Shell32.dll running at startup

[Claude]

Hi,

I have this laptop running WXP-Pro SP1 that has a desktop.ini file that
keeps on showing up in the Startup directory of "All Users" or individual
users.

The file contains the following command:

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

As a result the content of the %systemRoot%\system32 directory keeps on
being displayed when someone logs in to the system.
Steps taken so far:
- I deleted the desktop.ini file from every user's file (under Documents and
Setings) but it keeps on showing back.
- A virus scan has been performed with the latest patern & program from
Trend's OfficeScan; no virus was found;
- I have looked in the Registry under
HKLM\software\Microsoft\Windows\Currentversion\Run and found nothing
irregular. All the programs listed seem legitimate. Those I suspected I
removed one by one (after backing up the key content) and rebooted the
system... no effect on the System32 dir. content showing up.

It does not seem to be doing anything else that could be malicious however
it is very annoying!

There's got to be something somewhere that makes it re-appear but I do not
know where to look for anymore.
Any help would be much appreciated.

Thanks,
Claude

 

[David Candy]

Put the hidden attribute back on it. This is a user caused issue.

 

[Claude]

David,

The desktop.ini file I am referring to already had the hidden attribute ....
If you were referring to the attibutes of Shell32.dll it is not set to
hidden on other workstations we have!? I also looked for the same
desktop.ini file on other stations and found out it is not there...!?

Unless I misunderstood what you meant... I still have the same problem.

Claude

"David Candy" <.> wrote in message
Put the hidden attribute back on it. This is a user caused issue.

 

[David Candy]

It has hidden and system set. Hidden prevents it from executing. System keeps it super hidden (only a display setting). Only hidden is needed (and only in the startup folders at that). All other desktop.ini don't care. But startup runs any files in that folder. If it is not hidden it will run. A lot of programs can't see hidden files.

--
----------------------------------------------------------
http://www.uscricket.com

David,

The desktop.ini file I am referring to already had the hidden attribute ....
If you were referring to the attibutes of Shell32.dll it is not set to
hidden on other workstations we have!? I also looked for the same
desktop.ini file on other stations and found out it is not there...!?

Unless I misunderstood what you meant... I still have the same problem.

Claude

"David Candy" <.> wrote in message
Put the hidden attribute back on it. This is a user caused issue.

--
----------------------------------------------------------
http://www.uscricket.com

Hi,

I have this laptop running WXP-Pro SP1 that has a desktop.ini file that
keeps on showing up in the Startup directory of "All Users" or individual
users.

The file contains the following command:

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

As a result the content of the %systemRoot%\system32 directory keeps on
being displayed when someone logs in to the system.
Steps taken so far:
- I deleted the desktop.ini file from every user's file (under Documents and
Setings) but it keeps on showing back.
- A virus scan has been performed with the latest patern & program from
Trend's OfficeScan; no virus was found;
- I have looked in the Registry under
HKLM\software\Microsoft\Windows\Currentversion\Run and found nothing
irregular. All the programs listed seem legitimate. Those I suspected I
removed one by one (after backing up the key content) and rebooted the
system... no effect on the System32 dir. content showing up.

It does not seem to be doing anything else that could be malicious however
it is very annoying!

There's got to be something somewhere that makes it re-appear but I do not
know where to look for anymore.
Any help would be much appreciated.

Thanks,
Claude