Unknown ShellExecuteHook

[Olivier Avenel]

In Advanced Tools, System, Shell Execute Hooks I find the

following:
"Microsoft.AntiSpyware.ShellExecuteHook.1
This is an unknown Shell Execute Hook."
One would think that this program would know about its
own ShellExecuteHook!

- John

In the same group I also find an "unknown" Shell Execute
Hook in SHELL32.DLL!

Olivier

 

[plun]

Olivier Avenel formulated the question :

In the same group I also find an "unknown" Shell Execute
Hook in SHELL32.DLL!

Olivier

Hi

Try to block it and send to Spynet for analysis, lower/right within
MSAS.

 

[Guest]

OA>> In the same group I also find an "unknown" Shell
OA>> Execute Hook in SHELL32.DLL!Plun> Try to block it and send to Spynet for analysis,
Plun> lower/right within MSAS.

So I blocked it, and rebooted, and it disappeared for good
from the list of Shell Execute Hooks.
But I don't know how I could possibly un-block it as it is
not mentionned anywhere in the list of blocked events. %-)

This was done on French XP-Home-SP2. The same unknown
Shell Execute Hook ("URL Exec Hook" in Shell32.dll) is
also reported on another computer running French XP-Pro-
SP2 with the very same latest version of Shell32.dll.

I think it's a bug in MSAS. But wonder what it changed to
my system.

Olivier

 

[Olivier Avenel]

-----Original Message-----
OA>> In the same group I also find an "unknown" Shell
OA>> Execute Hook in SHELL32.DLL!
Plun> Try to block it and send to Spynet for analysis,
Plun> lower/right within MSAS.

OA> So I blocked it, and rebooted, and it disappeared for
good
OA> from the list of Shell Execute Hooks.
OA> But I don't know how I could possibly un-block it as
it is
OA> not mentionned anywhere in the list of blocked events.
%-)

OK, I found it in the registry. MSAS deleted the following:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersi
on\Explorer\ShellExecuteHooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

which corresponds to "URL Exec" in shell32.dll.

Would be good if MSAS did provide some way to go back
after deleting a key in the registry.

Olivier