Microsoft KB Archive/285327

= Games: W95.Hybris Virus Alert =

Article ID: 285327

Article Last Modified on 1/29/2007

-

APPLIES TO


 * Microsoft Age of Empires Gold Edition
 * Microsoft Age of Empires II: The Age of Kings
 * Microsoft Age of Empires II: The Conquerors Expansion
 * Microsoft Age of Empires II Gold Edition
 * Microsoft Combat Flight Simulator: WWII Europe Series
 * Microsoft Combat Flight Simulator 2: WWII Pacific Theater
 * Microsoft Flight Simulator 2000 Standard Edition
 * Microsoft Flight Simulator 2000 Professional Edition
 * Microsoft Links 2001 Standard Edition
 * Microsoft MechCommander 2
 * Microsoft MechWarrior 4: Mercenaries
 * Microsoft MechWarrior 4: Vengeance
 * Microsoft Motocross Madness 2

-



This article was previously published under Q285327



SYMPTOMS
When you play one of the programs listed in the &quot;Applies to&quot; section of this article, you may receive any one of the following error messages:

EXCEPTION: Access violation in PopupMsg::ONMBDOWN

STOP: Cannot create Resource\pilots\ \games\ .mw4

STOP: File not found Resource\props.mw4

The game could not be saved. Free some disk space and try again.

This feature will not work in the trial version.

Could not load keymap file default.map. Default keymap will be used instead.

Dlgalert.bmp Cannot Be Loaded.

Can't find file agencyfb20.d3f

Cannot find the file assets\graphics\agencyfb14.d3f.

For Microsoft Age of Empires 2, you may receive the following error message:

The scenario could not be loaded.

Note This happens with the second campaign, after you have beaten the first one.

Or, when you finish a race, the game may stop responding (hang) or your mouse pointer may disappear.

Or, when joining a CFS1 or CFS2 multiplayer session you may receive an error stating that some planes are unavailable or locked even though those planes are unlocked in the Multiplayer settings on the Host computer.

Or, you may lose keyboard functions within the game. And, upon going to the options menu to reassign keyboard assignments, you may find that the keyboard assignments are cleared out and non-configurable.



CAUSE
This issue may occur if the Wsock32.dll file on your computer is infected with the W95.Hybris worm virus.

Note This can also occur if the Wsock32.dll file is corrupted.



RESOLUTION
To resolve this issue, run anti-virus software that contains the latest virus signature file, and perform a thorough scan of your computer.

Support for this particular virus is available from many anti-virus programs.

After you detect and remove the virus, extract a new copy of the Wsock32.dll file. Use the steps below for your version of Windows operating system.

Microsoft Windows Millennium (Me)
The Windows Millennium (Me) system files are protected. To extract protected files, follow the steps given in the following Microsoft Knowledge Base article:

265371 How to Extract and Replace a Protected File in Windows Me

In Microsoft Windows 98

 * 1) Click Start, click Run, type sfc in the Open box, and then click OK.
 * 2) Click Extract one file from the installation disk.
 * 3) Type c:\windows\system\wsock32.dll, and then click Start.
 * 4) In the Restore from box, type c:\windows\options\cabs or browse to the Win98 folder on your Windows 98 CD-ROM.
 * 5) Click OK, and then click Skip to skip the back up of the file. (If you click OK, you might back up the virus.)
 * 6) Follow the instructions that appear on the screen to complete the installation, and then restart the computer.

The Wsock32.dll file is located in the Precopy1.cab cabinet file on the Windows 98 CD-ROM.

In Microsoft Windows 95
The Wsock32.dll file can be found in the following CAB files:
 * Win95_11.cab on the Windows 95 CD-ROM
 * Win95_18.cab on the Windows 95 OSR2 CD-ROM
 * Win95_12.cab on the Windows 95 DMF disks
 * Win95_19.cab on the Windows 95 non-DMF disks

To extract the Wsock32.dll file, from the Windows 95 CD-ROM:  Click Start, click Shut down, and then click Restart in MS-DOS mode. Either type

extract /a c:\windows\options\cabs\win95_11.cab wsock32.dll /l c:\windows\system

or

Insert your Windows 95 CD-ROM into your CD-ROM drive, and then type

extract /a :\win95\win95_11.cab wsock32.dll /l c:\windows\system

where  is the drive letter of your CD-ROM drive.

In Microsoft Windows NT 4.0
 Rename the Wsock32.dll file in the Windows\System32 folder to Wsock32.old. For information about how to rename a file, click Start, click Help, click the Index tab, type renaming, and then double-click the Renaming files topic.

 Click Start, point to Programs, and then click Command Prompt Type cd\, and then press ENTER.</li> Insert the Windows NT 4.0 CD-ROM into the CD-ROM drive, and then close the Windows NT Setup screen if it is displayed.</li> Type the following line at the command prompt, and then press ENTER:

expand :\i386\wsock32.dl_ c:\ \system32\wsock32.dll

where  is the drive letter assigned to your CD-ROM drive, and where   is the name of the folder in which Windows NT 4.0 is installed.</li> Type exit, and then press ENTER to return to windows.</li></ol>

For additional information about how to extract files from the Windows CD-ROM or a Windows floppy disk, click the following article number to view the article in the Microsoft Knowledge Base:

129605 How to Extract Original Compressed Windows Files

<div class="moreinformation_section">

MORE INFORMATION
It is possible to detect HYBRIS by using the Find program (Search in Windows Me/Windows 2000). Search the system for the Wsock32.dll file by using the Containing Text field. To do this, follow these steps:
 * 1) Click Start, point to Find, and then click Files or Folders. In Windows ME/Windows 2000, click Start, point to Search, and then click For files or folders.
 * 2) In the Named field (or Search for files or folders named:) type wsock32.dll.
 * 3) In the Containing Text field, type Hybris.
 * 4) Click Find Now (or Search Now).

Note The Containing Text field is on the Advanced tab in Windows 95.

If Windows finds any files, then the system may be infected with the HYBRIS virus and you should contact your antivirus vendor. For additional information about third-party antivirus vendors and products, click the following article number to view the article in the Microsoft Knowledge Base:

49500 List of Antivirus Software Vendors

For more detailed information about this particular virus, visit the following Web site:

http://www.mcafee.com

Additional query words: msgame hyrbis w95 win95 win98 connectivity network online winsock internet access explorer infect delete rename saved overwrite props mw4 mech mech4 links2k1 aoe links aok trial hd drive space save game mw warrior sockets wsock32 dll CFS1 CFS2 CFS performance

Keywords: kbconfig kberrmsg kbprb KB285327

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.