NISWiSy.dll

Discussion in 'Tech' started by JZL, Aug 20, 2011.

  1. JZL

    JZL Ministry of Wack

    Messages:
    3,078
    Trophy Points:
    78
    Location:
    SE Kansas
    A friend's laptop was infected with a bunch of stuff that I got with a boot-time scan. However, both before and after that, when w7 is loading after logging in as a user, There's a nag that says NISWiSy.dll can't be found.

    A google of NISWiSy.dll gets no hits. Nor does NlSWiSy.dll. I look in all the normal places to see what's loading with windows and don't see anything particularly suspicious.

    Any ideas?
    JZL, Aug 20, 2011
    #1
  2. msgwtco

    msgwtco Divides by Zero

    Messages:
    891
    Trophy Points:
    33
    Location:
    Plainville, CT
    msgwtco, Aug 20, 2011
    #2
  3. Goofus Maximus

    Goofus Maximus Too old to be this dumb!

    Messages:
    7,158
    Trophy Points:
    78
    Location:
    St. Louis area, but in Illinois
    When it gets to that point, I tend to prefer just nuking the installation and installing new, after saving all the needed data. Windows 7 may have better system file checking than XP does though, so maybe it won't be a slow moving train wreck like XP sfc tends to be.
    Goofus Maximus, Aug 20, 2011
    #3
  4. SoulAssassin

    SoulAssassin Car Ramrod

    Messages:
    4,656
    Trophy Points:
    53
    Location:
    Cincinnati, OH
    Search the registry for that file (specifically in the HKLM, Software, Microsoft, Windows, then current version I think, Run ) and I bet you'll find your reference.
    SoulAssassin, Aug 20, 2011
    #4
  5. JZL

    JZL Ministry of Wack

    Messages:
    3,078
    Trophy Points:
    78
    Location:
    SE Kansas
    I looked in Run already, but someone else has also advised me to search the reg generally. Not finding anything. Might try it in safemode as admin.

    The file checker said everything was OK.
    JZL, Aug 20, 2011
    #5
  6. Wedge_

    Wedge_ Rogue One

    Messages:
    1,135
    Trophy Points:
    51
    Location:
    Scotland
    Try loading up Autoruns from http://technet.microsoft.com/en-us/sysinternals/bb963902 - it should show you a list of everything that loads up when Windows does, in all the various locations they might be. Hopefully you can find a reference to it in there. If you do it should also let you delete it.
    Wedge_, Aug 20, 2011
    #6
  7. MSP

    MSP Haunting a dead forum...

    Messages:
    29,575
    Trophy Points:
    78
    This. I don't fuck with infested systems much at this point - troubleshoot for an hour or so and then reimage.
    MSP, Aug 22, 2011
    #7
  8. Adam12

    Adam12 Junior Member

    Messages:
    123
    Trophy Points:
    23
    +1 for autoruns, it should be able to tell you where it is trying to load from, and also allow you to delete the entry.
    Adam12, Aug 22, 2011
    #8
  9. JZL

    JZL Ministry of Wack

    Messages:
    3,078
    Trophy Points:
    78
    Location:
    SE Kansas
    Oh shit, I'm sorry. Autoruns found and killed whatever was looking for it.

    Yeah, it's hard to tell when to bag it. It wasn't my comp so I didn't have an image made. I know a lot of these laptops have recovery roms/partitions but this was also a multi-user family comp so setting it back yup after a fresh install would also have been slightly painful.

    Damn, I shoulda imaged it for her after I cleaned it out.
    JZL, Sep 1, 2011
    #9