# What is dfwntl.dll?

**URL:** <https://boards.straightdope.com/t/what-is-dfwntl-dll/241572>\
**Category:** Factual Questions\
**Created:** [April 23, 2004, 3:57am UTC](https://boards.straightdope.com/t/what-is-dfwntl-dll/241572 "2004-04-23T03:57:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Fang](https://avatars.discourse-cdn.com/v4/letter/f/96bed5/32.png) [@Fang](https://boards.straightdope.com/u/Fang)\
**Post date:** [April 23, 2004, 3:57am UTC](https://boards.straightdope.com/t/what-is-dfwntl-dll/241572/1 "2004-04-23T03:57:30Z")

</div>

I found this file on my PC infected with a virus, and since Norton AntiVirus couldn’t fix it, I deleted it. Possibly a bad move, but what the hell. Anyway, everytime I start Windows I get a message saying that it couldn’t find this file. A search on Google (and GoogleGroups) reveals nothing. Is there any way to find out what this file is or at least what application is calling it?

---

<div class="post-metadata">

**Author:** ![Dancing\_Fool](https://avatars.discourse-cdn.com/v4/letter/d/59ef9b/32.png) [@Dancing\_Fool](https://boards.straightdope.com/u/Dancing_Fool)\
**Post date:** [April 23, 2004, 6:26am UTC](https://boards.straightdope.com/t/what-is-dfwntl-dll/241572/2 "2004-04-23T06:26:44Z")

</div>

I couldn’t find it either, which makes me guess that it was probably being called by whatever it was you deleted. Before we can tell you how to find out what is calling that, it would be helpful to know what version of Windows you are running.

DancingFool

---

<div class="post-metadata">

**Author:** ![Fang](https://avatars.discourse-cdn.com/v4/letter/f/96bed5/32.png) [@Fang](https://boards.straightdope.com/u/Fang)\
**Post date:** [April 23, 2004, 6:48am UTC](https://boards.straightdope.com/t/what-is-dfwntl-dll/241572/3 "2004-04-23T06:48:17Z")

</div>

OK, as it turns out I made a mistake and the file is actually “dfwfntl.dll”. However this doesn’t return anything on Google either. I am running Win 2000. And just to clarify, dfwfntl.dll was the file I deleted, I am trying to find out what program is calling it.

---

<div class="post-metadata">

**Author:** ![DrDeth](https://avatars.discourse-cdn.com/v4/letter/d/b487fb/32.png) [@DrDeth](https://boards.straightdope.com/u/DrDeth)\
**Post date:** [April 23, 2004, 6:59am UTC](https://boards.straightdope.com/t/what-is-dfwntl-dll/241572/4 "2004-04-23T06:59:21Z")

</div>

I am no computer expert, but I think I saw this myself. I THINK it is a “BHO” realted to “CoolWebsearch” which hijacks your home page.

---

<div class="post-metadata">

**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\
**Post date:** [April 23, 2004, 12:28pm UTC](https://boards.straightdope.com/t/what-is-dfwntl-dll/241572/5 "2004-04-23T12:28:48Z")

</div>

If you can’t find it on Google, then it’s a random filename. No legitimate program uses random filenames – they solely used by viruses and spyware.

Random .dll’s are usually connected with BHO (Browser Help Object) spyware. CoolWebSearch is one of the most common, but AFAIK, it doesn’t yet use random names (though you never can state anything definitive about CWS, since it changes daily). I see that the Corefloo-C Virus uses a random filename with a .dll extension, but I can’t say if it is that.

If you’ve just deleted the .dll, get a copy of hijackthis and run it to see what HKLU entry refers to the file; that will give more information.