Undeletable damaged ifmon.dll file

Hi Jobsworth - Well, not sure it will solve it given what you've already
done, but you might want to try these utilities again after doing a "Clean
Boot". Again from my Blog:


#########IMPORTANT#########
Show hidden files and run all of the following removal tools from Safe mode
or preferably a "Clean Boot" when possible (which will let you use the
Windows Installer, access the Internet safely, etc., while still avoiding
interfering programs or malware), logged on as an Administrator. BEFORE
running these tools, be sure to clear all Temp files and your Temporary
Internet Files (TIF) (including offline content.) Reboot and test if the
malware is fixed after using each tool.
HOW TO Enable Hidden Files
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339
How to boot to Safe mode
http://spyware-free.us/tutorials/safemode/ and
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406

Clean Boot - General Win2k/XP procedure, but see below for links for other
OS's (The procedure does differ by OS, so be sure to check for yours. The
following is for XP or Win2k w/msconfig - you can obtain msconfig for Win2k
here: http://www.3feetunder.com/files/win2K_msconfig_setup.exe ):

1. StartRun enter msconfig.
2. On the General tab, click Selective Startup, and then clear the 'Process
System.ini File', 'Process Win.ini File', and 'Load Startup Items' check
boxes. Leave the 'boot.ini' boxes however they are currently set.
3. In the Services tab, check the "Hide All Microsoft Services" checkbox,
and then click the "Disable All" button. If you use a third party firewall
then re-check (enable) it. For example, if you use Zone Alarm, re-check the
True Vector Internet Monitor service (and you may also want to re-check
(enable) the zlclient on the Startup tab.) Equivalent services exist for
other third party firewalls. An alternative to this for XP users is to
enable at this time the XP native firewall (Internet Connection Firewall -
ICF). Be sure to turn it back off when you re-enable your non-MS services
and Startup tab programs and restore your normal msconfig configuration
after cleaning your machine.
4. Click OK and then reboot.

For additional information about how to clean boot your operating system,
click the following article links to view the articles in the Microsoft
Knowledge Base:
310353 How to Perform a Clean Boot in Windows XP,
http://support.microsoft.com/kb/310353
281770 How to Perform Clean-Boot Troubleshooting for Windows 2000
http://support.microsoft.com/kb/281770/EN-US/ (Procedure not using
msconfig)267288 How to Perform a Clean Boot in Windows Millennium Edition
http://support.microsoft.com/kb/267288/EN-US/
192926 How to Perform Clean-Boot Troubleshooting for Windows 98
http://support.microsoft.com/kb/192926/EN-US/
243039 How to Perform a Clean Boot in Windows 95
http://support.microsoft.com/kb/243039/EN-US/

(BTW, it's not pertinent to the 'Clean Boot' operation, but FYI you can add
a very useful 'Tools' tab to msconfig if you wish. See here:
http://support.microsoft.com/?kbid=906569)
#########IMPORTANT#########






--
Regards, Jim Byrd,
My Blog, Defending Your Machine,
http://defendingyourmachine2.blogspot.com/



In news:076D8AE8-57C8-4AF5-B1BF-6B0E0DD58967@microsoft.com,
Jobsworth <Jobsworth.RemoveThis@discussions.microsoft.com> typed:
|| Hi, Jim - yeah, I tried both ways of deleting through DIF. Both
|| produced a balloon message in the system tray - first said "Click to
|| delete the file selected above using its Short FileNam. The file or
|| directory c:\windows\system32\ifmon.dll is corrupt and unreadable.
|| Please run the Chkdsk utility.". Using the UNC option produced a
|| similar error: "Click folder name to navigate to it:DelinvFile.EXE -
|| Corrupt F".
|| Did seem a bit odd - for example, where to click? Also, the second
|| message looks somewhat incomplete. Forgive me - I'm an OK user, but
|| very green when I get under the hood.

Hi, Jim
Sorry for the delay - been at work and not long read your new post. Nobody'd
mentioned the 'clean boot' requirement before, so I'll get onto that later or
tomorrow, and be in touch again if that's OK.

Hi again, Jim
Renewed thanks for your detailed input! I've run each of those utilities
again after a clean boot - and having deleted the temp and TI files as you
suggested - and still the empty file is there! I tried killbox too, to no
avail.
I took note of the feedback from Chkdsk; while verifying files it reports:
"Truncating badly linked attribute records from file record segment 24338.".
Later it reports: "inserting data attribute into file 24338.". Don't know if
this is in any way significant or helpful.
I've responded to the request for errors in running FileASSASSIN to be
reported to the support team at malwarebytes.org. I hesitate to ask you for
further help, on account of the time you've spent already - but if you do
have any further inspiration and fancy getting in touch, that would be great!
I'm away for a few days and out of Internet range, but will check for
messages again later in the week.
Best regards.

Hi Jobsworth - YW. FWIW, this begins to sound more and more to me like a
hardware disk issue, and I suspect that your chkdsk msgs may, indeed, be
significant. I would at least get a SMART readout, and I think I might take
a look on my HD manufacture's site to see if there are any standalone disk
diagnostic utilities available for download (most have such, usually as
self-booting CD .iso images - I assume you know how to burn an .iso to CD?),
and institute a thorough check of the disk in question. FAIR WARNING - It's
almost always a good idea to do as complete a backup as you can given the
resources available to you of critical data BEFORE running such diagnostics.
While such utilities are normally non-destructive and quite safe, they are
often designed to also fix errors as well, and unhappy things have been
known to happen in that step upon occasion.

--
Regards, Jim Byrd,
My Blog, Defending Your Machine,
http://defendingyourmachine2.blogspot.com/



In news:8E6D3803-83EF-4987-8AA3-447F09740D13@microsoft.com,
Jobsworth <Jobsworth RemoveThis @discussions.microsoft.com> typed:
|| Hi again, Jim
|| Renewed thanks for your detailed input! I've run each of those
|| utilities again after a clean boot - and having deleted the temp and
|| TI files as you suggested - and still the empty file is there! I
|| tried killbox too, to no avail.
|| I took note of the feedback from Chkdsk; while verifying files it
|| reports: "Truncating badly linked attribute records from file record
|| segment 24338.". Later it reports: "inserting data attribute into
|| file 24338.". Don't know if this is in any way significant or
|| helpful.
|| I've responded to the request for errors in running FileASSASSIN to
|| be reported to the support team at malwarebytes.org. I hesitate to
|| ask you for further help, on account of the time you've spent
|| already - but if you do have any further inspiration and fancy
|| getting in touch, that would be great! I'm away for a few days and
|| out of Internet range, but will check for messages again later in
|| the week.
|| Best regards.

Hi again, Jim.
Sorry for the long delay - I've been working away from the poorly machine,
and without regular Internet access.
I was wondering about scrapping the HD partitions and doing a clean install
from CDs and a data backup, but maybe I'll give your suggestion a go first.
I've downloaded the .iso diagnostics file for my drive series from Western
Digital, and will run it after I've refreshed my backup. I'll let you know
what happens!
All the best,
Jobsworth

"Jim Byrd" wrote:

> Hi Jobsworth - YW. FWIW, this begins to sound more and more to me like a
> hardware disk issue, and I suspect that your chkdsk msgs may, indeed, be
> significant. I would at least get a SMART readout, and I think I might take
> a look on my HD manufacture's site to see if there are any standalone disk
> diagnostic utilities available for download (most have such, usually as
> self-booting CD .iso images - I assume you know how to burn an .iso to CD?),
> and institute a thorough check of the disk in question. FAIR WARNING - It's
> almost always a good idea to do as complete a backup as you can given the
> resources available to you of critical data BEFORE running such diagnostics.
> While such utilities are normally non-destructive and quite safe, they are
> often designed to also fix errors as well, and unhappy things have been
> known to happen in that step upon occasion.
>
> --
> Regards, Jim Byrd,
> My Blog, Defending Your Machine,
> http://defendingyourmachine2.blogspot.com/
>
>
>
> In news:8E6D3803-83EF-4987-8AA3-447F09740D13@microsoft.com,
> Jobsworth <Jobsworth.TakeThisOut@discussions.microsoft.com> typed:
> || Hi again, Jim
> || Renewed thanks for your detailed input! I've run each of those
> || utilities again after a clean boot - and having deleted the temp and
> || TI files as you suggested - and still the empty file is there! I
> || tried killbox too, to no avail.
> || I took note of the feedback from Chkdsk; while verifying files it
> || reports: "Truncating badly linked attribute records from file record
> || segment 24338.". Later it reports: "inserting data attribute into
> || file 24338.". Don't know if this is in any way significant or
> || helpful.
> || I've responded to the request for errors in running FileASSASSIN to
> || be reported to the support team at malwarebytes.org. I hesitate to
> || ask you for further help, on account of the time you've spent
> || already - but if you do have any further inspiration and fancy
> || getting in touch, that would be great! I'm away for a few days and
> || out of Internet range, but will check for messages again later in
> || the week.
> || Best regards.
>
>
>

Update since yesterday's post... run the WD diagnostics off a bootable CD,
100% clear.
Do you think this is something I can safely ignore, and clear it up when I
reformat or replace the HDD sometime?