Removal instructions for W32.Hybris 

4Help provides these instructions to assist you in the removal of this computer virus. If these instructions do not remove the virus from your system, then 4Help recommends that you contact your computer vendor. The use of up-to-date anti-virus software will help prevent your computer from becoming infected with viruses.

What you need to complete these instructions:

  • Your Windows 95/98 CD

  • Norton AntiVirus installed on the infected computer   

    If you don't have Norton AntiVirus installed, click the following link to download it:

                            http://antivirus.vt.edu/download/ 

 

Time to complete:     60 minutes

Virus removal:

Overview:

  • Remove the big black and white swirl.
  • Remove the virus from your system.
  • Disable your virus scanner.
  • Manually extract system files.
  • Re-enable your virus scanner and delete infected files.

 

  1. You MUST print these instructions before you proceed with the virus removal. You will need the printed instructions because your computer may not boot into Windows during parts of the repair process.
    • Select 'Print...' from the 'File' menu.

Remove the big black and white swirl:
  1. Boot your computer into safe mode.
    • How to start Windows 95 in Safe mode:
      1. Click the 'Start' button and select 'Shut Down'. The 'Shut Down Windows' dialog box will open.
      2. Select the 'Restart' option button and click 'Yes'. Windows will shut down and your computer will restart.
      3. Press the 'F8' key when the 'Starting Windows 95...' window appears. The 'Windows 95 Startup Menu' will appear.
      4. Select the 'Safe mode' option button and press the 'Enter' key.
    • How to start Windows 98 in Safe mode:
      1. Click the 'Start' button and select 'Shut Down.' The Shut Down Windows dialog box will open.
      2. Select the 'Restart' option button and click the 'OK' button. Windows will shut down and your computer will restart.
      3. As your computer restarts, press and hold down the 'Ctrl' key until the Windows 98 Startup Menu appears. Note: On some computers, a keyboard or other error may appear during restart as you hold down the 'Ctrl' key. If so, follow the prompts to press a key to continue (for example, the message may prompt you to press the 'Esc' key) and immediately press the 'Ctrl' key again.
      4. Select the 'Safe mode' option button and press the 'Enter' key.
  2. After your computer has booted in safe mode, click the 'Start' button and select 'Run...'.
  3. Type sysedit in the 'Open:' text field.
  4. Click the 'OK' button. The System Configuration Editor will start.
  5. Select the 'Win.ini' window.
  6. The win.ini file should have line that begins with 'run='.  Delete everything that appears after the '=' sign.
  7. Select 'Save' from the 'File' pull down menu.
  8. Close the System Configuration Editor.
  9. Restart your computer.

Remove the virus from your system:

  1. Make sure Norton AntiVirus has the most current virus definitions:
    1. Double click on the Norton icon in your system tray.
      • The system tray is the lower right hand corner of your Desktop on the Task Bar.
      • If you are uncertain as to which icon is the Norton Antivirus icon, holding the mouse pointer over an icon for a few seconds will display a description of what that icon represents.
    2. Click the 'System Status' button.
    3. In the 'Norton AntiVirus Status' box , you should see a green check and a line that reads, 'Your virus definitions are up-to-date'.
    4. If you see that your virus definitions are not up-to-date, run LiveUpdate.
      • For more information on how to run LiveUpdate, click here.
  2. Run a manual scan of your computer:
    1. Double click on the Norton icon in your system tray.
    2. Click the 'Scan for Viruses' button.
    3. Select 'Scan all hard disks for viruses'.
    4. Click the 'Run Scan Now' button.
  3. Delete all infected files from Norton's Quarantine:
Disable your virus scanner:

  1. Most anti-virus programs are disabled by right clicking on the icon in the system tray (lower right hand corner of your Desktop on the Task Bar).
  2. If you are running Norton AntiVirus 2000, right click on the silver computer icon and select 'Disable Auto-Protect' from the pop-up menu.
  3. If you are running Norton AntiVirus Corporate Edition 7.x, right click on the yellow shield icon and remove the checkmark next to 'Enable File System Realtime Protection' from the pop-up menu.
Manually extract System Files:

  • If you are running Windows 98:
You must first determine the location of your 'CAB files'. Once you've done that, you can restore the the 'Wscock32.dll' file using the Windows 'System File Checker' utility.
  1. Click the 'Start' button and select 'Run...'.
  2. Type command in the 'Open:' text field.
  3. Click the 'OK' button to open the 'MS-DOS Prompt'.
  4. Type dir /s \precopy1.cab at the command prompt and press the 'Enter' key.
  5. This will search your hard drive for the location of the 'CAB' files. If the file is not found, it is likely that the 'CAB' files are not on your hard drive. If this is the case, you will need your Windows CD in order to proceed with the virus removal instructions.
  6. If the file is found, write down the location that follows ‘Directory of’. For example, 'C:\Windows\Options\Cabs'.
  7. Click the 'Start' button and select 'Run...'.
  8. Type sfc in the 'Open:' box.
  9. Click the 'OK' button to start the 'System File Checker' utility.
  10. Select the 'Extract one file from installation disk' option button.
  11. Type wsock32.dll in the text box below 'Specify the system file you would like to restore.'.
  12. Click the 'Start' button.
  13. If the CAB files are located on your hard drive:
    • In the 'Restore from:' text box, type in the location that you wrote down from the 'Directory of' search above.
    • Skip to step 15.
  14. If the CAB files are located on your Windows CD:
    1. Insert the Windows CD into your CD-ROM drive.
    2. Click the 'Browse...' button to the right of the 'Restore from:' box.
    3. Click the '+' next to your CD-ROM drive.
    4. Click the 'Win98' folder to highlight it.
    5. Click the 'OK' button.
    6. If the text box labeled 'Save file in' is blank, type c:\windows\system.
  15. Click the 'OK' button.
  16. Click on the 'Skip' button if you are prompted to make a backup of the file.
  17. A message will appear saying the 'Wsock32.dll' file was successfully extracted.
  18. Click the 'OK' button.
  19. Close all programs that are running.
  20. Skip to the 'Re-enable your virus scanner and delete infected files' section at the bottom of this page.
  • If you are running Windows 95:
You must first determine the location of your 'CAB' files. Once you've done that, you can restore the 'Wsock32.dll' file using the 'extract' command.
  1. Click the 'Start' button and select 'Run...'.
  2. Type command in the 'Open:' box.
  3. Click the 'OK' button to open the 'MS-DOS Prompt'.
  4. Type dir /s \precopy1.cab at the command prompt and press the 'Enter' key.
  5. This will search your hard drive for the location of the 'CAB' files. If the file is not found, it is likely that the 'CAB' files are not on your hard drive. If this is the case, you will need your Windows CD in order to proceed with the virus removal instructions.
  6. If the file is found, write down the location that follows ‘Directory of’. For example, 'C:\Windows\Options\Cabs'.
  7. Click the 'Start' button and select 'Shut Down...'.
  8. Select the 'Restart in MS-DOS mode' option button.
  9. Your computer will restart.
  10. If the CAB files are located on your hard drive:
    • Type cd and the location you found for 'Directory of' (without the C:) and press the 'Enter' key. For example, cd \windows\options\cabs
    • Type extract /a win95_11.cab Wsock32.dll /L c:\windows\system and press the 'Enter' key.
    • Skip to step 12.
  11. If the CAB files are located on your Windows CD:
    • Insert the Windows CD into your CD-ROM drive.
    • Type extract /a d:\win95\win95_11.cab Wsock32.dll /L c:\windows\system (replacing d: with the correct letter of your CD-ROM drive) and press the 'Enter' key.
  12. Type y and press the 'Enter' key if you are warned about overwriting the 'Wsock32.dll' bile.
  13. A message will appear indicating the 'Wsock32.dll' file was successfully extracted.
  14. Type win and press the 'Enter' key to restart windows.
  15. Skip to the 'Re-enable your virus scanner and delete infected files' section at the bottom of this page.
Re-enable your virus scanner and delete infected files:

  1. Re-enable your virus scanner:
    • If you are running Norton AntiVirus 2000, right click the silver computer icon in your system tray and select 'Enable Auto-Protect' from the pop-up menu.
    • If you are running Norton AntiVirus Corporate Edition 7.x, right click the yellow shield icon in your system tray and place a checkmark in the 'Enable File System Realtime Protection' check box.
  2. Update your virus scanner definition files:
    • If you are using Norton AntiVirus, run LiveUpdate to download the latest virus definitions.
  3. Perform a manual scan on your computer to detect and delete any infect files on your computer.
  4. Restart your computer. The virus should be completely removed from your system and there should be no errors.
If these instructions did not repair your system, then 4Help recommends you contact a computer vendor for further assistance.