Tech: Blocked file - what does it do?

Subject: RE: Tech: Blocked file - what does it do?
From: JohnInKansas
Date: 16 Jul 08 - 07:57 PM

I wasn't quite sure what you meant.

Just didn't want you wasting time with chasing something that you wouldn't really want to catch.

John

Subject: RE: Tech: Blocked file - what does it do?
From: Tootler
Date: 16 Jul 08 - 06:17 PM

I think you misunderstood me John,

Looking back at your post, I should have said I'll investigate Microsoft Update and take it from there. I wasn't thinking specifically of the link you posted.

Thanks for the extra info just the same.

Geoff

Subject: RE: Tech: Blocked file - what does it do?
From: JohnInKansas
Date: 15 Jul 08 - 09:05 PM

Tootler -

The hotfix I gave a link to IS JUST ONE EXAMPLE of MANY hotfixes and patches that have used this filename. It was linked just so you could see that Microsoft has/does use the filename in legitimate patches.

At the Microsoft update site, you can look at "Installed Updates" for your computer. The list will include all the updates that have been downloaded to you and attempted to installl, and whether or not the installation was successful. If you can identify one that didn't install it might be likely that the problem file came with that one, but you'll need to check whether the same update was installed successfully later. Usually, Microsoft will try again until a successful install gets done, if you go back regularly.

Hopefully, once a successful installation gets done, your problem will go away.

John

Subject: RE: Tech: Blocked file - what does it do?
From: Tootler
Date: 15 Jul 08 - 06:01 PM

Thanks for the info, John and sorry, I should have said I am running Win XP SP2.

I will investigate the hotfix issue and see if that deals with the problem.

I had no intention of Unblocking the particular .dll unless clear it was harmless, but I would just rather that the message did not keep popping up.

Cheers

Gepff

Subject: RE: Tech: Blocked file - what does it do?
From: JohnInKansas
Date: 15 Jul 08 - 03:10 AM

The filename _SFX_.dll is a generic "CAB File" that has been used in a number of Micorosoft updates and hotfixes, so there is the possibility that it's a leftover from a failed prior "fix" from Microsoft.

Note that hotfixes, as opposed to patches, are "workarounds" issued to help with specific problems prior to development of general patches that eliminate the problem, and should NEVER be installed unless they apply to a problem found, verified, and unresponsive to general operational fixes on a specific computer.

ONE EXAMPLE is at KB81604, which offers a hotfix for a specific kind of driver conflict. The filename has appeared (as noted, it's "generic") in a number of patches, and there's no easy way of telling which one yours might have come from.

Unfortunately, the filename also has been suspected to have been "aped" by one or more malware programs, so without confirmation of where your copy came from there is no safe way for most users to "investigate" or do much of anything about it.

You haven't indicated what OS you're using, but if it's a recently current Windows version and you're not absolutely certain that it's up to date, the best first step would be to visit Microsoft Update, get your computer scanned for critical updates and download and install ALL CRITICAL UPDATES, including the Microsoft Malware Detector that will be part of the recommended "Critical Updates."

Critical updates will be downloaded and installed if you select "Express Install." If you're using WinXP or later, you can separately select "Custom Install" and look at optional updates on the chance that a patch for your hardware configuration may not have been distributed for all computers. (I'd suggest going back for a second scan and "Custom Install" after you've done an Express Install of Critical stuff.)

If your _SPX_.dll is a "leftover" from a valid update or hotfix that failed to install, completing the updates should replace/delete any failed installations and any prior hotfixes that have been superceded by full patches.

In one or two hotfixes, the extraction of files and installation may be blocked by the patch installation program, if there were conflicting hardware/drivers on your machine. This would imply that you (or someone who "fixed" things for you¹) didn't read and verify all the conditions for installing the particular hotfix. In this case the installation may still be trying to "finish," and could be repeatedly rejected. An update that incorporates or removes the need for the hotfix should clear this.

¹ "Someone" could include a program author (freeware?), especially of something that promises to solve a lot of your problems.

IF YOU HAPPPEN TO BE RUNNING VISTA, be aware that Vista itself may block insstallation of drivers that it doesn't think are "compatible," and the _SPX_.dll sometimes is a Drivers CAB file, so you could be seeing a Vista warning rather than a spyware warning(??????). My anti-everything looks quite different than the Vista notice, but with yours the notices might be similar(?).

John

Subject: RE: Tech: Blocked file - what does it do?
From: Bonnie Shaljean
Date: 14 Jul 08 - 08:17 PM

This may help answer the question asked in your thread title - it's from a friend some months ago regarding another (similar) situation and is worth sharing:

Do not succumb to the temptation to access that link with the sub file .dll - DLL stands for data link library and the .dll files are common subroutines used by several programs, but they also can be used to substitute for the legitimate .dlls on your machine that are called by the operating system or standard programs. This can be a form of trapping certain functions - viruses such as the ones that activate on a certain date, or after a certain action by you, are examples. It is also possible that it contains a virus that could be downloaded when you access the site.

There are basically two types of files on a computer - executable files and data files. Data files are just that, files of data (in many different formats, some music and some text and some graphics) and all of them have "dot extensions" that define the file format to the operating program.

Executable files are another thing - they are programs that run on your computer. The usual extension is .exe for a main program. Programs use "subroutines" of executable code. As programming languages advanced they got the capability of accessing libraries of common subroutines so that they didn't have to be included in any main program. That is where the .dll comes in. You may never notice that a .dll subroutine has overlaid a legitimate one on your system - if it is well designed it will perform all the normal functions, plus a few of its own.

Subject: RE: Tech: Blocked file - what does it do?
From: olddude
Date: 14 Jul 08 - 07:47 PM

Keep it BLOCKED
Dan

unsafe DLL

Subject: RE: Tech: Blocked file - what does it do?
From: Bonnie Shaljean
Date: 14 Jul 08 - 07:42 PM

Do you have Zone Alarm or some other firewall? I would set it to bar this one permanently, in conjunction with your spyware. (Wot, me paranoid?) But better paranoid than paralysed -

Subject: RE: Tech: Blocked file - what does it do?
From: Bonnie Shaljean
Date: 14 Jul 08 - 07:40 PM

I don't like anything with a .dll suffix. ("Data link library" or something like that - as far as I know it's an enabler of some sort, like .exe.) I would really really keep that one out. It sounds like it wants to do more than snoop on you, or at least gives itself permission to.

Hopefully John in Kansas will drop in to let us know more -

Subject: RE: Tech: Blocked file - what does it do?
From: Amos
Date: 14 Jul 08 - 06:44 PM

It appears to have been developed by on "BRHACK" as an adjunct to a program for making archives from files. I suggest you ignore it and have no truck therewith.

Assuming you do not need an amateur development utility for making archives.


A

Subject: Tech: Blocked file - what does it do?
From: Tootler
Date: 14 Jul 08 - 04:52 PM

My spyware program (spyware terminator) regularly blocks a file by the name of _SFX_.dll

Does anyone know what this file does? I would like to know whether or not it is harmful? I am working on the basis that it is harmful for now and until I hear otherwise.

Cheers

Geoff