Re: system 32/shell 32.dll

Wesley,

Thanks again.

The End.

(I'll be back)

Barb

"Wesley Vogel" wrote:

McAfee sucks. Norton is not much better, though I have never used Norton.

You must have downloaded the wrong version of AVG.

[[AVG Free Edition is for private, non-commercial, single home computer use
only. Use of AVG Free Edition within any organization or for commercial
purposes is strictly prohibited.]]
http://free.grisoft.com/freeweb.php/doc/2/lng/us/tpl/v5

The AVG version on from the link above is the FREE version.

This page has a trial version of AVG Professional (Pay version)
http://free.grisoft.com/doc/11/lng/us/tpl/v5

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:C306523E-94FB-4F36-9274-8B24E60E11D8@xxxxxxxxxxxxx,
Barbara <Barbara@xxxxxxxxxxxxxxxxxxxxxxxxx> hunted and pecked:
Wesley,

Yes it appears that McAfee does not protect my computer as this is the 3rd
time I've had viruses. Is Norton any better? I'm going to post a new
question related to problems I've been having since the last time I had
viruses that messed up my computer.

I am trying Grisoft on my old Windows ME computer in the other room. (I'm
definitely getting rid of McAfee.) But it's not free. The trial is free
for 30 days but then you have to pay for it. Good to know you recommend
it. I will go ahead and get it on this computer.

Thanks again. I can't afford a new computer right now so I'm trying to
make this one last a while.

Barb

"Wesley Vogel" wrote:

Question: Is W95/CXT a virus? Did it come thru an email attachment I
opened?? If not, how did I get it?? Where did it come from??

Correct W95/CTX detections are reported as W95/CTX.6886 or W95/CTX.10853

McAfee doesn't say how you get W95/CTX.6886 or W95/CTX.10853.

SWAG: It looks to me like W95/CTX was a false positive (incorrect
identification). McAfee screwed up something, so some files got deleted
that did not need to get deleted and in the process screwed up your
profile.

I dumped McAfee a long time ago and I use a different AV software.

AVG Free for Windows is a free anti-virus protection tool developed by
Grisoft for home use.

Get Your AVG 7 for free!
http://free.grisoft.com/freeweb.php/doc/2/lng/us/tpl/v5

Tips for using AVG Free 7.0 Antivirus
http://mvps.org/winhelp2002/avg7.htm

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:E2179680-5D7D-4B0C-8938-CAC18667FBE6@xxxxxxxxxxxxx,
Barbara <Barbara@xxxxxxxxxxxxxxxxxxxxxxxxx> hunted and pecked:
David and Wesley,

I am trying to understand this about the DAT files. I went ahead and
did a system restore. The 2 methods I tried yesterday did not correct
the problem. During the restore process, it asked if I wanted to delete
the quaranteened files (the virus infected files) and I said yes. So
they are gone. In the past when I've had viruses that ruined my
computer, I tried Restore but it didn't work and I had to reinstall
Windows - but this time it worked. I set the date back to 3/9/06 and
SURPRISE !!! - My computer is back again. I had to remove McAfee and
reinstall it but everything else seems to be working fine.

I read the info you provided in this link and looked at the About - it
says I have DAT Version 4716 created 3/10/06.

Question: Is W95/CXT a virus? Did it come thru an email attachment I
opened?? If not, how did I get it?? Where did it come from??

Is there anything else I need to do??

Thanks again,
Barb

"Wesley Vogel" wrote:

Barb,

Make sure that your McAfee has the latest updated DAT files!!!

Apparently there was something wrong with the 4715 DAT files, you need
the 4716 DAT files. And you need to take some other steps.

[[The 4715 DAT files contain an incorrect identification on W95/CTX
under the following products:
On Demand Scanner (ODS) Components Only
(the detection does not occur with the On Access Scanner (OAS), nor
with gateway or email scanners)

a.. VirusScan Enterprise 8.0i
b.. VirusScan Enterprise 7.1
c.. VirusScan Enterprise 7.0
d.. Managed VirusScan 4.0
e.. Managed VirusScan 3.5
f.. VirusScan Online 11
g.. VirusScan Online 10
h.. LinuxShield
i.. VirusScan 7.03 (consumer)
These product may report certain executable files as being infected
with a variant of W95/CTX. At that point the files may be renamed as
filename.exe.vir. However, the point product's secondary action can
result in the file being deleted.

Correct W95/CTX detections are reported as W95/CTX.6886 or
W95/CTX.10853]]

[[The 4716 DAT files have been posted to correct this issue. If you
are seeing W95/CTX detection, ensure that you are running the 4716 DAT
files or newer.]]
from...
W95/CTX
http://vil.nai.com/vil/content/v_138884.htm

Click the link to read the whole McAfee article.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:D39BE663-C327-40C0-9426-286A24CB1B92@xxxxxxxxxxxxx,
Barbara <Barbara@xxxxxxxxxxxxxxxxxxxxxxxxx> hunted and pecked:
David,

I opened an email attachment yesterday and got a window that said
something was intruding and then everything went haywire. A virus
corrupted 27 files named - W95/CXT-

After restarting the computer, I got a window from Notepad with this
in it --- [.shellclassinfo localized resource
name=systemroot%\system32\shel32.dll]
- I did not remove anything. It was removed by this virus. I have
never seen this before yesterday.

According to McAfee, the W95/CXT virus is a new virus that came out
3/10/06. It wiped out Outlook Express, all of my Favorites, most of
the icons on desktop, and now none of my settings will save, even
though when I shut down the computer it says it's saving my settings.

I am a little confused when you say "These are files that should
exist. " as I am getting direction that this file should not exist
and directed to this web page to correct the problem.
http://support.microsoft.com/kb/330132 - I have followed the
directions, both method 1 and 2, and it does not help the problem.

Can you tell me how to correct this problem so my settings will save?

Thanks,
Barb

"David Candy" wrote:

These are files that should exist. Depending on XP's language they
make parts of Start appear in the correct language. If it opens in
notepad at start then YOU removed the hidden attribute from the file.



--
---------------------------------------------------------------------
--
--
------------------------- Goodbye Web Diary



http://margokingston.typepad.com/harry_version_2/2005/12/thank_you_and_g.html#comments
=================================================
"Barbara" <Barbara@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:3E056AB0-87FE-49D5-989F-A69DD8BCFF79@xxxxxxxxxxxxxxxx
Ok - I just figured out how to post back in.

Yes I did that. I did not just delete the line - I deleted the whole
file -desktop.ini - if it contained [.ShellClassInfo]>
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

Yes I did delete the files in the Temp folders that contained that
line, but it doesn't stay deleted. When I restart the computer and
do a search, the same Temp files are contaminiated again. I have
cleaned them 3 times but they don't stay cleaned. The only files on
the computer right now that contain the desktop.ini file are in the
Temp files. Unless there are more files and Search is not finding
them.

Also, the 2 files in Windows Explorer you said to uncheck - Hide
extensions and Hide operating systems - I have unchecked them 3
times but, when shutting down the computer and starting it back up,
they are checked again.

But isn't that the problem. No settings can be saved. So why would
it save any settings in Windows Explorer any more than any where
else?

I have re-scanned with McAfee to make sure the virus is gone and it
is gone - so I'm not being re-infected.

This virus - W95/CTX - is a new virus that came out yesterday.
McAfee did not stop it on my computer. I had 27 infected files.
When I look at these files, some are the ones I have cleaned, but
there are many other kinds of files. The files have been
quaranteened because McAfee software says you cannot clean them.

Obviously, the maker of this virus has found a way to twart the
standard way to fix this problem. The standard way doesn't work. Any
ideas?

thanks,
Barb



"Wesley Vogel" wrote:

Barb,

You need to post back in one of the same threads as you posted in
originally. It makes it too hard for anyone to find your posts
otherwise.

Don't delete the line within the desktop.ini file, delete the whole
desktop.ini file.

The only desktop.ini file(s) that you would want to delete are any
that contain these lines:

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

However, you shouldn't have any desktop.ini files in any temp
folders, so those would be OK to delete, no matter what the
desktop.ini files have in them.

This temp folder, C:\WINDOWS\Temp ??

Or this one, C:\Documents and Settings\Your Name Here\Local
Settings\Temp ??

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:B1F043C0-BCEB-4DA1-9F94-7763CE4F4DA3@xxxxxxxxxxxxx,
Barbara <Barbara@xxxxxxxxxxxxxxxxxxxxxxxxx> hunted and pecked:
Thanks for your help earlier with the desktop [.shelclassinfo]
localizedresource name=systemroot\system32\shell32.dll -21787,
however, I followed your directions - used Method 1 and 2 with
msconfig. But still having the same problems and this file pops up
at startup. Tried saving some settings but they don't save after
turning
the computer off and then back on.

The desktop.ini file did not appear in the files named but I did
find
them using Search in the Temp files. Should I delte those?

Any other suggestions?

Thanks,
Barb

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:7B911C07-10F7-4FB8-B3C6-D2235A6518AC@xxxxxxxxxxxxx,
Barbara <Barbara@xxxxxxxxxxxxxxxxxxxxxxxxx> hunted and pecked:
To W. Vogel - I have followed your directions and tried to clear
this
line as you have previously instructed using both methods -
[.shelclassinfo localized resource
name=systemroot%\system32\shel32.dll -21787 - but on startup, the
window Desktop Notepad still pops up with this line. I still
cannot
save any settings.
.

Relevant Pages

  • Re: system 32/shell 32.dll
    ... Make sure that your McAfee has the latest updated DAT files!!! ... Apparently there was something wrong with the 4715 DAT files, ... MS-MVP Windows Shell/User ... It was removed by this virus. ...
    (microsoft.public.windowsxp.perform_maintain)
  • Re: system 32/shell 32.dll
    ... MS-MVP Windows Shell/User ... Barbara hunted and pecked: ... McAfee Update Breaks Hundreds Of Apps ... flagged hundreds of legitimate executables as a malicious virus, ...
    (microsoft.public.windowsxp.perform_maintain)
  • Re: system 32/shell 32.dll
    ... Correct W95/CTX detections are reported as W95/CTX.6886 or W95/CTX.10853 ... McAfee doesn't say how you get W95/CTX.6886 or W95/CTX.10853. ... MS-MVP Windows Shell/User ... Question: Is W95/CXT a virus? ...
    (microsoft.public.windowsxp.perform_maintain)
  • Re: system 32/shell 32.dll
    ... McAfee Update Breaks Hundreds Of Apps ... hundreds of legitimate executables as a malicious virus, ... MS-MVP Windows Shell/User ... VirusScan Enterprise 8.0i ...
    (microsoft.public.windowsxp.perform_maintain)
  • Re: system 32/shell 32.dll
    ... Use of AVG Free Edition within any organization or for commercial ... MS-MVP Windows Shell/User ... Yes it appears that McAfee does not protect my computer as this is the 3rd ... Question: Is W95/CXT a virus? ...
    (microsoft.public.windowsxp.perform_maintain)