Games: W95.Hybris Virus Alert (285327)


The information in this article applies to:

  • Microsoft Age of Empires, Gold Edition
  • Microsoft Age of Empires II: The Age of Kings 2.0
  • Microsoft Age of Empires II Expansion: The Conquerors
  • Microsoft Age of Empires II Gold Edition
  • Microsoft Combat Flight Simulator: WWII Europe Series 1.0
  • Microsoft Combat Flight Simulator 2: WWII Pacific Theater
  • Microsoft Flight Simulator 2000
  • Microsoft Flight Simulator 2000 Professional Edition
  • Microsoft Links 2001
  • Microsoft MechCommander 2.0 1.0
  • Microsoft MechWarrior 4: Mercenaries
  • Microsoft MechWarrior 4: Vengeance
  • Microsoft Motocross Madness 2 2.0
This article was previously published under Q285327

SYMPTOMS

When you play one of the programs listed in the "Applies to" section of this article, you may receive any one of the following error messages:
EXCEPTION: Access violation in PopupMsg::ONMBDOWN()
STOP: Cannot create Resource\pilots\username\games\Mission name.mw4
STOP: File not found Resource\props.mw4
The game could not be saved. Free some disk space and try again.
This feature will not work in the trial version.
Could not load keymap file default.map. Default keymap will be used instead.
Dlgalert.bmp Cannot Be Loaded.
Can't find file agencyfb20.d3f
Cannot find the file assets\graphics\agencyfb14.d3f.
For Microsoft Age of Empires 2, you may receive the following error message:
The scenario could not be loaded.
Note This happens with the second campaign, after you have beaten the first one.

Or, when you finish a race, the game may stop responding (hang) or your mouse pointer may disappear.

Or, when joining a CFS1 or CFS2 multiplayer session you may receive an error stating that some planes are unavailable or locked even though those planes are unlocked in the Multiplayer settings on the Host computer.

Or, you may lose keyboard functions within the game. And, upon going to the options menu to reassign keyboard assignments, you may find that the keyboard assignments are cleared out and non-configurable.

CAUSE

This issue may occur if the Wsock32.dll file on your computer is infected with the W95.Hybris worm virus.

Note This can also occur if the Wsock32.dll file is corrupted.

RESOLUTION

To resolve this issue, run anti-virus software that contains the latest virus signature file, and perform a thorough scan of your computer.

Support for this particular virus is available from many anti-virus programs.

After you detect and remove the virus, extract a new copy of the Wsock32.dll file. Use the steps below for your version of Windows operating system.

Microsoft Windows Millennium (Me)

The Windows Millennium (Me) system files are protected. To extract protected files, follow the steps given in the following Microsoft Knowledge Base article:

265371 How to Extract and Replace a Protected File in Windows Me

In Microsoft Windows 98

  1. Click Start, click Run, type sfc in the Open box, and then click OK.
  2. Click Extract one file from the installation disk.
  3. Type c:\windows\system\wsock32.dll, and then click Start.
  4. In the Restore from box, type c:\windows\options\cabs or browse to the Win98 folder on your Windows 98 CD-ROM.
  5. Click OK, and then click Skip to skip the back up of the file. (If you click OK, you might back up the virus.)
  6. Follow the instructions that appear on the screen to complete the installation, and then restart the computer.
The Wsock32.dll file is located in the Precopy1.cab cabinet file on the Windows 98 CD-ROM.

In Microsoft Windows 95

The Wsock32.dll file can be found in the following CAB files:
  • Win95_11.cab on the Windows 95 CD-ROM
  • Win95_18.cab on the Windows 95 OSR2 CD-ROM
  • Win95_12.cab on the Windows 95 DMF disks
  • Win95_19.cab on the Windows 95 non-DMF disks
To extract the Wsock32.dll file, from the Windows 95 CD-ROM:
  1. Click Start, click Shut down, and then click Restart in MS-DOS mode.
  2. Either type

    extract /a c:\windows\options\cabs\win95_11.cab wsock32.dll /l c:\windows\system

    or

    Insert your Windows 95 CD-ROM into your CD-ROM drive, and then type

    extract /a d:\win95\win95_11.cab wsock32.dll /l c:\windows\system

    where d is the drive letter of your CD-ROM drive.

In Microsoft Windows NT 4.0

  1. Rename the Wsock32.dll file in the Windows\System32 folder to Wsock32.old. For information about how to rename a file, click Start, click Help, click the Index tab, type renaming, and then double-click the Renaming files topic.

  2. Click Start, point to Programs, and then click Command Prompt
  3. Type cd\, and then press ENTER.
  4. Insert the Windows NT 4.0 CD-ROM into the CD-ROM drive, and then close the Windows NT Setup screen if it is displayed.
  5. Type the following line at the command prompt, and then press ENTER:

    expand drive:\i386\wsock32.dl_ c:\windows\system32\wsock32.dll

    where drive is the drive letter assigned to your CD-ROM drive, and where windows is the name of the folder in which Windows NT 4.0 is installed.
  6. Type exit, and then press ENTER to return to windows.
For additional information about how to extract files from the Windows CD-ROM or a Windows floppy disk, click the following article number to view the article in the Microsoft Knowledge Base:

129605 How to Extract Original Compressed Windows Files

MORE INFORMATION

It is possible to detect HYBRIS by using the Find program (Search in Windows Me/Windows 2000). Search the system for the Wsock32.dll file by using the Containing Text field. To do this, follow these steps:
  1. Click Start, point to Find, and then click Files or Folders. In Windows ME/Windows 2000, click Start, point to Search, and then click For files or folders.
  2. In the Named field (or Search for files or folders named:) type wsock32.dll.
  3. In the Containing Text field, type Hybris.
  4. Click Find Now (or Search Now).
Note The Containing Text field is on the Advanced tab in Windows 95.

If Windows finds any files, then the system may be infected with the HYBRIS virus and you should contact your antivirus vendor. For additional information about third-party antivirus vendors and products, click the following article number to view the article in the Microsoft Knowledge Base:

49500 List of Antivirus Software Vendors

For more detailed information about this particular virus, visit the following Web site:

http://www.mcafee.com

Modification Type:MinorLast Reviewed:6/20/2005
Keywords:kbConfig kberrmsg kbprb KB285327
©2004 Microsoft Corporation. All rights reserved.