Security Basics mailing list archives

Has or does anyone know what this .dll is for?


From: "rels" <rels () infionline net>
Date: Sun, 15 Jun 2003 23:04:17 -0400

OS - Win98 SE, P-III, 450 MHz, 256 MBytes
Browser - Mozilla 1.2.1 (Other browsers are installed, but have not used
in awhile)
OE 5.0.2xxx email client
NAV
Spybot, Ad-aware 6.0

Howdie -

Recently while running Spybot, syswvnt.dll was detected on my home
system.  Spybot identified it as a resident .dll potentially from
Winvestigator keylogger product (line?).  Spybot could not delete it as
it was resident in memory at the time and possibly in use.  Properties
indicate it is 57,344 bytes in size.  Interesting enough, Ad-aware 6.0
did not detect this particular .dll.

I also ran iProcessView, msinfo32, and msconfig, but this particlular
.dll did not show up in any of them.

Anyway I shutdown, rebooted into DOS CLI mode and renamed syswvnt.dll to
syswvnt.old.  After having completed this, I rebooted my system.  It
came up fine; I could ran various applications seemingly without a
problem.  I then connected via dial-up connection to my ISP.  Again,
connection was no problem.  I then started my email client, OE
5.00.2xxx.  At this point, OE 5.0.2xxx had a problem not recognizing or
connecting to various POP3 accounts I have set up in it.  Keep in mind
... syswvnt.dll was not functioning at this time.

I looked at a few other things related to email client and could not
determine if anything else was amiss.  So ... I shut my system down,
renamed syswvnt.old back to syswvnt.dll and rebooted.  After it had
successfully rebooted, I connected to my ISP via dial-up, started my
email client and then attempted to POP (download) my emails from various
accounts.  LO AND BEHOLD ... all is good (said with tongue in cheek
here).

Have any of you perhaps happen to experience this sort of thing that I
have described?  Anyone recognize "syswvnt.dll", the name, at all?  It
would appear the possibility exists that some other baseline .dll may
have been replaced with syswvnt.dll (and its additional functionality
;>)).   Am attempting to establish what baseline is, so I can compare to
what I have.  Doing this by loading Win98 SE on another clean system and
taken the initial install data to compare to what I currently have on
this system.  My hope is that I will spot a filename (or two) that
exists on the initial install that doesn't exist on the other.

Thanks in advance for any comments, suggestions, questions, etc.

Rob E.




---------------------------------------------------------------------------
Evaluating SSL VPNs' Consider NEOTERIS, chosen as leader by top analysts!
The Gartner Group just put Neoteris in the top of its Magic Quadrant,
while InStat has confirmed Neoteris as the leader in marketshare.
     
Find out why, and see how you can get plug-n-play secure remote access in
about an hour, with no client, server changes, or ongoing maintenance.
          
Visit us at: http://www.neoteris.com/promos/sf-6-9.htm
----------------------------------------------------------------------------


Current thread: