Re: system 32/shell 32.dll

Ok - I just figured out how to post back in.

Yes I did that. I did not just delete the line - I deleted the whole file
-desktop.ini - if it contained [.ShellClassInfo]>
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

Yes I did delete the files in the Temp folders that contained that line, but
it doesn't stay deleted. When I restart the computer and do a search, the
same Temp files are contaminiated again. I have cleaned them 3 times but they
don't stay cleaned. The only files on the computer right now that contain the
desktop.ini file are in the Temp files. Unless there are more files and
Search is not finding them.

Also, the 2 files in Windows Explorer you said to uncheck - Hide extensions
and Hide operating systems - I have unchecked them 3 times but, when shutting
down the computer and starting it back up, they are checked again.

But isn't that the problem. No settings can be saved. So why would it save
any settings in Windows Explorer any more than any where else?

I have re-scanned with McAfee to make sure the virus is gone and it is gone
- so I'm not being re-infected.

This virus - W95/CTX - is a new virus that came out yesterday. McAfee did
not stop it on my computer. I had 27 infected files. When I look at these
files, some are the ones I have cleaned, but there are many other kinds of
files. The files have been quaranteened because McAfee software says you
cannot clean them.

Obviously, the maker of this virus has found a way to twart the standard way
to fix this problem. The standard way doesn't work. Any ideas?

thanks,
Barb



"Wesley Vogel" wrote:

Barb,

You need to post back in one of the same threads as you posted in
originally. It makes it too hard for anyone to find your posts otherwise.

Don't delete the line within the desktop.ini file, delete the whole
desktop.ini file.

The only desktop.ini file(s) that you would want to delete are any that
contain these lines:

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

However, you shouldn't have any desktop.ini files in any temp folders, so
those would be OK to delete, no matter what the desktop.ini files have in
them.

This temp folder, C:\WINDOWS\Temp ??

Or this one, C:\Documents and Settings\Your Name Here\Local Settings\Temp ??

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:B1F043C0-BCEB-4DA1-9F94-7763CE4F4DA3@xxxxxxxxxxxxx,
Barbara <Barbara@xxxxxxxxxxxxxxxxxxxxxxxxx> hunted and pecked:
Thanks for your help earlier with the desktop [.shelclassinfo]
localizedresource name=systemroot\system32\shell32.dll -21787, however, I
followed your directions - used Method 1 and 2 with msconfig. But still
having the same problems and this file pops up at startup. Tried saving
some settings but they don't save after turning the computer off and then
back on.

The desktop.ini file did not appear in the files named but I did find them
using Search in the Temp files. Should I delte those?

Any other suggestions?

Thanks,
Barb

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:7B911C07-10F7-4FB8-B3C6-D2235A6518AC@xxxxxxxxxxxxx,
Barbara <Barbara@xxxxxxxxxxxxxxxxxxxxxxxxx> hunted and pecked:
To W. Vogel - I have followed your directions and tried to clear this
line as you have previously instructed using both methods -
[.shelclassinfo localized resource name=systemroot%\system32\shel32.dll
-21787 - but on startup, the window Desktop Notepad still pops up with
this line. I still cannot save any settings.

In Method 1, I deleted the desktop.ini files containing that line in the
following --
drive:\Documents and Settings\All Users\Start Menu\Programs\Startup
• drive:\Documents and Settings\All Users\Start Menu\Programs
• drive:\Documents and Settings\All Users\Start Menu

When doing a search for the desktop.ini file, these files no longer come
up.

I also unchecked "Hide extensions for known file types" and "Hide
protected operating system." But when I shut down the computer and turn
it back on, these are checked again.

I tried the 2nd method with msconfig - There was one Adobe file with
Common Startup and I deleted that. That remains deleted.

I also cleaned out the Temp files that contain this line, but when I shut
down the computer and start up again and do another search, the same files
are contaminated again.

The virus - W95/CTX - has obviously found a way to get around fixing this
problem. The usual method is not working.

What else do you suggest?? There must be another way.

Thanks,
Barbara


.

Relevant Pages

  • Re: Trojan?
    ... > "Will Denny" wrote in message ... > MS-MVP Windows Shell/User ... >> Reboot your PC to make sure that no Temp files are being used, ... >>> How can I fully clean out the Temp files and what are the 'pdk' folders. ...
    (microsoft.public.windowsxp.basics)
  • Re: Trojan?
    ... I tried deleting from Safe Mode with Command prompt. ... "pdk' folders culprit. ... > MS-MVP Windows Shell/User ... >>>I recently noticed 'pdk--xxxx' folders in my Temp files that occur ...
    (microsoft.public.windowsxp.basics)
  • Re: Temp Files
    ... Wes ... MS-MVP Windows Shell/User ... RS Thurman hunted and pecked: ... > number of temp files that need to be removed but I cannot find. ...
    (microsoft.public.windowsxp.newusers)
  • Re: Trojan?
    ... Reboot your PC to make sure that no Temp files are being used, ... MS-MVP Windows Shell/User ... > every time I boot. ... > How can I fully clean out the Temp files and what are the 'pdk' folders. ...
    (microsoft.public.windowsxp.basics)
  • Re: Crash, crash and more crash
    ... Click on Settings under Startup and Recovery and disable 'Automatically ... Next time your PC reboots, you should see a Blue Screen. ... MS-MVP Windows Shell/User ...
    (microsoft.public.windowsxp.general)