Sophos

Sophos blogs

Disabled System File Check DLL

Category
Type
What to do
  • If you've received an alert for a blocked PUA or adware and decide that the application is not suitable for your workplace, then follow the instructions for removing PUAs.

Summary

 
Affected operating systems Windows
Protection available since 15 September 2006 00:18:42 (GMT)
Last updated 16 January 2009 13:19:11 (GMT)
Detected by Sophos Anti-Virus for Windows, version 7, and PureMessage for Microsoft Exchange.

More Information

Disabled System File Check DLLs are hacked versions of Microsoft dll files related to the system file checker.

Detection of these DLLs indictates that the system file checker has been disabled. Malware families, such as W32/Tilebot variants, are known to patch system file checker dll files in this way.

Some Windows pre-installation tools, such as nLite, are also known to modify these DLLs in certain configurations. Users of these tools may need to authorize the modified DLLs. Information on authorizing potentially unwanted applications can be found in support knowledgebase article 25866.

RSS|Atom
Get reports about the latest adware and potentially unwanted applications (PUAs) delivered to your computer