I'm not sure how this got onto my computer since I am usually careful, but I noticed a significant slowdown in my computer and numerous security pop-ups from Norton, so I checked it out. Apparently a file named "avwapi32.dll" was copied into my \Windows\system32 folder, edow.exe into \Windows, VBounce into \Program Files, and a startup entry.
Winlogon.exe was constantly trying to contact sites like www.888.com and www.look2me.com, but nothing was done to it. I removed everything except avwapi32.dll because it was being used by a process. I tried in Safe Mode, but the same thing happened.
I think Winlogon is being tricked into using avwapi32.dll as an application extension, and since Winlogon can't be turned off, I can't delete avwapi32.dll! Is there any way to do this?
If your answer is to use a DOS boot disk with an NTFS reader and modifier, could you give some instructions or a link to a good way of doing that?
Winlogon.exe was constantly trying to contact sites like www.888.com and www.look2me.com, but nothing was done to it. I removed everything except avwapi32.dll because it was being used by a process. I tried in Safe Mode, but the same thing happened.
I think Winlogon is being tricked into using avwapi32.dll as an application extension, and since Winlogon can't be turned off, I can't delete avwapi32.dll! Is there any way to do this?
If your answer is to use a DOS boot disk with an NTFS reader and modifier, could you give some instructions or a link to a good way of doing that?