now with LSPFix it has a caveat : I know what I am doing (or enjoy reinstalling my operating system)
Clearly I don't know what I'm doing, so you think it will be alright to delete the avlibrary.dll?

Removing valid LSP's always makes me nervous. It's too bad it got left behind when you uninstalled the program. Removing it with LSPFix only removes the registry entry, not the file. So the file will need to be deleted also.

It's up to you. It's probably pretty safe to use LSPFix to "fix" it, then delete the file if all is well. If all is working well then you could leave it too. Up to you ultimately, but I'd remove it. To be really safe it couldn't hurt to have a full registry backup with ERUNT first though.

Backup Your Registry with ERUNT

* Please use the following link and scroll down to ERUNT and download it.
http://aumha.org/freeware/freeware.php
* For version with the Installer:
Use the setup program to install ERUNT on your computer
* For the zipped version:
Unzip all the files into a folder of your choice.

Click Erunt.exe to backup your registry to the folder of your choice.

Note: to restore your registry, go to the folder and start ERDNT.exe

Let me know how you make out.

Ok. I have downloaded ERUNT and have made a copy of the registry. Question: So with the LSPFix I move the AVLibrary.dll file from the left side KEEP window to the right side REMOVE window and click finish? Then I manually delete AVLibrary.dll from the windows folder? Baring anything bad happening that should probably do it, right? I know I am basically repeating what you said but I'm looking to be sure. Thanks.

I think you have it, yes.

Remove the file from the system32 folder though.

C:\WINDOWS\SYSTEM32\avlibrary.dll

If you have problems deleting then you may need to either do it in Safe Mode, or I can advise a tool to use. Let me know.

Alright another job well done. Thank you! I ran LSPFix and removed the file from WinsockLSP and then I was able to delete the file from the System32 folder. I don't think I really had a nasty there but having you show me what it is and how to get rid of it is really so satisfying and a real relief. Fantastic. OK I just downloaded Malwarebytes antimalware, ran a full scan, and it found 7-8 infections in the registry. I remove the infections. Why is it these do not show up with HiJackThis? Here is the Malwarebytes log: Malwarebytes' Anti-Malware 1.36 Database version: 2162 Windows 5.1.2600 Service Pack 3 5/21/2009 9:15:11 AM mbam-log-2009-05-21 (09-15-11).txt Scan type: Full Scan (C:\|) Objects scanned: 195374 Time elapsed: 1 hour(s), 12 minute(s), 12 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 8 Registry Values Infected: 0 Registry Data Items Infected: 1 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) Next I downloaded Dr. Webb Cureit and ran an express scan and nothing was found. I guess things should start to run better to some degree now.