Re: system 32/shell 32.dll

Barb,

Make sure that your McAfee has the latest updated DAT files!!!

Apparently there was something wrong with the 4715 DAT files, you need the
4716 DAT files. And you need to take some other steps.

[[The 4715 DAT files contain an incorrect identification on W95/CTX under
the following products:
On Demand Scanner (ODS) Components Only
(the detection does not occur with the On Access Scanner (OAS), nor with
gateway or email scanners)

a.. VirusScan Enterprise 8.0i
b.. VirusScan Enterprise 7.1
c.. VirusScan Enterprise 7.0
d.. Managed VirusScan 4.0
e.. Managed VirusScan 3.5
f.. VirusScan Online 11
g.. VirusScan Online 10
h.. LinuxShield
i.. VirusScan 7.03 (consumer)
These product may report certain executable files as being infected with a
variant of W95/CTX. At that point the files may be renamed as
filename.exe.vir. However, the point product's secondary action can result
in the file being deleted.

Correct W95/CTX detections are reported as W95/CTX.6886 or W95/CTX.10853]]

[[The 4716 DAT files have been posted to correct this issue. If you are
seeing W95/CTX detection, ensure that you are running the 4716 DAT files or
newer.]]
from...
W95/CTX
http://vil.nai.com/vil/content/v_138884.htm

Click the link to read the whole McAfee article.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:D39BE663-C327-40C0-9426-286A24CB1B92@xxxxxxxxxxxxx,
Barbara <Barbara@xxxxxxxxxxxxxxxxxxxxxxxxx> hunted and pecked:
David,

I opened an email attachment yesterday and got a window that said
something was intruding and then everything went haywire. A virus
corrupted 27 files named - W95/CXT-

After restarting the computer, I got a window from Notepad with this in it
--- [.shellclassinfo localized resource
name=systemroot%\system32\shel32.dll]
- I did not remove anything. It was removed by this virus. I have never
seen this before yesterday.

According to McAfee, the W95/CXT virus is a new virus that came out
3/10/06. It wiped out Outlook Express, all of my Favorites, most of the
icons on desktop, and now none of my settings will save, even though when
I shut down the computer it says it's saving my settings.

I am a little confused when you say "These are files that should exist. "
as I am getting direction that this file should not exist and directed to
this web page to correct the problem.
http://support.microsoft.com/kb/330132 - I have followed the directions,
both method 1 and 2, and it does not help the problem.

Can you tell me how to correct this problem so my settings will save?

Thanks,
Barb

"David Candy" wrote:

These are files that should exist. Depending on XP's language they make
parts of Start appear in the correct language. If it opens in notepad at
start then YOU removed the hidden attribute from the file.



--
-------------------------------------------------------------------------
-------------------------
Goodbye Web Diary

http://margokingston.typepad.com/harry_version_2/2005/12/thank_you_and_g.html#comments
=================================================
"Barbara" <Barbara@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:3E056AB0-87FE-49D5-989F-A69DD8BCFF79@xxxxxxxxxxxxxxxx
Ok - I just figured out how to post back in.

Yes I did that. I did not just delete the line - I deleted the whole
file -desktop.ini - if it contained [.ShellClassInfo]>
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

Yes I did delete the files in the Temp folders that contained that
line, but it doesn't stay deleted. When I restart the computer and do a
search, the same Temp files are contaminiated again. I have cleaned
them 3 times but they don't stay cleaned. The only files on the
computer right now that contain the desktop.ini file are in the Temp
files. Unless there are more files and Search is not finding them.

Also, the 2 files in Windows Explorer you said to uncheck - Hide
extensions and Hide operating systems - I have unchecked them 3 times
but, when shutting down the computer and starting it back up, they are
checked again.

But isn't that the problem. No settings can be saved. So why would it
save any settings in Windows Explorer any more than any where else?

I have re-scanned with McAfee to make sure the virus is gone and it is
gone - so I'm not being re-infected.

This virus - W95/CTX - is a new virus that came out yesterday. McAfee
did not stop it on my computer. I had 27 infected files. When I look at
these files, some are the ones I have cleaned, but there are many other
kinds of files. The files have been quaranteened because McAfee
software says you cannot clean them.

Obviously, the maker of this virus has found a way to twart the
standard way to fix this problem. The standard way doesn't work. Any
ideas?

thanks,
Barb



"Wesley Vogel" wrote:

Barb,

You need to post back in one of the same threads as you posted in
originally. It makes it too hard for anyone to find your posts
otherwise.

Don't delete the line within the desktop.ini file, delete the whole
desktop.ini file.

The only desktop.ini file(s) that you would want to delete are any that
contain these lines:

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

However, you shouldn't have any desktop.ini files in any temp folders,
so those would be OK to delete, no matter what the desktop.ini files
have in them.

This temp folder, C:\WINDOWS\Temp ??

Or this one, C:\Documents and Settings\Your Name Here\Local
Settings\Temp ??

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:B1F043C0-BCEB-4DA1-9F94-7763CE4F4DA3@xxxxxxxxxxxxx,
Barbara <Barbara@xxxxxxxxxxxxxxxxxxxxxxxxx> hunted and pecked:
Thanks for your help earlier with the desktop [.shelclassinfo]
localizedresource name=systemroot\system32\shell32.dll -21787,
however, I followed your directions - used Method 1 and 2 with
msconfig. But still having the same problems and this file pops up at
startup. Tried saving some settings but they don't save after turning
the computer off and then back on.

The desktop.ini file did not appear in the files named but I did find
them using Search in the Temp files. Should I delte those?

Any other suggestions?

Thanks,
Barb

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:7B911C07-10F7-4FB8-B3C6-D2235A6518AC@xxxxxxxxxxxxx,
Barbara <Barbara@xxxxxxxxxxxxxxxxxxxxxxxxx> hunted and pecked:
To W. Vogel - I have followed your directions and tried to clear this
line as you have previously instructed using both methods -
[.shelclassinfo localized resource
name=systemroot%\system32\shel32.dll -21787 - but on startup, the
window Desktop Notepad still pops up with this line. I still cannot
save any settings.

In Method 1, I deleted the desktop.ini files containing that line in
the following --
drive:\Documents and Settings\All Users\Start Menu\Programs\Startup
• drive:\Documents and Settings\All Users\Start Menu\Programs
• drive:\Documents and Settings\All Users\Start Menu

When doing a search for the desktop.ini file, these files no longer
come up.

I also unchecked "Hide extensions for known file types" and "Hide
protected operating system." But when I shut down the computer and
turn it back on, these are checked again.

I tried the 2nd method with msconfig - There was one Adobe file with
Common Startup and I deleted that. That remains deleted.

I also cleaned out the Temp files that contain this line, but when I
shut down the computer and start up again and do another search, the
same files are contaminated again.

The virus - W95/CTX - has obviously found a way to get around fixing
this problem. The usual method is not working.

What else do you suggest?? There must be another way.

Thanks,
Barbara

.

Relevant Pages

  • Re: system 32/shell 32.dll
    ... Use of AVG Free Edition within any organization or for commercial ... MS-MVP Windows Shell/User ... Yes it appears that McAfee does not protect my computer as this is the 3rd ... Question: Is W95/CXT a virus? ...
    (microsoft.public.windowsxp.perform_maintain)
  • Re: system 32/shell 32.dll
    ... MS-MVP Windows Shell/User ... Barbara hunted and pecked: ... McAfee Update Breaks Hundreds Of Apps ... flagged hundreds of legitimate executables as a malicious virus, ...
    (microsoft.public.windowsxp.perform_maintain)
  • Re: system 32/shell 32.dll
    ... Correct W95/CTX detections are reported as W95/CTX.6886 or W95/CTX.10853 ... McAfee doesn't say how you get W95/CTX.6886 or W95/CTX.10853. ... MS-MVP Windows Shell/User ... Question: Is W95/CXT a virus? ...
    (microsoft.public.windowsxp.perform_maintain)
  • Re: system 32/shell 32.dll
    ... McAfee Update Breaks Hundreds Of Apps ... hundreds of legitimate executables as a malicious virus, ... MS-MVP Windows Shell/User ... VirusScan Enterprise 8.0i ...
    (microsoft.public.windowsxp.perform_maintain)
  • Re: svchost consuming CPU even after boot-up
    ... Norton, McAfee, TrendMicro etc.) then please do a FREE online virus scan from ... Once you have properly cleaned your pc please install SpywareBlaster ... latest version of Windows Update and the patch for the SVCHOST issue ...
    (microsoft.public.windowsxp.perform_maintain)