Can I delete these files???

Avast Free Antivirus / Premium Security
1

I have some system files in the virus chest:

   kernell32.dll
   winsock.dll
   winsock32.dll

They have been in there for over three weeks. Is it safe to delete them now?

2

Here’s a quote from the help files :wink:

Backup of the system files. During the installation, avast! copies some critical system files into the Chest, under the "System files" category. Those files might cause the operating system to crash if they get infected by a virus. If needed, those files can be restored from the Chest to their original location. Should an unknown virus infect the computer despite the extensive protection from the avast! antivirus package and alter an important system file, it can then be easily restored to its original state.

So, my advise is: Don’t delete these files :wink:

3

If you delete them, they’ll be recreated anyway.

4

Here is a bit of info from Bleeping computers about
winsock32.dll
Name: System
Filename: winsock32.dll
Command: C:\Windows\System32\winsock32.dll
Description: Added by the Troj/Agent-SH Trojan.
File Location: %System%
Startup Type: This startup entry is started automatically from a Run, RunOnce, RunServices, or RunServicesOnce entry in the registry.
CLSID: (4F69BFF9-3901-4D8A-8926-C9B29794CA95)
HijackThis Category: O4 Entry
Note: %System% is a variable that refers to the Windows System folder. By default this is C:\Windows\System for Windows 95/98/ME, C:\Winnt\System32 for Windows NT/2000, or
C:\Windows\System32 for Windows XP.

Is it kernell32.dll with two l’s or kernel32.dll one l
winsock.dll Windows Socket 16-Bit DLL

Try downloading and running HijackThis 1.99.1 form Meriji.org
HijackThis Download Page

Run HijackThis and post the text file to
HijackThis log file analysis
or
NetworkTechs log file analysis

5

If they were infected files, they would be in the Infected Files section, rather than the System Files section for back-ups of critical system files. So I guess we will have to wait for testy to get back to us.

6

In the virus chest, it is listed under the System files, and All Chest Files tabs.

dll’s listed are double ll’s

7

The all files includes the System Files section, so the ones you see are back-up files so should be left where they are.

There may be occasions when you will have more than one copy of the files in the System Files section, e.g. any system update that effects those files.

8

Sorry I’m Confused below image of Avast–All Chest Files

kernell32.dll>> I can only find>>kernel32.dll=C:\Windows\System32>>kernell32.dll>>Not on my XP system this file contains 2 l’s>> one more than it should have??
winsock.dll>>C:\Windows\System32>> This I can find
winsock32.dll>>I can only find>wsock32.dll=C:\Windows\System32>>winsock32.dll again not on my XP system
are they pre XP files

9

Same as mine Peter, so we can only assume that it’s a typo as I can’t see avast saving an infected file or one with a different file name to the one we both have in chest system files section.

I can only guess that Testy was referring to the double ll in dll (file type) as he mentioned “dll’s listed are double ll’s” implying more than one, rather than the file name because there was only one with an l much less two lls.

10

Thanks David clear as mud mate ;D to many llllls for me

11

I still don’t understand what you are referring to. This is the screenshot.

12

It appears to me they would be safe to delete from chest as your system is I assume working ok without them and some have been there a long time.
As VLK has said if they are needed then windows will re-create them.

13

  1. The 3 files are copied (not moved) to the Chest (to the System folder) when avast is installed. That is, avast is backing up these files for you (should these get infected/deleted later, avast will be able to restore them from the backup, i.e. from the Chest).

  2. If you install a service pack (or sometimes even a security patch), these files may change. Avast will detect this and will back up even the new ones for you (automatically). Hence, if you’re running avast for some time already, there may be multiple copies of the files in the Chest. It is OK to delete the old ones – but I’d recommend leaving the most recent ones in place.

Hope this helps
Vlk

14

Your screenshot gives a filename/s of kernel32.dll yet your post gives a filename of kerneLL32.dll (two lls in the filename not the file extension dll, caps for emphasis, it was that which was being queried).

There are viruses that are named very closely to a legitimate system file to confuse and deceive you into not removing them if they are detected as a virus. Do a google search for kernell32.dll and you will see why we were concerned, there are lots of hits relating to viruses, totally different from the legitimate kernel32.dll.