I found this file on my PC infected with a virus, and since Norton AntiVirus couldn’t fix it, I deleted it. Possibly a bad move, but what the hell. Anyway, everytime I start Windows I get a message saying that it couldn’t find this file. A search on Google (and GoogleGroups) reveals nothing. Is there any way to find out what this file is or at least what application is calling it?
I couldn’t find it either, which makes me guess that it was probably being called by whatever it was you deleted. Before we can tell you how to find out what is calling that, it would be helpful to know what version of Windows you are running.
DancingFool
OK, as it turns out I made a mistake and the file is actually “dfwfntl.dll”. However this doesn’t return anything on Google either. I am running Win 2000. And just to clarify, dfwfntl.dll was the file I deleted, I am trying to find out what program is calling it.
I am no computer expert, but I think I saw this myself. I THINK it is a “BHO” realted to “CoolWebsearch” which hijacks your home page.
If you can’t find it on Google, then it’s a random filename. No legitimate program uses random filenames – they solely used by viruses and spyware.
Random .dll’s are usually connected with BHO (Browser Help Object) spyware. CoolWebSearch is one of the most common, but AFAIK, it doesn’t yet use random names (though you never can state anything definitive about CWS, since it changes daily). I see that the Corefloo-C Virus uses a random filename with a .dll extension, but I can’t say if it is that.
If you’ve just deleted the .dll, get a copy of hijackthis and run it to see what HKLU entry refers to the file; that will give more information.