Undeletable damaged ifmon.dll file

Jobsworth wrote:
> The ifmon.dll file in my \windows\system32 folder contains 0 bytes, and won't
> let me delete or rename it in order to use a freshly-downloaded copy. I'm
> using XP Home/SP2, with all relevant updates; has anyone any ideas, please?

Click Start, Run, type SFC /SCANNOW, click OK. If any files are damaged
or missing, they'll be replaced. You may need to reboot afterwards so
damaged files will be replaced.

--
Joe =o)

Try this, Windows File Protection will probably replace the file, ifmon.dll.

Start | Run | Type: system32 | Click OK |

WINDOWS\system32 should open.
Size the window so you can also see your Desktop.
Scroll down to ifmon.dll.
Left click and drag ifmon.dll to your Desktop.
Wait just a minute.
Now scroll down clear to the bottom of system32.
Is there a new ifmon.dll there?

If there is a new ifmon.dll delete the one on your Desktop.
Close system32.

If there is NOT a new ifmon.dll drag the one on your Desktop back into
system32.
Close system32.

If there is a new ifmon.dll in system32, you'll see something similar to
this in the Event Viewer under System, listed as Information; Windows File
Protection:

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64002
Date: 09-May-07
Time: 7:10:56 PM
User: N/A
Computer: GT5404
Description:
File replacement was attempted on the protected system file
c:\windows\system32\ifmon.dll. This file was restored to the original
version to maintain system stability. The file version of the system file is
5.1.2600.2180.

To open the Event Viewer...
Start | Run | Type: eventvwr | Click OK

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:C0323105-3127-4967-87DE-7C7898555D72@microsoft.com,
Jobsworth <Jobsworth DeleteThis @discussions.microsoft.com> hunted and pecked:
> The ifmon.dll file in my \windows\system32 folder contains 0 bytes, and
> won't let me delete or rename it in order to use a freshly-downloaded
> copy. I'm using XP Home/SP2, with all relevant updates; has anyone any
> ideas, please?

Thanks for the very prompt and detailed responses. However, no dice so far.
I've:
Used SFC /SCANNOW, as suggested by Elmo - although something was definitely
happening, my damaged file remained in place;
Downloaded and run the Sysinternals Process Explorer (3c273's solution), but
have been through every process shown and can't see ifmon.dll being used by
any of them;
Tried Wesley's File Protection route, but dragging the file to the desktop
produces a "Cannot move ifmon: The file or directory is corrupted and
unreadable." error.
Does any of this shed any light on my stubborn little problem?

Hi Jobsworth - From my Blog, Defending Your Machine, addy below in my
Signature:


"Sometimes the tools below will find files which they are unable to delete
because they are in use.

- A program called Locked Files Wizard (LFW), formerly CopyLock, here,
http://noeld.com/programs.asp?cat=misc "is a simple assistant that allows
you to either replace, move, delete or rename one or more files or folders
which are in use by the system or any running process. Additionally, you can
display and possibly stop the processes or services that lock a file, and
manage files flagged to be processed by the system on next reboot (e.g.
after an installation or an uninstallation.) The Locked Files Wizard can
also help to select some worms and trojans from the Registry and to quickly
remove them from the system." Copylock2 (now Locked Files Wizard) does
request a $12 registration fee in order to activate some additional _new
functions_ in the new version and/or for installation on multiple computers
or commercial usage. However, that version is available for download at the
link on that page without registration and with full utility of the original
capabilities of Copylock after installation without registration. If you
prefer, you can alternatively download the older v. 1.09 version which
involves no registration at all (but, of course doesn't include the
possibility of upgrade to the paid version) here:
http://copylock.noel-danjou.qarchive.org/_download2.html

- Another is Killbox by Option Explicit, Beta version available here:
http://www.killbox.net/downloads/beta/KillBox.exe
Overview directions are available here:
http://www.killbox.net/help.html#Top
Read carefully - this tool is quite powerful. A Beta version is also
available.

- A third which is a bit different but often very useful is Delete Invalid
File, here:
http://www.purgeie.com/delinv.htm
which handles invalid/UNC file/folder name deleting, rather than the in use
problem. The situation with Delete Invalid Files is similar to that with
Copylock. The latest version adds additional capabilities which are aimed at
the commercial marketplace (but would be useful to an individual user also.)
However, all of the _original file removal functions_ are still freely
available in the download version without registration or payment.

From http://www.purgeie.com/delinv/index.htm:

"As the "Free" version of DelinvFile had become so popular and has been
referenced on many download sites, web forums and newsgroups as being
"Free", the current version does not require a fee to access the original
program functions. The commercial version of DelinvFile makes available
additional functions which require licensing (registration) for them to
work. The additional functions include "Open With..", Renaming Files,
Renaming Folders, and Deleting Files and Folders at Boot."

- A fourth useful program is Unlocker, here:
http://ccollomb.free.fr/unlocker/
" Simply right click the folder or file and select Unlocker. If the folder
or file is locked, a window listing of lockers will appear. Simply select
the lockers and click Unlock and you are done!" Works as advertised and is
particularly helpful in identifying malware components which are
'protecting' each other.

- A fifth is FileASSASSIN, here:
http://www.malwarebytes.org/fileassassin.php
"FileASSASSIN can delete locked malware files on your system. It uses
advanced techniques to unload modules, close remote handles, and terminate
processes to allow the removal of the file." "



--
Regards, Jim Byrd,
My Blog, Defending Your Machine,
http://defendingyourmachine2.blogspot.com/



In news:642F2825-42CD-40E7-BD58-EFCFE78D7745@microsoft.com,
Jobsworth <Jobsworth RemoveThis @discussions.microsoft.com> typed:
|| Thanks for the very prompt and detailed responses. However, no dice
|| so far. I've:
|| Used SFC /SCANNOW, as suggested by Elmo - although something was
|| definitely happening, my damaged file remained in place;
|| Downloaded and run the Sysinternals Process Explorer (3c273's
|| solution), but have been through every process shown and can't see
|| ifmon.dll being used by any of them;
|| Tried Wesley's File Protection route, but dragging the file to the
|| desktop produces a "Cannot move ifmon: The file or directory is
|| corrupted and unreadable." error.
|| Does any of this shed any light on my stubborn little problem?

Jim - many thanks for a huge amount of advice. I can't quite believe it, but
I've tried all those solutions - except KillBox - and the damn file is still
there!
Some programs say the file doesn't exist - e.g., the message from
LockedFilesWizard was: " The source file or folder does not exist. Please
correct." Unlocker looked more hopeful, reporting: "No locking handle found.
However Unlocker can help you with this object. Choose action you want to
perform on the object." A combo-type box offered several selections,
including 'delete' (which I chose), and something seemed to happen - except
the file was still listed in Windows Explorer afterwards. Similarly,
FileAssassin claimed to have processed the file (unlocked, then deleted in
two operations)... but there it is still!
I did wonder if it was just explorer playing games, but I had a look using
dir from the command prompt, and it's listed with 0 bytes.
Is this something I can ignore, maybe? What does ifmon.dll do anyway, and
what processes use it? All a bit strange!

....other possibly relevant piece of info is that chkdsk runs every time the
machine is booted, and Spybot Search & Destroy produces a balloon in the
system tray about the corrupt .dll whenever a scan is run.