DiamondCS dcsws2.dll?? Can I delete safely pereserving WinSock integrity?

Discussion in 'ProcessGuard' started by racketeer66, Aug 7, 2006.

Thread Status:
Not open for further replies.
  1. racketeer66

    racketeer66 Registered Member

    Joined:
    Mar 19, 2006
    Posts:
    84
    Location:
    Hungary
    Hello!
    After uniinstalling Process Guard I found this dcsws2.dll (3 copies!) very deep in my system. I don't know why is still there - I guess it Shouldn't! As it's stuck such deep in my system, I 'm sfraid to delete it- don't want to lose my WinSock-settings.
    One thing is for sure, as I 've uninstalled Diamond Process Guard-it shoud have gone with it.
    Please, help me, whwt can I do t get rid of this file (dcsws2.dll) safely?
    I copy my Autoruns findings here:

    HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9 DiamondCS TCP/IP Layer [RAW]dcsws2 (Not verified) DiamondCS c:\windows\system32\dcsws2.dll
    Any help is greatly appreciated!
     
    Last edited: Aug 7, 2006
  2. Paranoid2000

    Paranoid2000 Registered Member

    Joined:
    May 2, 2004
    Posts:
    2,839
    Location:
    North West, United Kingdom
    Dcsws2.dll is used by Port Explorer, not Process Guard so should be left alone if Port Explorer is still present on your system.
     
  3. racketeer66

    racketeer66 Registered Member

    Joined:
    Mar 19, 2006
    Posts:
    84
    Location:
    Hungary
    It is not, I tried it long ago - but I uninstalled it a year ago.
    Can I remove those files? And afterwards do I have to reestablish my WinSock-settings?
    Thanx for Your reply (also congratulations for Your perfect tutorial on secure Settings-Outpost:). I configured Outpost accordingly-and it works like an angel.
    Br:
    Ivan
     
  4. StriderSkorpion

    StriderSkorpion Registered Member

    Joined:
    Feb 24, 2006
    Posts:
    54
    If you've uninstalled Port Explorer, it shouldn't pose a problem. You should also remove the registry entry to prevent any problems. Make a backup of the registry entry and file just in case it does happen to cause problems so you can revert back.
     
  5. racketeer66

    racketeer66 Registered Member

    Joined:
    Mar 19, 2006
    Posts:
    84
    Location:
    Hungary
    Thanx- I moved it with the concurrent registry entries (Autoruns-Jump to...), and my notebook didn't really want to start. This file was in the deepest WinSock layer (really a Port Expl. remnant, not processGuard i was wrong), and caused problems. Had to fix with a useful tool (WinSockFix.exe - Blackspear recommended in NOD32 extra setting thread). Now it's just fine - everything looks stable. Interesting, how such a little file can cause major havoc.:)
    Thanx for Your help once again- BTWI have done exactly the same U recommended instinctively.
    Br:
    Ivan
     
  6. Gavin - DiamondCS

    Gavin - DiamondCS Former DCS Moderator

    Joined:
    Feb 10, 2002
    Posts:
    2,080
    Location:
    Perth, Western Australia
    Generally speaking, you should not have a problem when using this command

    regsvr32 -u dcsws2.dll

    Just reboot afterwards. But yes NOD32 for example does layer itself around the Winsock stack, and is quite complex. Sometimes it needs a nudge to get back to normal after inserting or removing another LSP.
     
  7. racketeer66

    racketeer66 Registered Member

    Joined:
    Mar 19, 2006
    Posts:
    84
    Location:
    Hungary
    Exactly-just what I noticed! It (dcsws2.dll) spawned TCP/IP processes(imon). But I succeeded and reestablished my WinSock. I'll buy ProcessGuard anyway-but for the time being I guess I use enough protection - more should be overkill:)
    (Outpost 3.51, Spywareblaster, NOD32, WinDefender, DropMyRights, IE-Spyad)
    Setting ProcessGuard atop of it should slow my system to a considerable extent.
    Thanx for Your time and contribution - it's most appreciated!
    And also sorry for my misjudging dcsws2.dll as a ProcesGuard - remnant - I haven't used Port Explorer for a long time. Some moderator in charge should move this thread to the relevant topic.
     
Thread Status:
Not open for further replies.