sens.dll infected by patched.g

i posted in the lowyat forum too, but i havent had any replies yet so far.

just curious whether it is advisable to replace the sens.dll file.

upload YOUR "infected" sens.dll file to:

Virus Total
http://www.virustotal.com/

to SEE IF it is indeed infected?

well.. i tried uploading it, but it showed me "0 bytes size received / Se ha recibido un archivo vacio"

The sense.dll file has been scanned in the last couple of days:

Have a look:

http://virscan.org/report/17729fe4549f63614168a9a36279058b.html

Did Nod32 put your "infected" file into the vault?

Name Trojan.Win32.Patched.g
Type Malware

http://research.sunbelt-software.com/threatdisplay.aspx?name=Trojan.Win32.Patched.g&threatid=90203

I would suggest:

Please download Malwarebytes Anti-Malware or alternate download link

* Make sure you are connected to the Internet.
* Double-click on Download_mbam-setup.exe to install the application.
* When the installation begins, follow the prompts and do not make any changes to default settings.
* When installation has finished, make sure you leave both of these checked:
* - Update Malwarebytes' Anti-Malware
* - Launch Malwarebytes' Anti-Malware
* Then click Finish.
* MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
* If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.

* On the Scanner tab:
* - Make sure the "Perform Quick Acan" option is selected.
* - Then click on the Scan button.
* The next screen will ask you to select the drives to scan. Leave all the drives selected and click on the Start Scan button.
* The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
* When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
* Click OK to close the message box and continue with the removal process.
* Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
* Make sure that everything is checked, and click Remove Selected.
* When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
* The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.

* -- Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

**If you encounter this message:"c:\program files\malwarebytes' Anti-Malware\mbamext.dll Unable to register the dll/ocx: RegSvr32 failed with exit code 0x5" Click on ignore mbamext.dll


What does the scanner find, IF anything?

I kinda aware that sens.dll is essential to windows. what are the risk imposed if in case I deleted the file through AV or antispyware softwares?

sens.dll is a library that contains functions used for System Event Notification Service (SENS).

http://www.processlibrary.com/directory/files/sens/20520

"sens.dll is flagged as a system process and does not appear to be a security risk. However, removing System Event Notification Service Library may adversly impact your system."


http://www.auditmypc.com/process/sens.asp

it says it must not be disabled or whatsoever, so what will happen if the file is missing?
should i just replace the file with the one available from dlldump?

a System Restore first to an earlier date ?

i'm not sure when i got infected, the notification of infection was shown only after i updated my AV.
moreover, my system restore is disabled (it was the technician who disabled it when i got it reformatted last year).

and whether or not it is a False Positive from Nod32.......

I saw you posted at Wilder's........ Pls. wait till you get info from them before doing anything.

Was the file created recently? Or is it an "old file" ?

I would wait for a response from the Nod team at Wilder's though ...... ONLY to be sure !

The date created and the date modified are same, 1 September 2004, 8:00:00 AM. so i would say this is an old file.

seems to me it has never been modified, so I thought it was NOD faulty.
still waiting for reply in Wilders.

so...... my "guess" is........ it is a False Positive from Nod32.

I guessed the same too, but I just hate the warning window which keeps popping out when I close it. I minimized it although it doesnt look good on my taskbar.

hi there,

are sens.dll and Sens.dll the same? mind the caps.
just checking the log of my NOD, it showed me sens.dll, Sens.dll, SENS.DLL, but of the same foler c:/windows/system32/

anyway, to update, i asked NOD to delete the infected file, but when i checked back in system32 folder, the file is there! this time when i hover over the file, it shows me the description, file version etc.

any explanation to this?

There has been a similar "problem" with BitDefender.

Suggestion was:

Copy a clean sens.dll from a windows install CD, or another computer.

More here in post # 5:

http://forum.bitdefender.com/index.php?showtopic=4672&pid=23445&mode=threaded&start=#entry23445

BD= BitDefender

Have your Detector remove the offensive item and the original sens.dll file should reappear. Worked for me in AV, anyway.