system 32/shell 32.dll

[Guest]

To W. Vogel - I have followed your directions and tried to clear this line as
you have previously instructed using both methods - [.shelclassinfo localized
resource name=systemroot%\system32\shel32.dll -21787 - but on startup, the
window Desktop Notepad still pops up with this line. I still cannot save any
settings.

In Method 1, I deleted the desktop.ini files containing that line in the
following --
drive:\Documents and Settings\All Users\Start Menu\Programs\Startup
• drive:\Documents and Settings\All Users\Start Menu\Programs
• drive:\Documents and Settings\All Users\Start Menu

When doing a search for the desktop.ini file, these files no longer come up.

I also unchecked "Hide extensions for known file types" and "Hide protected
operating system." But when I shut down the computer and turn it back on,
these are checked again.

I tried the 2nd method with msconfig - There was one Adobe file with Common
Startup and I deleted that. That remains deleted.

I also cleaned out the Temp files that contain this line, but when I shut
down the computer and start up again and do another search, the same files
are contaminated again.

The virus - W95/CTX - has obviously found a way to get around fixing this
problem. The usual method is not working.

What else do you suggest?? There must be another way.

Thanks,
Barbara

 

[Wesley Vogel]

Barb,

You need to post back in one of the same threads as you posted in
originally. It makes it too hard for anyone to find your posts otherwise.

Don't delete the line within the desktop.ini file, delete the whole
desktop.ini file.

The only desktop.ini file(s) that you would want to delete are any that
contain these lines:

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

However, you shouldn't have any desktop.ini files in any temp folders, so
those would be OK to delete, no matter what the desktop.ini files have in
them.

This temp folder, C:\WINDOWS\Temp ??

Or this one, C:\Documents and Settings\Your Name Here\Local Settings\Temp ??

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Thanks for your help earlier with the desktop [.shelclassinfo]
localizedresource name=systemroot\system32\shell32.dll -21787, however, I
followed your directions - used Method 1 and 2 with msconfig. But still
having the same problems and this file pops up at startup. Tried saving
some settings but they don't save after turning the computer off and then
back on.

The desktop.ini file did not appear in the files named but I did find them
using Search in the Temp files. Should I delte those?

Any other suggestions?

Thanks,
Barb

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

To W. Vogel - I have followed your directions and tried to clear this
line as you have previously instructed using both methods -
[.shelclassinfo localized resource name=systemroot%\system32\shel32.dll
-21787 - but on startup, the window Desktop Notepad still pops up with
this line. I still cannot save any settings.

In Method 1, I deleted the desktop.ini files containing that line in the
following --
drive:\Documents and Settings\All Users\Start Menu\Programs\Startup
• drive:\Documents and Settings\All Users\Start Menu\Programs
• drive:\Documents and Settings\All Users\Start Menu

When doing a search for the desktop.ini file, these files no longer come
up.

I also unchecked "Hide extensions for known file types" and "Hide
protected operating system." But when I shut down the computer and turn
it back on, these are checked again.

I tried the 2nd method with msconfig - There was one Adobe file with
Common Startup and I deleted that. That remains deleted.

I also cleaned out the Temp files that contain this line, but when I shut
down the computer and start up again and do another search, the same files
are contaminated again.

The virus - W95/CTX - has obviously found a way to get around fixing this
problem. The usual method is not working.

What else do you suggest?? There must be another way.

Thanks,
Barbara

 

[Guest]

Ok - I just figured out how to post back in.

Yes I did that. I did not just delete the line - I deleted the whole file
-desktop.ini - if it contained [.ShellClassInfo]>
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

Yes I did delete the files in the Temp folders that contained that line, but
it doesn't stay deleted. When I restart the computer and do a search, the
same Temp files are contaminiated again. I have cleaned them 3 times but they
don't stay cleaned. The only files on the computer right now that contain the
desktop.ini file are in the Temp files. Unless there are more files and
Search is not finding them.

Also, the 2 files in Windows Explorer you said to uncheck - Hide extensions
and Hide operating systems - I have unchecked them 3 times but, when shutting
down the computer and starting it back up, they are checked again.

But isn't that the problem. No settings can be saved. So why would it save
any settings in Windows Explorer any more than any where else?

I have re-scanned with McAfee to make sure the virus is gone and it is gone
- so I'm not being re-infected.

This virus - W95/CTX - is a new virus that came out yesterday. McAfee did
not stop it on my computer. I had 27 infected files. When I look at these
files, some are the ones I have cleaned, but there are many other kinds of
files. The files have been quaranteened because McAfee software says you
cannot clean them.

Obviously, the maker of this virus has found a way to twart the standard way
to fix this problem. The standard way doesn't work. Any ideas?

thanks,
Barb

Barb,

You need to post back in one of the same threads as you posted in
originally. It makes it too hard for anyone to find your posts otherwise.

Don't delete the line within the desktop.ini file, delete the whole
desktop.ini file.

The only desktop.ini file(s) that you would want to delete are any that
contain these lines:

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

However, you shouldn't have any desktop.ini files in any temp folders, so
those would be OK to delete, no matter what the desktop.ini files have in
them.

This temp folder, C:\WINDOWS\Temp ??

Or this one, C:\Documents and Settings\Your Name Here\Local Settings\Temp ??

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Thanks for your help earlier with the desktop [.shelclassinfo]
localizedresource name=systemroot\system32\shell32.dll -21787, however, I
followed your directions - used Method 1 and 2 with msconfig. But still
having the same problems and this file pops up at startup. Tried saving
some settings but they don't save after turning the computer off and then
back on.

The desktop.ini file did not appear in the files named but I did find them
using Search in the Temp files. Should I delte those?

Any other suggestions?

Thanks,
Barb

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

To W. Vogel - I have followed your directions and tried to clear this
line as you have previously instructed using both methods -
[.shelclassinfo localized resource name=systemroot%\system32\shel32.dll
-21787 - but on startup, the window Desktop Notepad still pops up with
this line. I still cannot save any settings.

In Method 1, I deleted the desktop.ini files containing that line in the
following --
drive:\Documents and Settings\All Users\Start Menu\Programs\Startup
• drive:\Documents and Settings\All Users\Start Menu\Programs
• drive:\Documents and Settings\All Users\Start Menu

When doing a search for the desktop.ini file, these files no longer come
up.

I also unchecked "Hide extensions for known file types" and "Hide
protected operating system." But when I shut down the computer and turn
it back on, these are checked again.

I tried the 2nd method with msconfig - There was one Adobe file with
Common Startup and I deleted that. That remains deleted.

I also cleaned out the Temp files that contain this line, but when I shut
down the computer and start up again and do another search, the same files
are contaminated again.

The virus - W95/CTX - has obviously found a way to get around fixing this
problem. The usual method is not working.

What else do you suggest?? There must be another way.

Thanks,
Barbara

 

[David Candy]

These are files that should exist. Depending on XP's language they make parts of Start appear in the correct language. If it opens in notepad at start then YOU removed the hidden attribute from the file.



--
--------------------------------------------------------------------------------------------------
Goodbye Web Diary
http://margokingston.typepad.com/harry_version_2/2005/12/thank_you_and_g.html#comments
=================================================

Ok - I just figured out how to post back in.

Yes I did that. I did not just delete the line - I deleted the whole file
-desktop.ini - if it contained [.ShellClassInfo]>
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

Yes I did delete the files in the Temp folders that contained that line, but
it doesn't stay deleted. When I restart the computer and do a search, the
same Temp files are contaminiated again. I have cleaned them 3 times but they
don't stay cleaned. The only files on the computer right now that contain the
desktop.ini file are in the Temp files. Unless there are more files and
Search is not finding them.

Also, the 2 files in Windows Explorer you said to uncheck - Hide extensions
and Hide operating systems - I have unchecked them 3 times but, when shutting
down the computer and starting it back up, they are checked again.

But isn't that the problem. No settings can be saved. So why would it save
any settings in Windows Explorer any more than any where else?

I have re-scanned with McAfee to make sure the virus is gone and it is gone
- so I'm not being re-infected.

This virus - W95/CTX - is a new virus that came out yesterday. McAfee did
not stop it on my computer. I had 27 infected files. When I look at these
files, some are the ones I have cleaned, but there are many other kinds of
files. The files have been quaranteened because McAfee software says you
cannot clean them.

Obviously, the maker of this virus has found a way to twart the standard way
to fix this problem. The standard way doesn't work. Any ideas?

thanks,
Barb

Barb,

You need to post back in one of the same threads as you posted in
originally. It makes it too hard for anyone to find your posts otherwise.

Don't delete the line within the desktop.ini file, delete the whole
desktop.ini file.

The only desktop.ini file(s) that you would want to delete are any that
contain these lines:

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

However, you shouldn't have any desktop.ini files in any temp folders, so
those would be OK to delete, no matter what the desktop.ini files have in
them.

This temp folder, C:\WINDOWS\Temp ??

Or this one, C:\Documents and Settings\Your Name Here\Local Settings\Temp ??

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Thanks for your help earlier with the desktop [.shelclassinfo]
localizedresource name=systemroot\system32\shell32.dll -21787, however, I
followed your directions - used Method 1 and 2 with msconfig. But still
having the same problems and this file pops up at startup. Tried saving
some settings but they don't save after turning the computer off and then
back on.

The desktop.ini file did not appear in the files named but I did find them
using Search in the Temp files. Should I delte those?

Any other suggestions?

Thanks,
Barb

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

To W. Vogel - I have followed your directions and tried to clear this
line as you have previously instructed using both methods -
[.shelclassinfo localized resource name=systemroot%\system32\shel32.dll
-21787 - but on startup, the window Desktop Notepad still pops up with
this line. I still cannot save any settings.

In Method 1, I deleted the desktop.ini files containing that line in the
following --
drive:\Documents and Settings\All Users\Start Menu\Programs\Startup
• drive:\Documents and Settings\All Users\Start Menu\Programs
• drive:\Documents and Settings\All Users\Start Menu

When doing a search for the desktop.ini file, these files no longer come
up.

I also unchecked "Hide extensions for known file types" and "Hide
protected operating system." But when I shut down the computer and turn
it back on, these are checked again.

I tried the 2nd method with msconfig - There was one Adobe file with
Common Startup and I deleted that. That remains deleted.

I also cleaned out the Temp files that contain this line, but when I shut
down the computer and start up again and do another search, the same files
are contaminated again.

The virus - W95/CTX - has obviously found a way to get around fixing this
problem. The usual method is not working.

What else do you suggest?? There must be another way.

Thanks,
Barbara

 

[Guest]

David,

I opened an email attachment yesterday and got a window that said something
was intruding and then everything went haywire. A virus corrupted 27 files
named - W95/CXT-

After restarting the computer, I got a window from Notepad with this in it
--- [.shellclassinfo localized resource name=systemroot%\system32\shel32.dll]
- I did not remove anything. It was removed by this virus. I have never seen
this before yesterday.

According to McAfee, the W95/CXT virus is a new virus that came out 3/10/06.
It wiped out Outlook Express, all of my Favorites, most of the icons on
desktop, and now none of my settings will save, even though when I shut down
the computer it says it's saving my settings.

I am a little confused when you say "These are files that should exist. "
as I am getting direction that this file should not exist and directed to
this web page to correct the problem. http://support.microsoft.com/kb/330132
- I have followed the directions, both method 1 and 2, and it does not help
the problem.

Can you tell me how to correct this problem so my settings will save?

Thanks,
Barb

These are files that should exist. Depending on XP's language they make parts of Start appear in the correct language. If it opens in notepad at start then YOU removed the hidden attribute from the file.



--
--------------------------------------------------------------------------------------------------
Goodbye Web Diary
http://margokingston.typepad.com/harry_version_2/2005/12/thank_you_and_g.html#comments
=================================================

Ok - I just figured out how to post back in.

Yes I did that. I did not just delete the line - I deleted the whole file
-desktop.ini - if it contained [.ShellClassInfo]>
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

Yes I did delete the files in the Temp folders that contained that line, but
it doesn't stay deleted. When I restart the computer and do a search, the
same Temp files are contaminiated again. I have cleaned them 3 times but they
don't stay cleaned. The only files on the computer right now that contain the
desktop.ini file are in the Temp files. Unless there are more files and
Search is not finding them.

Also, the 2 files in Windows Explorer you said to uncheck - Hide extensions
and Hide operating systems - I have unchecked them 3 times but, when shutting
down the computer and starting it back up, they are checked again.

But isn't that the problem. No settings can be saved. So why would it save
any settings in Windows Explorer any more than any where else?

I have re-scanned with McAfee to make sure the virus is gone and it is gone
- so I'm not being re-infected.

This virus - W95/CTX - is a new virus that came out yesterday. McAfee did
not stop it on my computer. I had 27 infected files. When I look at these
files, some are the ones I have cleaned, but there are many other kinds of
files. The files have been quaranteened because McAfee software says you
cannot clean them.

Obviously, the maker of this virus has found a way to twart the standard way
to fix this problem. The standard way doesn't work. Any ideas?

thanks,
Barb

Barb,

You need to post back in one of the same threads as you posted in
originally. It makes it too hard for anyone to find your posts otherwise.

Don't delete the line within the desktop.ini file, delete the whole
desktop.ini file.

The only desktop.ini file(s) that you would want to delete are any that
contain these lines:

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

However, you shouldn't have any desktop.ini files in any temp folders, so
those would be OK to delete, no matter what the desktop.ini files have in
them.

This temp folder, C:\WINDOWS\Temp ??

Or this one, C:\Documents and Settings\Your Name Here\Local Settings\Temp ??

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Barbara <[email protected]> hunted and pecked:
Thanks for your help earlier with the desktop [.shelclassinfo]
localizedresource name=systemroot\system32\shell32.dll -21787, however, I
followed your directions - used Method 1 and 2 with msconfig. But still
having the same problems and this file pops up at startup. Tried saving
some settings but they don't save after turning the computer off and then
back on.

The desktop.ini file did not appear in the files named but I did find them
using Search in the Temp files. Should I delte those?

Any other suggestions?

Thanks,
Barb

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Barbara <[email protected]> hunted and pecked:
To W. Vogel - I have followed your directions and tried to clear this
line as you have previously instructed using both methods -
[.shelclassinfo localized resource name=systemroot%\system32\shel32.dll
-21787 - but on startup, the window Desktop Notepad still pops up with
this line. I still cannot save any settings.

In Method 1, I deleted the desktop.ini files containing that line in the
following --
drive:\Documents and Settings\All Users\Start Menu\Programs\Startup
• drive:\Documents and Settings\All Users\Start Menu\Programs
• drive:\Documents and Settings\All Users\Start Menu

When doing a search for the desktop.ini file, these files no longer come
up.

I also unchecked "Hide extensions for known file types" and "Hide
protected operating system." But when I shut down the computer and turn
it back on, these are checked again.

I tried the 2nd method with msconfig - There was one Adobe file with
Common Startup and I deleted that. That remains deleted.

I also cleaned out the Temp files that contain this line, but when I shut
down the computer and start up again and do another search, the same files
are contaminated again.

The virus - W95/CTX - has obviously found a way to get around fixing this
problem. The usual method is not working.

What else do you suggest?? There must be another way.

Thanks,
Barbara

 

[David Candy]

Microsoft are wrong. The file should be there and should be hidden. It replaces the name of the folder Startup with whatever startup is in any language. In english the word is startup so it makes no difference. This particular line in the file is for the Per User startup folder.

Explorer shell executes (same as dbl clicking a file) any non hidden files in this folder.

It doesn't matter much on english language if the file is deleted or not.

I'd say you are logging on with a new profile each logon? Are My Docs etc still there?
--
--------------------------------------------------------------------------------------------------
Goodbye Web Diary
http://margokingston.typepad.com/harry_version_2/2005/12/thank_you_and_g.html#comments
=================================================

David,

I opened an email attachment yesterday and got a window that said something
was intruding and then everything went haywire. A virus corrupted 27 files
named - W95/CXT-

After restarting the computer, I got a window from Notepad with this in it
--- [.shellclassinfo localized resource name=systemroot%\system32\shel32.dll]
- I did not remove anything. It was removed by this virus. I have never seen
this before yesterday.

According to McAfee, the W95/CXT virus is a new virus that came out 3/10/06.
It wiped out Outlook Express, all of my Favorites, most of the icons on
desktop, and now none of my settings will save, even though when I shut down
the computer it says it's saving my settings.

I am a little confused when you say "These are files that should exist. "
as I am getting direction that this file should not exist and directed to
this web page to correct the problem. http://support.microsoft.com/kb/330132
- I have followed the directions, both method 1 and 2, and it does not help
the problem.

Can you tell me how to correct this problem so my settings will save?

Thanks,
Barb

These are files that should exist. Depending on XP's language they make parts of Start appear in the correct language. If it opens in notepad at start then YOU removed the hidden attribute from the file.



--
--------------------------------------------------------------------------------------------------
Goodbye Web Diary
http://margokingston.typepad.com/harry_version_2/2005/12/thank_you_and_g.html#comments
=================================================

Ok - I just figured out how to post back in.

Yes I did that. I did not just delete the line - I deleted the whole file
-desktop.ini - if it contained [.ShellClassInfo]>
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

Yes I did delete the files in the Temp folders that contained that line, but
it doesn't stay deleted. When I restart the computer and do a search, the
same Temp files are contaminiated again. I have cleaned them 3 times but they
don't stay cleaned. The only files on the computer right now that contain the
desktop.ini file are in the Temp files. Unless there are more files and
Search is not finding them.

Also, the 2 files in Windows Explorer you said to uncheck - Hide extensions
and Hide operating systems - I have unchecked them 3 times but, when shutting
down the computer and starting it back up, they are checked again.

But isn't that the problem. No settings can be saved. So why would it save
any settings in Windows Explorer any more than any where else?

I have re-scanned with McAfee to make sure the virus is gone and it is gone
- so I'm not being re-infected.

This virus - W95/CTX - is a new virus that came out yesterday. McAfee did
not stop it on my computer. I had 27 infected files. When I look at these
files, some are the ones I have cleaned, but there are many other kinds of
files. The files have been quaranteened because McAfee software says you
cannot clean them.

Obviously, the maker of this virus has found a way to twart the standard way
to fix this problem. The standard way doesn't work. Any ideas?

thanks,
Barb



:

Barb,

You need to post back in one of the same threads as you posted in
originally. It makes it too hard for anyone to find your posts otherwise.

Don't delete the line within the desktop.ini file, delete the whole
desktop.ini file.

The only desktop.ini file(s) that you would want to delete are any that
contain these lines:

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

However, you shouldn't have any desktop.ini files in any temp folders, so
those would be OK to delete, no matter what the desktop.ini files have in
them.

This temp folder, C:\WINDOWS\Temp ??

Or this one, C:\Documents and Settings\Your Name Here\Local Settings\Temp ??

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Barbara <[email protected]> hunted and pecked:
Thanks for your help earlier with the desktop [.shelclassinfo]
localizedresource name=systemroot\system32\shell32.dll -21787, however, I
followed your directions - used Method 1 and 2 with msconfig. But still
having the same problems and this file pops up at startup. Tried saving
some settings but they don't save after turning the computer off and then
back on.

The desktop.ini file did not appear in the files named but I did find them
using Search in the Temp files. Should I delte those?

Any other suggestions?

Thanks,
Barb

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Barbara <[email protected]> hunted and pecked:
To W. Vogel - I have followed your directions and tried to clear this
line as you have previously instructed using both methods -
[.shelclassinfo localized resource name=systemroot%\system32\shel32.dll
-21787 - but on startup, the window Desktop Notepad still pops up with
this line. I still cannot save any settings.

In Method 1, I deleted the desktop.ini files containing that line in the
following --
drive:\Documents and Settings\All Users\Start Menu\Programs\Startup
• drive:\Documents and Settings\All Users\Start Menu\Programs
• drive:\Documents and Settings\All Users\Start Menu

When doing a search for the desktop.ini file, these files no longer come
up.

I also unchecked "Hide extensions for known file types" and "Hide
protected operating system." But when I shut down the computer and turn
it back on, these are checked again.

I tried the 2nd method with msconfig - There was one Adobe file with
Common Startup and I deleted that. That remains deleted.

I also cleaned out the Temp files that contain this line, but when I shut
down the computer and start up again and do another search, the same files
are contaminated again.

The virus - W95/CTX - has obviously found a way to get around fixing this
problem. The usual method is not working.

What else do you suggest?? There must be another way.

Thanks,
Barbara

 

[Wesley Vogel]

Barb,

Make sure that your McAfee has the latest updated DAT files!!!

Apparently there was something wrong with the 4715 DAT files, you need the
4716 DAT files. And you need to take some other steps.

[[The 4715 DAT files contain an incorrect identification on W95/CTX under
the following products:
On Demand Scanner (ODS) Components Only
(the detection does not occur with the On Access Scanner (OAS), nor with
gateway or email scanners)

a.. VirusScan Enterprise 8.0i
b.. VirusScan Enterprise 7.1
c.. VirusScan Enterprise 7.0
d.. Managed VirusScan 4.0
e.. Managed VirusScan 3.5
f.. VirusScan Online 11
g.. VirusScan Online 10
h.. LinuxShield
i.. VirusScan 7.03 (consumer)
These product may report certain executable files as being infected with a
variant of W95/CTX. At that point the files may be renamed as
filename.exe.vir. However, the point product's secondary action can result
in the file being deleted.

Correct W95/CTX detections are reported as W95/CTX.6886 or W95/CTX.10853]]

[[The 4716 DAT files have been posted to correct this issue. If you are
seeing W95/CTX detection, ensure that you are running the 4716 DAT files or
newer.]]
from...
W95/CTX
http://vil.nai.com/vil/content/v_138884.htm

Click the link to read the whole McAfee article.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

David,

I opened an email attachment yesterday and got a window that said
something was intruding and then everything went haywire. A virus
corrupted 27 files named - W95/CXT-

After restarting the computer, I got a window from Notepad with this in it
--- [.shellclassinfo localized resource
name=systemroot%\system32\shel32.dll]
- I did not remove anything. It was removed by this virus. I have never
seen this before yesterday.

According to McAfee, the W95/CXT virus is a new virus that came out
3/10/06. It wiped out Outlook Express, all of my Favorites, most of the
icons on desktop, and now none of my settings will save, even though when
I shut down the computer it says it's saving my settings.

I am a little confused when you say "These are files that should exist. "
as I am getting direction that this file should not exist and directed to
this web page to correct the problem.
http://support.microsoft.com/kb/330132 - I have followed the directions,
both method 1 and 2, and it does not help the problem.

Can you tell me how to correct this problem so my settings will save?

Thanks,
Barb

These are files that should exist. Depending on XP's language they make
parts of Start appear in the correct language. If it opens in notepad at
start then YOU removed the hidden attribute from the file.



--
------------------------------------------------------------------------- -------------------------
Goodbye Web Diary
http://margokingston.typepad.com/harry_version_2/2005/12/thank_you_and_g.html#comments
=================================================

Ok - I just figured out how to post back in.

Yes I did that. I did not just delete the line - I deleted the whole
file -desktop.ini - if it contained [.ShellClassInfo]>
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

Yes I did delete the files in the Temp folders that contained that
line, but it doesn't stay deleted. When I restart the computer and do a
search, the same Temp files are contaminiated again. I have cleaned
them 3 times but they don't stay cleaned. The only files on the
computer right now that contain the desktop.ini file are in the Temp
files. Unless there are more files and Search is not finding them.

Also, the 2 files in Windows Explorer you said to uncheck - Hide
extensions and Hide operating systems - I have unchecked them 3 times
but, when shutting down the computer and starting it back up, they are
checked again.

But isn't that the problem. No settings can be saved. So why would it
save any settings in Windows Explorer any more than any where else?

I have re-scanned with McAfee to make sure the virus is gone and it is
gone - so I'm not being re-infected.

This virus - W95/CTX - is a new virus that came out yesterday. McAfee
did not stop it on my computer. I had 27 infected files. When I look at
these files, some are the ones I have cleaned, but there are many other
kinds of files. The files have been quaranteened because McAfee
software says you cannot clean them.

Obviously, the maker of this virus has found a way to twart the
standard way to fix this problem. The standard way doesn't work. Any
ideas?

thanks,
Barb



:

Barb,

You need to post back in one of the same threads as you posted in
originally. It makes it too hard for anyone to find your posts
otherwise.

Don't delete the line within the desktop.ini file, delete the whole
desktop.ini file.

The only desktop.ini file(s) that you would want to delete are any that
contain these lines:

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

However, you shouldn't have any desktop.ini files in any temp folders,
so those would be OK to delete, no matter what the desktop.ini files
have in them.

This temp folder, C:\WINDOWS\Temp ??

Or this one, C:\Documents and Settings\Your Name Here\Local
Settings\Temp ??

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Barbara <[email protected]> hunted and pecked:
Thanks for your help earlier with the desktop [.shelclassinfo]
localizedresource name=systemroot\system32\shell32.dll -21787,
however, I followed your directions - used Method 1 and 2 with
msconfig. But still having the same problems and this file pops up at
startup. Tried saving some settings but they don't save after turning
the computer off and then back on.

The desktop.ini file did not appear in the files named but I did find
them using Search in the Temp files. Should I delte those?

Any other suggestions?

Thanks,
Barb

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Barbara <[email protected]> hunted and pecked:
To W. Vogel - I have followed your directions and tried to clear this
line as you have previously instructed using both methods -
[.shelclassinfo localized resource
name=systemroot%\system32\shel32.dll -21787 - but on startup, the
window Desktop Notepad still pops up with this line. I still cannot
save any settings.

In Method 1, I deleted the desktop.ini files containing that line in
the following --
drive:\Documents and Settings\All Users\Start Menu\Programs\Startup
• drive:\Documents and Settings\All Users\Start Menu\Programs
• drive:\Documents and Settings\All Users\Start Menu

When doing a search for the desktop.ini file, these files no longer
come up.

I also unchecked "Hide extensions for known file types" and "Hide
protected operating system." But when I shut down the computer and
turn it back on, these are checked again.

I tried the 2nd method with msconfig - There was one Adobe file with
Common Startup and I deleted that. That remains deleted.

I also cleaned out the Temp files that contain this line, but when I
shut down the computer and start up again and do another search, the
same files are contaminated again.

The virus - W95/CTX - has obviously found a way to get around fixing
this problem. The usual method is not working.

What else do you suggest?? There must be another way.

Thanks,
Barbara

 

[Guest]

David and Wesley,

I am trying to understand this about the DAT files. I went ahead and did a
system restore. The 2 methods I tried yesterday did not correct the problem.
During the restore process, it asked if I wanted to delete the quaranteened
files (the virus infected files) and I said yes. So they are gone. In the
past when I've had viruses that ruined my computer, I tried Restore but it
didn't work and I had to reinstall Windows - but this time it worked. I set
the date back to 3/9/06 and SURPRISE !!! - My computer is back again. I had
to remove McAfee and reinstall it but everything else seems to be working
fine.

I read the info you provided in this link and looked at the About - it says
I have DAT Version 4716 created 3/10/06.

Question: Is W95/CXT a virus? Did it come thru an email attachment I
opened?? If not, how did I get it?? Where did it come from??

Is there anything else I need to do??

Thanks again,
Barb

Barb,

Make sure that your McAfee has the latest updated DAT files!!!

Apparently there was something wrong with the 4715 DAT files, you need the
4716 DAT files. And you need to take some other steps.

[[The 4715 DAT files contain an incorrect identification on W95/CTX under
the following products:
On Demand Scanner (ODS) Components Only
(the detection does not occur with the On Access Scanner (OAS), nor with
gateway or email scanners)

a.. VirusScan Enterprise 8.0i
b.. VirusScan Enterprise 7.1
c.. VirusScan Enterprise 7.0
d.. Managed VirusScan 4.0
e.. Managed VirusScan 3.5
f.. VirusScan Online 11
g.. VirusScan Online 10
h.. LinuxShield
i.. VirusScan 7.03 (consumer)
These product may report certain executable files as being infected with a
variant of W95/CTX. At that point the files may be renamed as
filename.exe.vir. However, the point product's secondary action can result
in the file being deleted.

Correct W95/CTX detections are reported as W95/CTX.6886 or W95/CTX.10853]]

[[The 4716 DAT files have been posted to correct this issue. If you are
seeing W95/CTX detection, ensure that you are running the 4716 DAT files or
newer.]]
from...
W95/CTX
http://vil.nai.com/vil/content/v_138884.htm

Click the link to read the whole McAfee article.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

David,

I opened an email attachment yesterday and got a window that said
something was intruding and then everything went haywire. A virus
corrupted 27 files named - W95/CXT-

After restarting the computer, I got a window from Notepad with this in it
--- [.shellclassinfo localized resource
name=systemroot%\system32\shel32.dll]
- I did not remove anything. It was removed by this virus. I have never
seen this before yesterday.

According to McAfee, the W95/CXT virus is a new virus that came out
3/10/06. It wiped out Outlook Express, all of my Favorites, most of the
icons on desktop, and now none of my settings will save, even though when
I shut down the computer it says it's saving my settings.

I am a little confused when you say "These are files that should exist. "
as I am getting direction that this file should not exist and directed to
this web page to correct the problem.
http://support.microsoft.com/kb/330132 - I have followed the directions,
both method 1 and 2, and it does not help the problem.

Can you tell me how to correct this problem so my settings will save?

Thanks,
Barb

These are files that should exist. Depending on XP's language they make
parts of Start appear in the correct language. If it opens in notepad at
start then YOU removed the hidden attribute from the file.



--
------------------------------------------------------------------------- -------------------------
Goodbye Web Diary
http://margokingston.typepad.com/harry_version_2/2005/12/thank_you_and_g.html#comments
=================================================
Ok - I just figured out how to post back in.

Yes I did that. I did not just delete the line - I deleted the whole
file -desktop.ini - if it contained [.ShellClassInfo]>
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

Yes I did delete the files in the Temp folders that contained that
line, but it doesn't stay deleted. When I restart the computer and do a
search, the same Temp files are contaminiated again. I have cleaned
them 3 times but they don't stay cleaned. The only files on the
computer right now that contain the desktop.ini file are in the Temp
files. Unless there are more files and Search is not finding them.

Also, the 2 files in Windows Explorer you said to uncheck - Hide
extensions and Hide operating systems - I have unchecked them 3 times
but, when shutting down the computer and starting it back up, they are
checked again.

But isn't that the problem. No settings can be saved. So why would it
save any settings in Windows Explorer any more than any where else?

I have re-scanned with McAfee to make sure the virus is gone and it is
gone - so I'm not being re-infected.

This virus - W95/CTX - is a new virus that came out yesterday. McAfee
did not stop it on my computer. I had 27 infected files. When I look at
these files, some are the ones I have cleaned, but there are many other
kinds of files. The files have been quaranteened because McAfee
software says you cannot clean them.

Obviously, the maker of this virus has found a way to twart the
standard way to fix this problem. The standard way doesn't work. Any
ideas?

thanks,
Barb



:

Barb,

You need to post back in one of the same threads as you posted in
originally. It makes it too hard for anyone to find your posts
otherwise.

Don't delete the line within the desktop.ini file, delete the whole
desktop.ini file.

The only desktop.ini file(s) that you would want to delete are any that
contain these lines:

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

However, you shouldn't have any desktop.ini files in any temp folders,
so those would be OK to delete, no matter what the desktop.ini files
have in them.

This temp folder, C:\WINDOWS\Temp ??

Or this one, C:\Documents and Settings\Your Name Here\Local
Settings\Temp ??

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Barbara <[email protected]> hunted and pecked:
Thanks for your help earlier with the desktop [.shelclassinfo]
localizedresource name=systemroot\system32\shell32.dll -21787,
however, I followed your directions - used Method 1 and 2 with
msconfig. But still having the same problems and this file pops up at
startup. Tried saving some settings but they don't save after turning
the computer off and then back on.

The desktop.ini file did not appear in the files named but I did find
them using Search in the Temp files. Should I delte those?

Any other suggestions?

Thanks,
Barb

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Barbara <[email protected]> hunted and pecked:
To W. Vogel - I have followed your directions and tried to clear this
line as you have previously instructed using both methods -
[.shelclassinfo localized resource
name=systemroot%\system32\shel32.dll -21787 - but on startup, the
window Desktop Notepad still pops up with this line. I still cannot
save any settings.

In Method 1, I deleted the desktop.ini files containing that line in
the following --
drive:\Documents and Settings\All Users\Start Menu\Programs\Startup
• drive:\Documents and Settings\All Users\Start Menu\Programs
• drive:\Documents and Settings\All Users\Start Menu

When doing a search for the desktop.ini file, these files no longer
come up.

I also unchecked "Hide extensions for known file types" and "Hide
protected operating system." But when I shut down the computer and
turn it back on, these are checked again.

I tried the 2nd method with msconfig - There was one Adobe file with
Common Startup and I deleted that. That remains deleted.

I also cleaned out the Temp files that contain this line, but when I
shut down the computer and start up again and do another search, the
same files are contaminated again.

The virus - W95/CTX - has obviously found a way to get around fixing
this problem. The usual method is not working.

What else do you suggest?? There must be another way.

Thanks,
Barbara

 

[Wesley Vogel]

Question: Is W95/CXT a virus? Did it come thru an email attachment I

opened?? If not, how did I get it?? Where did it come from??

Correct W95/CTX detections are reported as W95/CTX.6886 or W95/CTX.10853

McAfee doesn't say how you get W95/CTX.6886 or W95/CTX.10853.

SWAG: It looks to me like W95/CTX was a false positive (incorrect
identification). McAfee screwed up something, so some files got deleted
that did not need to get deleted and in the process screwed up your profile.

I dumped McAfee a long time ago and I use a different AV software.

AVG Free for Windows is a free anti-virus protection tool developed by
Grisoft for home use.

Get Your AVG 7 for free!
http://free.grisoft.com/freeweb.php/doc/2/lng/us/tpl/v5

Tips for using AVG Free 7.0 Antivirus
http://mvps.org/winhelp2002/avg7.htm

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

David and Wesley,

I am trying to understand this about the DAT files. I went ahead and did a
system restore. The 2 methods I tried yesterday did not correct the
problem. During the restore process, it asked if I wanted to delete the
quaranteened files (the virus infected files) and I said yes. So they are
gone. In the past when I've had viruses that ruined my computer, I tried
Restore but it didn't work and I had to reinstall Windows - but this time
it worked. I set the date back to 3/9/06 and SURPRISE !!! - My computer
is back again. I had to remove McAfee and reinstall it but everything
else seems to be working fine.

I read the info you provided in this link and looked at the About - it
says I have DAT Version 4716 created 3/10/06.

Question: Is W95/CXT a virus? Did it come thru an email attachment I
opened?? If not, how did I get it?? Where did it come from??

Is there anything else I need to do??

Thanks again,
Barb

Barb,

Make sure that your McAfee has the latest updated DAT files!!!

Apparently there was something wrong with the 4715 DAT files, you need
the 4716 DAT files. And you need to take some other steps.

[[The 4715 DAT files contain an incorrect identification on W95/CTX under
the following products:
On Demand Scanner (ODS) Components Only
(the detection does not occur with the On Access Scanner (OAS), nor with
gateway or email scanners)

a.. VirusScan Enterprise 8.0i
b.. VirusScan Enterprise 7.1
c.. VirusScan Enterprise 7.0
d.. Managed VirusScan 4.0
e.. Managed VirusScan 3.5
f.. VirusScan Online 11
g.. VirusScan Online 10
h.. LinuxShield
i.. VirusScan 7.03 (consumer)
These product may report certain executable files as being infected with
a variant of W95/CTX. At that point the files may be renamed as
filename.exe.vir. However, the point product's secondary action can
result in the file being deleted.

Correct W95/CTX detections are reported as W95/CTX.6886 or
W95/CTX.10853]]

[[The 4716 DAT files have been posted to correct this issue. If you are
seeing W95/CTX detection, ensure that you are running the 4716 DAT files
or newer.]]
from...
W95/CTX
http://vil.nai.com/vil/content/v_138884.htm

Click the link to read the whole McAfee article.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

David,

I opened an email attachment yesterday and got a window that said
something was intruding and then everything went haywire. A virus
corrupted 27 files named - W95/CXT-

After restarting the computer, I got a window from Notepad with this in
it --- [.shellclassinfo localized resource
name=systemroot%\system32\shel32.dll]
- I did not remove anything. It was removed by this virus. I have never
seen this before yesterday.

According to McAfee, the W95/CXT virus is a new virus that came out
3/10/06. It wiped out Outlook Express, all of my Favorites, most of the
icons on desktop, and now none of my settings will save, even though
when I shut down the computer it says it's saving my settings.

I am a little confused when you say "These are files that should exist.
" as I am getting direction that this file should not exist and
directed to this web page to correct the problem.
http://support.microsoft.com/kb/330132 - I have followed the directions,
both method 1 and 2, and it does not help the problem.

Can you tell me how to correct this problem so my settings will save?

Thanks,
Barb

:

These are files that should exist. Depending on XP's language they make
parts of Start appear in the correct language. If it opens in notepad
at start then YOU removed the hidden attribute from the file.

http://margokingston.typepad.com/harry_version_2/2005/12/thank_you_and_g.html#comments

=================================================
Ok - I just figured out how to post back in.

Yes I did that. I did not just delete the line - I deleted the whole
file -desktop.ini - if it contained [.ShellClassInfo]>
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

Yes I did delete the files in the Temp folders that contained that
line, but it doesn't stay deleted. When I restart the computer and do
a search, the same Temp files are contaminiated again. I have cleaned
them 3 times but they don't stay cleaned. The only files on the
computer right now that contain the desktop.ini file are in the Temp
files. Unless there are more files and Search is not finding them.

Also, the 2 files in Windows Explorer you said to uncheck - Hide
extensions and Hide operating systems - I have unchecked them 3 times
but, when shutting down the computer and starting it back up, they are
checked again.

But isn't that the problem. No settings can be saved. So why would it
save any settings in Windows Explorer any more than any where else?

I have re-scanned with McAfee to make sure the virus is gone and it is
gone - so I'm not being re-infected.

This virus - W95/CTX - is a new virus that came out yesterday. McAfee
did not stop it on my computer. I had 27 infected files. When I look
at these files, some are the ones I have cleaned, but there are many
other kinds of files. The files have been quaranteened because McAfee
software says you cannot clean them.

Obviously, the maker of this virus has found a way to twart the
standard way to fix this problem. The standard way doesn't work. Any
ideas?

thanks,
Barb



:

Barb,

You need to post back in one of the same threads as you posted in
originally. It makes it too hard for anyone to find your posts
otherwise.

Don't delete the line within the desktop.ini file, delete the whole
desktop.ini file.

The only desktop.ini file(s) that you would want to delete are any
that contain these lines:

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

However, you shouldn't have any desktop.ini files in any temp
folders, so those would be OK to delete, no matter what the
desktop.ini files have in them.

This temp folder, C:\WINDOWS\Temp ??

Or this one, C:\Documents and Settings\Your Name Here\Local
Settings\Temp ??

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Barbara <[email protected]> hunted and pecked:
Thanks for your help earlier with the desktop [.shelclassinfo]
localizedresource name=systemroot\system32\shell32.dll -21787,
however, I followed your directions - used Method 1 and 2 with
msconfig. But still having the same problems and this file pops up
at startup. Tried saving some settings but they don't save after
turning
the computer off and then back on.

The desktop.ini file did not appear in the files named but I did
find
them using Search in the Temp files. Should I delte those?

Any other suggestions?

Thanks,
Barb

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Barbara <[email protected]> hunted and pecked:
To W. Vogel - I have followed your directions and tried to clear
this
line as you have previously instructed using both methods -
[.shelclassinfo localized resource
name=systemroot%\system32\shel32.dll -21787 - but on startup, the
window Desktop Notepad still pops up with this line. I still cannot
save any settings.

In Method 1, I deleted the desktop.ini files containing that line in
the following --
drive:\Documents and Settings\All Users\Start Menu\Programs\Startup
• drive:\Documents and Settings\All Users\Start
Menu\Programs • drive:\Documents and Settings\All
Users\Start Menu

When doing a search for the desktop.ini file, these files no longer
come up.

I also unchecked "Hide extensions for known file types" and "Hide
protected operating system." But when I shut down the computer and
turn it back on, these are checked again.

I tried the 2nd method with msconfig - There was one Adobe file with
Common Startup and I deleted that. That remains deleted.

I also cleaned out the Temp files that contain this line, but when I
shut down the computer and start up again and do another search, the
same files are contaminated again.

The virus - W95/CTX - has obviously found a way to get around fixing
this problem. The usual method is not working.

What else do you suggest?? There must be another way.

Thanks,
Barbara

 

[Guest]

Wesley,

Yes it appears that McAfee does not protect my computer as this is the 3rd
time I've had viruses. Is Norton any better? I'm going to post a new
question related to problems I've been having since the last time I had
viruses that messed up my computer.

I am trying Grisoft on my old Windows ME computer in the other room. (I'm
definitely getting rid of McAfee.) But it's not free. The trial is free for
30 days but then you have to pay for it. Good to know you recommend it. I
will go ahead and get it on this computer.

Thanks again. I can't afford a new computer right now so I'm trying to make
this one last a while.

Barb

Question: Is W95/CXT a virus? Did it come thru an email attachment I
opened?? If not, how did I get it?? Where did it come from??

Correct W95/CTX detections are reported as W95/CTX.6886 or W95/CTX.10853

McAfee doesn't say how you get W95/CTX.6886 or W95/CTX.10853.

SWAG: It looks to me like W95/CTX was a false positive (incorrect
identification). McAfee screwed up something, so some files got deleted
that did not need to get deleted and in the process screwed up your profile.

I dumped McAfee a long time ago and I use a different AV software.

AVG Free for Windows is a free anti-virus protection tool developed by
Grisoft for home use.

Get Your AVG 7 for free!
http://free.grisoft.com/freeweb.php/doc/2/lng/us/tpl/v5

Tips for using AVG Free 7.0 Antivirus
http://mvps.org/winhelp2002/avg7.htm

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

David and Wesley,

I am trying to understand this about the DAT files. I went ahead and did a
system restore. The 2 methods I tried yesterday did not correct the
problem. During the restore process, it asked if I wanted to delete the
quaranteened files (the virus infected files) and I said yes. So they are
gone. In the past when I've had viruses that ruined my computer, I tried
Restore but it didn't work and I had to reinstall Windows - but this time
it worked. I set the date back to 3/9/06 and SURPRISE !!! - My computer
is back again. I had to remove McAfee and reinstall it but everything
else seems to be working fine.

I read the info you provided in this link and looked at the About - it
says I have DAT Version 4716 created 3/10/06.

Question: Is W95/CXT a virus? Did it come thru an email attachment I
opened?? If not, how did I get it?? Where did it come from??

Is there anything else I need to do??

Thanks again,
Barb

Barb,

Make sure that your McAfee has the latest updated DAT files!!!

Apparently there was something wrong with the 4715 DAT files, you need
the 4716 DAT files. And you need to take some other steps.

[[The 4715 DAT files contain an incorrect identification on W95/CTX under
the following products:
On Demand Scanner (ODS) Components Only
(the detection does not occur with the On Access Scanner (OAS), nor with
gateway or email scanners)

a.. VirusScan Enterprise 8.0i
b.. VirusScan Enterprise 7.1
c.. VirusScan Enterprise 7.0
d.. Managed VirusScan 4.0
e.. Managed VirusScan 3.5
f.. VirusScan Online 11
g.. VirusScan Online 10
h.. LinuxShield
i.. VirusScan 7.03 (consumer)
These product may report certain executable files as being infected with
a variant of W95/CTX. At that point the files may be renamed as
filename.exe.vir. However, the point product's secondary action can
result in the file being deleted.

Correct W95/CTX detections are reported as W95/CTX.6886 or
W95/CTX.10853]]

[[The 4716 DAT files have been posted to correct this issue. If you are
seeing W95/CTX detection, ensure that you are running the 4716 DAT files
or newer.]]
from...
W95/CTX
http://vil.nai.com/vil/content/v_138884.htm

Click the link to read the whole McAfee article.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Barbara <[email protected]> hunted and pecked:
David,

I opened an email attachment yesterday and got a window that said
something was intruding and then everything went haywire. A virus
corrupted 27 files named - W95/CXT-

After restarting the computer, I got a window from Notepad with this in
it --- [.shellclassinfo localized resource
name=systemroot%\system32\shel32.dll]
- I did not remove anything. It was removed by this virus. I have never
seen this before yesterday.

According to McAfee, the W95/CXT virus is a new virus that came out
3/10/06. It wiped out Outlook Express, all of my Favorites, most of the
icons on desktop, and now none of my settings will save, even though
when I shut down the computer it says it's saving my settings.

I am a little confused when you say "These are files that should exist.
" as I am getting direction that this file should not exist and
directed to this web page to correct the problem.
http://support.microsoft.com/kb/330132 - I have followed the directions,
both method 1 and 2, and it does not help the problem.

Can you tell me how to correct this problem so my settings will save?

Thanks,
Barb

:

These are files that should exist. Depending on XP's language they make
parts of Start appear in the correct language. If it opens in notepad
at start then YOU removed the hidden attribute from the file.



--
----------------------------------------------------------------------- --
------------------------- Goodbye Web Diary

http://margokingston.typepad.com/harry_version_2/2005/12/thank_you_and_g.html#comments
=================================================
Ok - I just figured out how to post back in.

Yes I did that. I did not just delete the line - I deleted the whole
file -desktop.ini - if it contained [.ShellClassInfo]>
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

Yes I did delete the files in the Temp folders that contained that
line, but it doesn't stay deleted. When I restart the computer and do
a search, the same Temp files are contaminiated again. I have cleaned
them 3 times but they don't stay cleaned. The only files on the
computer right now that contain the desktop.ini file are in the Temp
files. Unless there are more files and Search is not finding them.

Also, the 2 files in Windows Explorer you said to uncheck - Hide
extensions and Hide operating systems - I have unchecked them 3 times
but, when shutting down the computer and starting it back up, they are
checked again.

But isn't that the problem. No settings can be saved. So why would it
save any settings in Windows Explorer any more than any where else?

I have re-scanned with McAfee to make sure the virus is gone and it is
gone - so I'm not being re-infected.

This virus - W95/CTX - is a new virus that came out yesterday. McAfee
did not stop it on my computer. I had 27 infected files. When I look
at these files, some are the ones I have cleaned, but there are many
other kinds of files. The files have been quaranteened because McAfee
software says you cannot clean them.

Obviously, the maker of this virus has found a way to twart the
standard way to fix this problem. The standard way doesn't work. Any
ideas?

thanks,
Barb



:

Barb,

You need to post back in one of the same threads as you posted in
originally. It makes it too hard for anyone to find your posts
otherwise.

Don't delete the line within the desktop.ini file, delete the whole
desktop.ini file.

The only desktop.ini file(s) that you would want to delete are any
that contain these lines:

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

However, you shouldn't have any desktop.ini files in any temp
folders, so those would be OK to delete, no matter what the
desktop.ini files have in them.

This temp folder, C:\WINDOWS\Temp ??

Or this one, C:\Documents and Settings\Your Name Here\Local
Settings\Temp ??

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Barbara <[email protected]> hunted and pecked:
Thanks for your help earlier with the desktop [.shelclassinfo]
localizedresource name=systemroot\system32\shell32.dll -21787,
however, I followed your directions - used Method 1 and 2 with
msconfig. But still having the same problems and this file pops up
at startup. Tried saving some settings but they don't save after
turning
the computer off and then back on.

The desktop.ini file did not appear in the files named but I did
find
them using Search in the Temp files. Should I delte those?

Any other suggestions?

Thanks,
Barb

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Barbara <[email protected]> hunted and pecked:
To W. Vogel - I have followed your directions and tried to clear
this
line as you have previously instructed using both methods -
[.shelclassinfo localized resource
name=systemroot%\system32\shel32.dll -21787 - but on startup, the
window Desktop Notepad still pops up with this line. I still cannot
save any settings.

In Method 1, I deleted the desktop.ini files containing that line in
the following --
drive:\Documents and Settings\All Users\Start Menu\Programs\Startup
• drive:\Documents and Settings\All Users\Start
Menu\Programs • drive:\Documents and Settings\All
Users\Start Menu

When doing a search for the desktop.ini file, these files no longer
come up.

I also unchecked "Hide extensions for known file types" and "Hide
protected operating system." But when I shut down the computer and
turn it back on, these are checked again.

I tried the 2nd method with msconfig - There was one Adobe file with
Common Startup and I deleted that. That remains deleted.

I also cleaned out the Temp files that contain this line, but when I
shut down the computer and start up again and do another search, the
same files are contaminated again.

The virus - W95/CTX - has obviously found a way to get around fixing
this problem. The usual method is not working.

What else do you suggest?? There must be another way.

Thanks,
Barbara

 

[Wesley Vogel]

McAfee sucks. Norton is not much better, though I have never used Norton.

You must have downloaded the wrong version of AVG.

[[AVG Free Edition is for private, non-commercial, single home computer use
only. Use of AVG Free Edition within any organization or for commercial
purposes is strictly prohibited.]]
http://free.grisoft.com/freeweb.php/doc/2/lng/us/tpl/v5

The AVG version on from the link above is the FREE version.

This page has a trial version of AVG Professional (Pay version)
http://free.grisoft.com/doc/11/lng/us/tpl/v5

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Wesley,

Yes it appears that McAfee does not protect my computer as this is the 3rd
time I've had viruses. Is Norton any better? I'm going to post a new
question related to problems I've been having since the last time I had
viruses that messed up my computer.

I am trying Grisoft on my old Windows ME computer in the other room. (I'm
definitely getting rid of McAfee.) But it's not free. The trial is free
for 30 days but then you have to pay for it. Good to know you recommend
it. I will go ahead and get it on this computer.

Thanks again. I can't afford a new computer right now so I'm trying to
make this one last a while.

Barb

Question: Is W95/CXT a virus? Did it come thru an email attachment I
opened?? If not, how did I get it?? Where did it come from??

Correct W95/CTX detections are reported as W95/CTX.6886 or W95/CTX.10853

McAfee doesn't say how you get W95/CTX.6886 or W95/CTX.10853.

SWAG: It looks to me like W95/CTX was a false positive (incorrect
identification). McAfee screwed up something, so some files got deleted
that did not need to get deleted and in the process screwed up your
profile.

I dumped McAfee a long time ago and I use a different AV software.

AVG Free for Windows is a free anti-virus protection tool developed by
Grisoft for home use.

Get Your AVG 7 for free!
http://free.grisoft.com/freeweb.php/doc/2/lng/us/tpl/v5

Tips for using AVG Free 7.0 Antivirus
http://mvps.org/winhelp2002/avg7.htm

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

David and Wesley,

I am trying to understand this about the DAT files. I went ahead and
did a system restore. The 2 methods I tried yesterday did not correct
the problem. During the restore process, it asked if I wanted to delete
the quaranteened files (the virus infected files) and I said yes. So
they are gone. In the past when I've had viruses that ruined my
computer, I tried Restore but it didn't work and I had to reinstall
Windows - but this time it worked. I set the date back to 3/9/06 and
SURPRISE !!! - My computer is back again. I had to remove McAfee and
reinstall it but everything else seems to be working fine.

I read the info you provided in this link and looked at the About - it
says I have DAT Version 4716 created 3/10/06.

Question: Is W95/CXT a virus? Did it come thru an email attachment I
opened?? If not, how did I get it?? Where did it come from??

Is there anything else I need to do??

Thanks again,
Barb

:

Barb,

Make sure that your McAfee has the latest updated DAT files!!!

Apparently there was something wrong with the 4715 DAT files, you need
the 4716 DAT files. And you need to take some other steps.

[[The 4715 DAT files contain an incorrect identification on W95/CTX
under the following products:
On Demand Scanner (ODS) Components Only
(the detection does not occur with the On Access Scanner (OAS), nor
with gateway or email scanners)

a.. VirusScan Enterprise 8.0i
b.. VirusScan Enterprise 7.1
c.. VirusScan Enterprise 7.0
d.. Managed VirusScan 4.0
e.. Managed VirusScan 3.5
f.. VirusScan Online 11
g.. VirusScan Online 10
h.. LinuxShield
i.. VirusScan 7.03 (consumer)
These product may report certain executable files as being infected
with a variant of W95/CTX. At that point the files may be renamed as
filename.exe.vir. However, the point product's secondary action can
result in the file being deleted.

Correct W95/CTX detections are reported as W95/CTX.6886 or
W95/CTX.10853]]

[[The 4716 DAT files have been posted to correct this issue. If you
are seeing W95/CTX detection, ensure that you are running the 4716 DAT
files or newer.]]
from...
W95/CTX
http://vil.nai.com/vil/content/v_138884.htm

Click the link to read the whole McAfee article.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Barbara <[email protected]> hunted and pecked:
David,

I opened an email attachment yesterday and got a window that said
something was intruding and then everything went haywire. A virus
corrupted 27 files named - W95/CXT-

After restarting the computer, I got a window from Notepad with this
in it --- [.shellclassinfo localized resource
name=systemroot%\system32\shel32.dll]
- I did not remove anything. It was removed by this virus. I have
never seen this before yesterday.

According to McAfee, the W95/CXT virus is a new virus that came out
3/10/06. It wiped out Outlook Express, all of my Favorites, most of
the icons on desktop, and now none of my settings will save, even
though when I shut down the computer it says it's saving my settings.

I am a little confused when you say "These are files that should
exist. " as I am getting direction that this file should not exist
and directed to this web page to correct the problem.
http://support.microsoft.com/kb/330132 - I have followed the
directions, both method 1 and 2, and it does not help the problem.

Can you tell me how to correct this problem so my settings will save?

Thanks,
Barb

:

These are files that should exist. Depending on XP's language they
make parts of Start appear in the correct language. If it opens in
notepad at start then YOU removed the hidden attribute from the file.

--
--

------------------------- Goodbye Web Diary

http://margokingston.typepad.com/harry_version_2/2005/12/thank_you_and_g.html#comments

=================================================
Ok - I just figured out how to post back in.

Yes I did that. I did not just delete the line - I deleted the whole
file -desktop.ini - if it contained [.ShellClassInfo]>
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

Yes I did delete the files in the Temp folders that contained that
line, but it doesn't stay deleted. When I restart the computer and
do a search, the same Temp files are contaminiated again. I have
cleaned them 3 times but they don't stay cleaned. The only files on
the computer right now that contain the desktop.ini file are in the
Temp files. Unless there are more files and Search is not finding
them.

Also, the 2 files in Windows Explorer you said to uncheck - Hide
extensions and Hide operating systems - I have unchecked them 3
times but, when shutting down the computer and starting it back up,
they are checked again.

But isn't that the problem. No settings can be saved. So why would
it save any settings in Windows Explorer any more than any where
else?

I have re-scanned with McAfee to make sure the virus is gone and it
is gone - so I'm not being re-infected.

This virus - W95/CTX - is a new virus that came out yesterday.
McAfee did not stop it on my computer. I had 27 infected files.
When I look at these files, some are the ones I have cleaned, but
there are many other kinds of files. The files have been
quaranteened because McAfee software says you cannot clean them.

Obviously, the maker of this virus has found a way to twart the
standard way to fix this problem. The standard way doesn't work. Any
ideas?

thanks,
Barb



:

Barb,

You need to post back in one of the same threads as you posted in
originally. It makes it too hard for anyone to find your posts
otherwise.

Don't delete the line within the desktop.ini file, delete the whole
desktop.ini file.

The only desktop.ini file(s) that you would want to delete are any
that contain these lines:

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

However, you shouldn't have any desktop.ini files in any temp
folders, so those would be OK to delete, no matter what the
desktop.ini files have in them.

This temp folder, C:\WINDOWS\Temp ??

Or this one, C:\Documents and Settings\Your Name Here\Local
Settings\Temp ??

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Barbara <[email protected]> hunted and pecked:
Thanks for your help earlier with the desktop [.shelclassinfo]
localizedresource name=systemroot\system32\shell32.dll -21787,
however, I followed your directions - used Method 1 and 2 with
msconfig. But still having the same problems and this file pops up
at startup. Tried saving some settings but they don't save after
turning
the computer off and then back on.

The desktop.ini file did not appear in the files named but I did
find
them using Search in the Temp files. Should I delte those?

Any other suggestions?

Thanks,
Barb

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Barbara <[email protected]> hunted and pecked:
To W. Vogel - I have followed your directions and tried to clear
this
line as you have previously instructed using both methods -
[.shelclassinfo localized resource
name=systemroot%\system32\shel32.dll -21787 - but on startup, the
window Desktop Notepad still pops up with this line. I still
cannot
save any settings.

In Method 1, I deleted the desktop.ini files containing that line
in
the following --
drive:\Documents and Settings\All Users\Start
Menu\Programs\Startup •
drive:\Documents and Settings\All Users\Start Menu\Programs
• drive:\Documents and
Settings\All Users\Start Menu

When doing a search for the desktop.ini file, these files no
longer
come up.

I also unchecked "Hide extensions for known file types" and "Hide
protected operating system." But when I shut down the computer and
turn it back on, these are checked again.

I tried the 2nd method with msconfig - There was one Adobe file
with
Common Startup and I deleted that. That remains deleted.

I also cleaned out the Temp files that contain this line, but
when I
shut down the computer and start up again and do another search,
the
same files are contaminated again.

The virus - W95/CTX - has obviously found a way to get around
fixing
this problem. The usual method is not working.

What else do you suggest?? There must be another way.

Thanks,
Barbara

 

[Guest]

Wesley,

Thanks again.

The End.

(I'll be back)

Barb

McAfee sucks. Norton is not much better, though I have never used Norton.

You must have downloaded the wrong version of AVG.

[[AVG Free Edition is for private, non-commercial, single home computer use
only. Use of AVG Free Edition within any organization or for commercial
purposes is strictly prohibited.]]
http://free.grisoft.com/freeweb.php/doc/2/lng/us/tpl/v5

The AVG version on from the link above is the FREE version.

This page has a trial version of AVG Professional (Pay version)
http://free.grisoft.com/doc/11/lng/us/tpl/v5

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Wesley,

Yes it appears that McAfee does not protect my computer as this is the 3rd
time I've had viruses. Is Norton any better? I'm going to post a new
question related to problems I've been having since the last time I had
viruses that messed up my computer.

I am trying Grisoft on my old Windows ME computer in the other room. (I'm
definitely getting rid of McAfee.) But it's not free. The trial is free
for 30 days but then you have to pay for it. Good to know you recommend
it. I will go ahead and get it on this computer.

Thanks again. I can't afford a new computer right now so I'm trying to
make this one last a while.

Barb

Question: Is W95/CXT a virus? Did it come thru an email attachment I
opened?? If not, how did I get it?? Where did it come from??

Correct W95/CTX detections are reported as W95/CTX.6886 or W95/CTX.10853

McAfee doesn't say how you get W95/CTX.6886 or W95/CTX.10853.

SWAG: It looks to me like W95/CTX was a false positive (incorrect
identification). McAfee screwed up something, so some files got deleted
that did not need to get deleted and in the process screwed up your
profile.

I dumped McAfee a long time ago and I use a different AV software.

AVG Free for Windows is a free anti-virus protection tool developed by
Grisoft for home use.

Get Your AVG 7 for free!
http://free.grisoft.com/freeweb.php/doc/2/lng/us/tpl/v5

Tips for using AVG Free 7.0 Antivirus
http://mvps.org/winhelp2002/avg7.htm

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Barbara <[email protected]> hunted and pecked:
David and Wesley,

I am trying to understand this about the DAT files. I went ahead and
did a system restore. The 2 methods I tried yesterday did not correct
the problem. During the restore process, it asked if I wanted to delete
the quaranteened files (the virus infected files) and I said yes. So
they are gone. In the past when I've had viruses that ruined my
computer, I tried Restore but it didn't work and I had to reinstall
Windows - but this time it worked. I set the date back to 3/9/06 and
SURPRISE !!! - My computer is back again. I had to remove McAfee and
reinstall it but everything else seems to be working fine.

I read the info you provided in this link and looked at the About - it
says I have DAT Version 4716 created 3/10/06.

Question: Is W95/CXT a virus? Did it come thru an email attachment I
opened?? If not, how did I get it?? Where did it come from??

Is there anything else I need to do??

Thanks again,
Barb

:

Barb,

Make sure that your McAfee has the latest updated DAT files!!!

Apparently there was something wrong with the 4715 DAT files, you need
the 4716 DAT files. And you need to take some other steps.

[[The 4715 DAT files contain an incorrect identification on W95/CTX
under the following products:
On Demand Scanner (ODS) Components Only
(the detection does not occur with the On Access Scanner (OAS), nor
with gateway or email scanners)

a.. VirusScan Enterprise 8.0i
b.. VirusScan Enterprise 7.1
c.. VirusScan Enterprise 7.0
d.. Managed VirusScan 4.0
e.. Managed VirusScan 3.5
f.. VirusScan Online 11
g.. VirusScan Online 10
h.. LinuxShield
i.. VirusScan 7.03 (consumer)
These product may report certain executable files as being infected
with a variant of W95/CTX. At that point the files may be renamed as
filename.exe.vir. However, the point product's secondary action can
result in the file being deleted.

Correct W95/CTX detections are reported as W95/CTX.6886 or
W95/CTX.10853]]

[[The 4716 DAT files have been posted to correct this issue. If you
are seeing W95/CTX detection, ensure that you are running the 4716 DAT
files or newer.]]
from...
W95/CTX
http://vil.nai.com/vil/content/v_138884.htm

Click the link to read the whole McAfee article.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Barbara <[email protected]> hunted and pecked:
David,

I opened an email attachment yesterday and got a window that said
something was intruding and then everything went haywire. A virus
corrupted 27 files named - W95/CXT-

After restarting the computer, I got a window from Notepad with this
in it --- [.shellclassinfo localized resource
name=systemroot%\system32\shel32.dll]
- I did not remove anything. It was removed by this virus. I have
never seen this before yesterday.

According to McAfee, the W95/CXT virus is a new virus that came out
3/10/06. It wiped out Outlook Express, all of my Favorites, most of
the icons on desktop, and now none of my settings will save, even
though when I shut down the computer it says it's saving my settings.

I am a little confused when you say "These are files that should
exist. " as I am getting direction that this file should not exist
and directed to this web page to correct the problem.
http://support.microsoft.com/kb/330132 - I have followed the
directions, both method 1 and 2, and it does not help the problem.

Can you tell me how to correct this problem so my settings will save?

Thanks,
Barb

:

These are files that should exist. Depending on XP's language they
make parts of Start appear in the correct language. If it opens in
notepad at start then YOU removed the hidden attribute from the file.



--
--------------------------------------------------------------------- --
--
------------------------- Goodbye Web Diary


http://margokingston.typepad.com/harry_version_2/2005/12/thank_you_and_g.html#comments
=================================================
Ok - I just figured out how to post back in.

Yes I did that. I did not just delete the line - I deleted the whole
file -desktop.ini - if it contained [.ShellClassInfo]>
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

Yes I did delete the files in the Temp folders that contained that
line, but it doesn't stay deleted. When I restart the computer and
do a search, the same Temp files are contaminiated again. I have
cleaned them 3 times but they don't stay cleaned. The only files on
the computer right now that contain the desktop.ini file are in the
Temp files. Unless there are more files and Search is not finding
them.

Also, the 2 files in Windows Explorer you said to uncheck - Hide
extensions and Hide operating systems - I have unchecked them 3
times but, when shutting down the computer and starting it back up,
they are checked again.

But isn't that the problem. No settings can be saved. So why would
it save any settings in Windows Explorer any more than any where
else?

I have re-scanned with McAfee to make sure the virus is gone and it
is gone - so I'm not being re-infected.

This virus - W95/CTX - is a new virus that came out yesterday.
McAfee did not stop it on my computer. I had 27 infected files.
When I look at these files, some are the ones I have cleaned, but
there are many other kinds of files. The files have been
quaranteened because McAfee software says you cannot clean them.

Obviously, the maker of this virus has found a way to twart the
standard way to fix this problem. The standard way doesn't work. Any
ideas?

thanks,
Barb



:

Barb,

You need to post back in one of the same threads as you posted in
originally. It makes it too hard for anyone to find your posts
otherwise.

Don't delete the line within the desktop.ini file, delete the whole
desktop.ini file.

The only desktop.ini file(s) that you would want to delete are any
that contain these lines:

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

However, you shouldn't have any desktop.ini files in any temp
folders, so those would be OK to delete, no matter what the
desktop.ini files have in them.

This temp folder, C:\WINDOWS\Temp ??

Or this one, C:\Documents and Settings\Your Name Here\Local
Settings\Temp ??

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Barbara <[email protected]> hunted and pecked:
Thanks for your help earlier with the desktop [.shelclassinfo]
localizedresource name=systemroot\system32\shell32.dll -21787,
however, I followed your directions - used Method 1 and 2 with
msconfig. But still having the same problems and this file pops up
at startup. Tried saving some settings but they don't save after
turning
the computer off and then back on.

The desktop.ini file did not appear in the files named but I did
find
them using Search in the Temp files. Should I delte those?

Any other suggestions?

Thanks,
Barb

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Barbara <[email protected]> hunted and pecked:
To W. Vogel - I have followed your directions and tried to clear
this
line as you have previously instructed using both methods -
[.shelclassinfo localized resource
name=systemroot%\system32\shel32.dll -21787 - but on startup, the
window Desktop Notepad still pops up with this line. I still
cannot
save any settings.

 

[Wesley Vogel]

It made the news.

McAfee Update Breaks Hundreds Of Apps
For over five hours Friday, McAfee's anti-virus software erroneously flagged
hundreds of legitimate executables as a malicious virus, leading some
customers to quarantine or delete the offending files and render
applications such as Microsoft Excel inoperative.
http://www.informationweek.com/news/showArticle.jhtml?articleID=181503325&pgno=1

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Wesley,

Thanks again.

The End.

(I'll be back)

Barb

McAfee sucks. Norton is not much better, though I have never used
Norton.

You must have downloaded the wrong version of AVG.

[[AVG Free Edition is for private, non-commercial, single home computer
use only. Use of AVG Free Edition within any organization or for
commercial purposes is strictly prohibited.]]
http://free.grisoft.com/freeweb.php/doc/2/lng/us/tpl/v5

The AVG version on from the link above is the FREE version.

This page has a trial version of AVG Professional (Pay version)
http://free.grisoft.com/doc/11/lng/us/tpl/v5

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Wesley,

Yes it appears that McAfee does not protect my computer as this is the
3rd time I've had viruses. Is Norton any better? I'm going to post a
new question related to problems I've been having since the last time I
had viruses that messed up my computer.

I am trying Grisoft on my old Windows ME computer in the other room.
(I'm definitely getting rid of McAfee.) But it's not free. The trial is
free for 30 days but then you have to pay for it. Good to know you
recommend it. I will go ahead and get it on this computer.

Thanks again. I can't afford a new computer right now so I'm trying to
make this one last a while.

Barb

:

Question: Is W95/CXT a virus? Did it come thru an email attachment I
opened?? If not, how did I get it?? Where did it come from??

Correct W95/CTX detections are reported as W95/CTX.6886 or
W95/CTX.10853

McAfee doesn't say how you get W95/CTX.6886 or W95/CTX.10853.

SWAG: It looks to me like W95/CTX was a false positive (incorrect
identification). McAfee screwed up something, so some files got
deleted that did not need to get deleted and in the process screwed up
your profile.

I dumped McAfee a long time ago and I use a different AV software.

AVG Free for Windows is a free anti-virus protection tool developed by
Grisoft for home use.

Get Your AVG 7 for free!
http://free.grisoft.com/freeweb.php/doc/2/lng/us/tpl/v5

Tips for using AVG Free 7.0 Antivirus
http://mvps.org/winhelp2002/avg7.htm

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Barbara <[email protected]> hunted and pecked:
David and Wesley,

I am trying to understand this about the DAT files. I went ahead and
did a system restore. The 2 methods I tried yesterday did not correct
the problem. During the restore process, it asked if I wanted to
delete the quaranteened files (the virus infected files) and I said
yes. So they are gone. In the past when I've had viruses that ruined
my computer, I tried Restore but it didn't work and I had to reinstall
Windows - but this time it worked. I set the date back to 3/9/06 and
SURPRISE !!! - My computer is back again. I had to remove McAfee and
reinstall it but everything else seems to be working fine.

I read the info you provided in this link and looked at the About - it
says I have DAT Version 4716 created 3/10/06.

Question: Is W95/CXT a virus? Did it come thru an email attachment I
opened?? If not, how did I get it?? Where did it come from??

Is there anything else I need to do??

Thanks again,
Barb

:

Barb,

Make sure that your McAfee has the latest updated DAT files!!!

Apparently there was something wrong with the 4715 DAT files, you
need the 4716 DAT files. And you need to take some other steps.

[[The 4715 DAT files contain an incorrect identification on W95/CTX
under the following products:
On Demand Scanner (ODS) Components Only
(the detection does not occur with the On Access Scanner (OAS), nor
with gateway or email scanners)

a.. VirusScan Enterprise 8.0i
b.. VirusScan Enterprise 7.1
c.. VirusScan Enterprise 7.0
d.. Managed VirusScan 4.0
e.. Managed VirusScan 3.5
f.. VirusScan Online 11
g.. VirusScan Online 10
h.. LinuxShield
i.. VirusScan 7.03 (consumer)
These product may report certain executable files as being infected
with a variant of W95/CTX. At that point the files may be renamed as
filename.exe.vir. However, the point product's secondary action can
result in the file being deleted.

Correct W95/CTX detections are reported as W95/CTX.6886 or
W95/CTX.10853]]

[[The 4716 DAT files have been posted to correct this issue. If you
are seeing W95/CTX detection, ensure that you are running the 4716
DAT files or newer.]]
from...
W95/CTX
http://vil.nai.com/vil/content/v_138884.htm

Click the link to read the whole McAfee article.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Barbara <[email protected]> hunted and pecked:
David,

I opened an email attachment yesterday and got a window that said
something was intruding and then everything went haywire. A virus
corrupted 27 files named - W95/CXT-

After restarting the computer, I got a window from Notepad with this
in it --- [.shellclassinfo localized resource
name=systemroot%\system32\shel32.dll]
- I did not remove anything. It was removed by this virus. I have
never seen this before yesterday.

According to McAfee, the W95/CXT virus is a new virus that came out
3/10/06. It wiped out Outlook Express, all of my Favorites, most of
the icons on desktop, and now none of my settings will save, even
though when I shut down the computer it says it's saving my
settings.

I am a little confused when you say "These are files that should
exist. " as I am getting direction that this file should not exist
and directed to this web page to correct the problem.
http://support.microsoft.com/kb/330132 - I have followed the
directions, both method 1 and 2, and it does not help the problem.

Can you tell me how to correct this problem so my settings will
save?

Thanks,
Barb

:

These are files that should exist. Depending on XP's language they
make parts of Start appear in the correct language. If it opens in
notepad at start then YOU removed the hidden attribute from the
file.

http://margokingston.typepad.com/harry_version_2/2005/12/thank_you_and_g.html#comments

=================================================
Ok - I just figured out how to post back in.

Yes I did that. I did not just delete the line - I deleted the
whole file -desktop.ini - if it contained [.ShellClassInfo]>
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

Yes I did delete the files in the Temp folders that contained that
line, but it doesn't stay deleted. When I restart the computer and
do a search, the same Temp files are contaminiated again. I have
cleaned them 3 times but they don't stay cleaned. The only files
on the computer right now that contain the desktop.ini file are
in the Temp files. Unless there are more files and Search is not
finding them.

Also, the 2 files in Windows Explorer you said to uncheck - Hide
extensions and Hide operating systems - I have unchecked them 3
times but, when shutting down the computer and starting it back
up, they are checked again.

But isn't that the problem. No settings can be saved. So why would
it save any settings in Windows Explorer any more than any where
else?

I have re-scanned with McAfee to make sure the virus is gone and
it is gone - so I'm not being re-infected.

This virus - W95/CTX - is a new virus that came out yesterday.
McAfee did not stop it on my computer. I had 27 infected files.
When I look at these files, some are the ones I have cleaned, but
there are many other kinds of files. The files have been
quaranteened because McAfee software says you cannot clean them.

Obviously, the maker of this virus has found a way to twart the
standard way to fix this problem. The standard way doesn't work.
Any ideas?

thanks,
Barb



:

Barb,

You need to post back in one of the same threads as you posted in
originally. It makes it too hard for anyone to find your posts
otherwise.

Don't delete the line within the desktop.ini file, delete the
whole desktop.ini file.

The only desktop.ini file(s) that you would want to delete are
any that contain these lines:

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

However, you shouldn't have any desktop.ini files in any temp
folders, so those would be OK to delete, no matter what the
desktop.ini files have in them.

This temp folder, C:\WINDOWS\Temp ??

Or this one, C:\Documents and Settings\Your Name Here\Local
Settings\Temp ??

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Barbara <[email protected]> hunted and pecked:
Thanks for your help earlier with the desktop [.shelclassinfo]
localizedresource name=systemroot\system32\shell32.dll -21787,
however, I followed your directions - used Method 1 and 2 with
msconfig. But still having the same problems and this file pops
up at startup. Tried saving some settings but they don't save
after turning
the computer off and then back on.

The desktop.ini file did not appear in the files named but I did
find
them using Search in the Temp files. Should I delte those?

Any other suggestions?

Thanks,
Barb

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Barbara <[email protected]> hunted and pecked:
To W. Vogel - I have followed your directions and tried to clear
this
line as you have previously instructed using both methods -
[.shelclassinfo localized resource
name=systemroot%\system32\shel32.dll -21787 - but on startup,
the window Desktop Notepad still pops up with this line. I still
cannot
save any settings.

 

[Guest]

Yes I see! There are 2 ways to correct the problem as I've learned. First, do
a system restore. Second, get rid of McAfee. I did both.

Barb

It made the news.

McAfee Update Breaks Hundreds Of Apps
For over five hours Friday, McAfee's anti-virus software erroneously flagged
hundreds of legitimate executables as a malicious virus, leading some
customers to quarantine or delete the offending files and render
applications such as Microsoft Excel inoperative.
http://www.informationweek.com/news/showArticle.jhtml?articleID=181503325&pgno=1

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Wesley,

Thanks again.

The End.

(I'll be back)

Barb

McAfee sucks. Norton is not much better, though I have never used
Norton.

You must have downloaded the wrong version of AVG.

[[AVG Free Edition is for private, non-commercial, single home computer
use only. Use of AVG Free Edition within any organization or for
commercial purposes is strictly prohibited.]]
http://free.grisoft.com/freeweb.php/doc/2/lng/us/tpl/v5

The AVG version on from the link above is the FREE version.

This page has a trial version of AVG Professional (Pay version)
http://free.grisoft.com/doc/11/lng/us/tpl/v5

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Barbara <[email protected]> hunted and pecked:
Wesley,

Yes it appears that McAfee does not protect my computer as this is the
3rd time I've had viruses. Is Norton any better? I'm going to post a
new question related to problems I've been having since the last time I
had viruses that messed up my computer.

I am trying Grisoft on my old Windows ME computer in the other room.
(I'm definitely getting rid of McAfee.) But it's not free. The trial is
free for 30 days but then you have to pay for it. Good to know you
recommend it. I will go ahead and get it on this computer.

Thanks again. I can't afford a new computer right now so I'm trying to
make this one last a while.

Barb

:

Question: Is W95/CXT a virus? Did it come thru an email attachment I
opened?? If not, how did I get it?? Where did it come from??

Correct W95/CTX detections are reported as W95/CTX.6886 or
W95/CTX.10853

McAfee doesn't say how you get W95/CTX.6886 or W95/CTX.10853.

SWAG: It looks to me like W95/CTX was a false positive (incorrect
identification). McAfee screwed up something, so some files got
deleted that did not need to get deleted and in the process screwed up
your profile.

I dumped McAfee a long time ago and I use a different AV software.

AVG Free for Windows is a free anti-virus protection tool developed by
Grisoft for home use.

Get Your AVG 7 for free!
http://free.grisoft.com/freeweb.php/doc/2/lng/us/tpl/v5

Tips for using AVG Free 7.0 Antivirus
http://mvps.org/winhelp2002/avg7.htm

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Barbara <[email protected]> hunted and pecked:
David and Wesley,

I am trying to understand this about the DAT files. I went ahead and
did a system restore. The 2 methods I tried yesterday did not correct
the problem. During the restore process, it asked if I wanted to
delete the quaranteened files (the virus infected files) and I said
yes. So they are gone. In the past when I've had viruses that ruined
my computer, I tried Restore but it didn't work and I had to reinstall
Windows - but this time it worked. I set the date back to 3/9/06 and
SURPRISE !!! - My computer is back again. I had to remove McAfee and
reinstall it but everything else seems to be working fine.

I read the info you provided in this link and looked at the About - it
says I have DAT Version 4716 created 3/10/06.

Question: Is W95/CXT a virus? Did it come thru an email attachment I
opened?? If not, how did I get it?? Where did it come from??

Is there anything else I need to do??

Thanks again,
Barb

:

Barb,

Make sure that your McAfee has the latest updated DAT files!!!

Apparently there was something wrong with the 4715 DAT files, you
need the 4716 DAT files. And you need to take some other steps.

[[The 4715 DAT files contain an incorrect identification on W95/CTX
under the following products:
On Demand Scanner (ODS) Components Only
(the detection does not occur with the On Access Scanner (OAS), nor
with gateway or email scanners)

a.. VirusScan Enterprise 8.0i
b.. VirusScan Enterprise 7.1
c.. VirusScan Enterprise 7.0
d.. Managed VirusScan 4.0
e.. Managed VirusScan 3.5
f.. VirusScan Online 11
g.. VirusScan Online 10
h.. LinuxShield
i.. VirusScan 7.03 (consumer)
These product may report certain executable files as being infected
with a variant of W95/CTX. At that point the files may be renamed as
filename.exe.vir. However, the point product's secondary action can
result in the file being deleted.

Correct W95/CTX detections are reported as W95/CTX.6886 or
W95/CTX.10853]]

[[The 4716 DAT files have been posted to correct this issue. If you
are seeing W95/CTX detection, ensure that you are running the 4716
DAT files or newer.]]
from...
W95/CTX
http://vil.nai.com/vil/content/v_138884.htm

Click the link to read the whole McAfee article.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Barbara <[email protected]> hunted and pecked:
David,

I opened an email attachment yesterday and got a window that said
something was intruding and then everything went haywire. A virus
corrupted 27 files named - W95/CXT-

After restarting the computer, I got a window from Notepad with this
in it --- [.shellclassinfo localized resource
name=systemroot%\system32\shel32.dll]
- I did not remove anything. It was removed by this virus. I have
never seen this before yesterday.

According to McAfee, the W95/CXT virus is a new virus that came out
3/10/06. It wiped out Outlook Express, all of my Favorites, most of
the icons on desktop, and now none of my settings will save, even
though when I shut down the computer it says it's saving my
settings.

I am a little confused when you say "These are files that should
exist. " as I am getting direction that this file should not exist
and directed to this web page to correct the problem.
http://support.microsoft.com/kb/330132 - I have followed the
directions, both method 1 and 2, and it does not help the problem.

Can you tell me how to correct this problem so my settings will
save?

Thanks,
Barb

:

These are files that should exist. Depending on XP's language they
make parts of Start appear in the correct language. If it opens in
notepad at start then YOU removed the hidden attribute from the
file.



--
------------------------------------------------------------------- --
-- --
------------------------- Goodbye Web Diary



http://margokingston.typepad.com/harry_version_2/2005/12/thank_you_and_g.html#comments
=================================================
Ok - I just figured out how to post back in.

Yes I did that. I did not just delete the line - I deleted the
whole file -desktop.ini - if it contained [.ShellClassInfo]>
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

Yes I did delete the files in the Temp folders that contained that
line, but it doesn't stay deleted. When I restart the computer and
do a search, the same Temp files are contaminiated again. I have
cleaned them 3 times but they don't stay cleaned. The only files
on the computer right now that contain the desktop.ini file are
in the Temp files. Unless there are more files and Search is not
finding them.

Also, the 2 files in Windows Explorer you said to uncheck - Hide
extensions and Hide operating systems - I have unchecked them 3
times but, when shutting down the computer and starting it back
up, they are checked again.

But isn't that the problem. No settings can be saved. So why would
it save any settings in Windows Explorer any more than any where
else?

I have re-scanned with McAfee to make sure the virus is gone and
it is gone - so I'm not being re-infected.

This virus - W95/CTX - is a new virus that came out yesterday.
McAfee did not stop it on my computer. I had 27 infected files.
When I look at these files, some are the ones I have cleaned, but
there are many other kinds of files. The files have been
quaranteened because McAfee software says you cannot clean them.

Obviously, the maker of this virus has found a way to twart the
standard way to fix this problem. The standard way doesn't work.
Any ideas?

thanks,
Barb



:

Barb,

You need to post back in one of the same threads as you posted in
originally. It makes it too hard for anyone to find your posts
otherwise.

Don't delete the line within the desktop.ini file, delete the
whole desktop.ini file.

The only desktop.ini file(s) that you would want to delete are
any that contain these lines:

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

However, you shouldn't have any desktop.ini files in any temp
folders, so those would be OK to delete, no matter what the
desktop.ini files have in them.

This temp folder, C:\WINDOWS\Temp ??

Or this one, C:\Documents and Settings\Your Name Here\Local
Settings\Temp ??

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

 

[Wesley Vogel]

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Yes I see! There are 2 ways to correct the problem as I've learned.
First, do a system restore. Second, get rid of McAfee. I did both.

Barb

It made the news.

McAfee Update Breaks Hundreds Of Apps
For over five hours Friday, McAfee's anti-virus software erroneously
flagged hundreds of legitimate executables as a malicious virus, leading
some customers to quarantine or delete the offending files and render
applications such as Microsoft Excel inoperative.
http://www.informationweek.com/news/showArticle.jhtml?articleID=181503325&pgno=1

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

Wesley,

Thanks again.

The End.

(I'll be back)

Barb

:

McAfee sucks. Norton is not much better, though I have never used
Norton.

You must have downloaded the wrong version of AVG.

[[AVG Free Edition is for private, non-commercial, single home computer
use only. Use of AVG Free Edition within any organization or for
commercial purposes is strictly prohibited.]]
http://free.grisoft.com/freeweb.php/doc/2/lng/us/tpl/v5

The AVG version on from the link above is the FREE version.

This page has a trial version of AVG Professional (Pay version)
http://free.grisoft.com/doc/11/lng/us/tpl/v5

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Barbara <[email protected]> hunted and pecked:
Wesley,

Yes it appears that McAfee does not protect my computer as this is the
3rd time I've had viruses. Is Norton any better? I'm going to post a
new question related to problems I've been having since the last time
I had viruses that messed up my computer.

I am trying Grisoft on my old Windows ME computer in the other room.
(I'm definitely getting rid of McAfee.) But it's not free. The trial
is free for 30 days but then you have to pay for it. Good to know you
recommend it. I will go ahead and get it on this computer.

Thanks again. I can't afford a new computer right now so I'm trying to
make this one last a while.

Barb

:

Question: Is W95/CXT a virus? Did it come thru an email attachment I
opened?? If not, how did I get it?? Where did it come from??

Correct W95/CTX detections are reported as W95/CTX.6886 or
W95/CTX.10853

McAfee doesn't say how you get W95/CTX.6886 or W95/CTX.10853.

SWAG: It looks to me like W95/CTX was a false positive (incorrect
identification). McAfee screwed up something, so some files got
deleted that did not need to get deleted and in the process screwed
up your profile.

I dumped McAfee a long time ago and I use a different AV software.

AVG Free for Windows is a free anti-virus protection tool developed
by Grisoft for home use.

Get Your AVG 7 for free!
http://free.grisoft.com/freeweb.php/doc/2/lng/us/tpl/v5

Tips for using AVG Free 7.0 Antivirus
http://mvps.org/winhelp2002/avg7.htm

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Barbara <[email protected]> hunted and pecked:
David and Wesley,

I am trying to understand this about the DAT files. I went ahead and
did a system restore. The 2 methods I tried yesterday did not
correct the problem. During the restore process, it asked if I
wanted to delete the quaranteened files (the virus infected files)
and I said yes. So they are gone. In the past when I've had
viruses that ruined my computer, I tried Restore but it didn't work
and I had to reinstall Windows - but this time it worked. I set the
date back to 3/9/06 and SURPRISE !!! - My computer is back again. I
had to remove McAfee and reinstall it but everything else seems to
be working fine.

I read the info you provided in this link and looked at the About -
it says I have DAT Version 4716 created 3/10/06.

Question: Is W95/CXT a virus? Did it come thru an email attachment I
opened?? If not, how did I get it?? Where did it come from??

Is there anything else I need to do??

Thanks again,
Barb

:

Barb,

Make sure that your McAfee has the latest updated DAT files!!!

Apparently there was something wrong with the 4715 DAT files, you
need the 4716 DAT files. And you need to take some other steps.

[[The 4715 DAT files contain an incorrect identification on W95/CTX
under the following products:
On Demand Scanner (ODS) Components Only
(the detection does not occur with the On Access Scanner (OAS), nor
with gateway or email scanners)

a.. VirusScan Enterprise 8.0i
b.. VirusScan Enterprise 7.1
c.. VirusScan Enterprise 7.0
d.. Managed VirusScan 4.0
e.. Managed VirusScan 3.5
f.. VirusScan Online 11
g.. VirusScan Online 10
h.. LinuxShield
i.. VirusScan 7.03 (consumer)
These product may report certain executable files as being infected
with a variant of W95/CTX. At that point the files may be renamed
as filename.exe.vir. However, the point product's secondary
action can result in the file being deleted.

Correct W95/CTX detections are reported as W95/CTX.6886 or
W95/CTX.10853]]

[[The 4716 DAT files have been posted to correct this issue. If
you are seeing W95/CTX detection, ensure that you are running the
4716 DAT files or newer.]]
from...
W95/CTX
http://vil.nai.com/vil/content/v_138884.htm

Click the link to read the whole McAfee article.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In Barbara <[email protected]> hunted and pecked:
David,

I opened an email attachment yesterday and got a window that said
something was intruding and then everything went haywire. A virus
corrupted 27 files named - W95/CXT-

After restarting the computer, I got a window from Notepad with
this in it --- [.shellclassinfo localized resource
name=systemroot%\system32\shel32.dll]
- I did not remove anything. It was removed by this virus. I have
never seen this before yesterday.

According to McAfee, the W95/CXT virus is a new virus that came
out 3/10/06. It wiped out Outlook Express, all of my Favorites,
most of the icons on desktop, and now none of my settings will
save, even though when I shut down the computer it says it's
saving my settings.

I am a little confused when you say "These are files that should
exist. " as I am getting direction that this file should not
exist and directed to this web page to correct the problem.
http://support.microsoft.com/kb/330132 - I have followed the
directions, both method 1 and 2, and it does not help the problem.

Can you tell me how to correct this problem so my settings will
save?

Thanks,
Barb

:

These are files that should exist. Depending on XP's language
they make parts of Start appear in the correct language. If it
opens in notepad at start then YOU removed the hidden attribute
from the file.

http://margokingston.typepad.com/harry_version_2/2005/12/thank_you_and_g.html#comments

=================================================
Ok - I just figured out how to post back in.

Yes I did that. I did not just delete the line - I deleted the
whole file -desktop.ini - if it contained [.ShellClassInfo]>
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

Yes I did delete the files in the Temp folders that contained
that line, but it doesn't stay deleted. When I restart the
computer and do a search, the same Temp files are contaminiated
again. I have cleaned them 3 times but they don't stay cleaned.
The only files on the computer right now that contain the
desktop.ini file are in the Temp files. Unless there are more
files and Search is not finding them.

Also, the 2 files in Windows Explorer you said to uncheck - Hide
extensions and Hide operating systems - I have unchecked them 3
times but, when shutting down the computer and starting it back
up, they are checked again.

But isn't that the problem. No settings can be saved. So why
would it save any settings in Windows Explorer any more than
any where else?

I have re-scanned with McAfee to make sure the virus is gone and
it is gone - so I'm not being re-infected.

This virus - W95/CTX - is a new virus that came out yesterday.
McAfee did not stop it on my computer. I had 27 infected files.
When I look at these files, some are the ones I have cleaned,
but there are many other kinds of files. The files have been
quaranteened because McAfee software says you cannot clean them.

Obviously, the maker of this virus has found a way to twart the
standard way to fix this problem. The standard way doesn't work.
Any ideas?

thanks,
Barb



:

Barb,

You need to post back in one of the same threads as you posted
in originally. It makes it too hard for anyone to find your
posts otherwise.

Don't delete the line within the desktop.ini file, delete the
whole desktop.ini file.

The only desktop.ini file(s) that you would want to delete are
any that contain these lines:

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

However, you shouldn't have any desktop.ini files in any temp
folders, so those would be OK to delete, no matter what the
desktop.ini files have in them.

This temp folder, C:\WINDOWS\Temp ??

Or this one, C:\Documents and Settings\Your Name Here\Local
Settings\Temp ??

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

 

[Guest]

My recycle bin has been named %SystemRoot%\SYSTEM32\Shell32.dll,32

I checked under C:\Windows\System and there is a Shell.dll. In
C:\Windows\System32, there is a folder called ShellExt and there is a
Shell.dll and a Shell 32.dll. I do not see a Shell 32.dll,32.

I was trying to download updates and save to the desktop and then run them;
after I ran them, I sent them to the recycle bin. Somewhere in the process
of doing this, I renamed my Recycle Bin %SystemRoot%\SYSTEM32\Shell32.dll,32.

Do I need Shell32.dll,32? If so how do I recover it; and how do I change my
Recycle Bin name. I tried Windows Explorer and nothing will allowed me to
change the name.

Unfortunately I do have McAfee.

 

[Ramesh, MS-MVP]

Shell32.dll is a vital system file present in C:\Windows\System32

IconIndex is a zero-based index that points to a particular icon in the
file. In the following string, the "32" represents the Iconindex into the
Shell32.dll file.

"%SystemRoot%\SYSTEM32\Shell32.dll,32"

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows XP Shell/User]
Windows® XP Troubleshooting http://www.winhelponline.com


My recycle bin has been named %SystemRoot%\SYSTEM32\Shell32.dll,32

I checked under C:\Windows\System and there is a Shell.dll. In
C:\Windows\System32, there is a folder called ShellExt and there is a
Shell.dll and a Shell 32.dll. I do not see a Shell 32.dll,32.

I was trying to download updates and save to the desktop and then run them;
after I ran them, I sent them to the recycle bin. Somewhere in the process
of doing this, I renamed my Recycle Bin
%SystemRoot%\SYSTEM32\Shell32.dll,32.

Do I need Shell32.dll,32? If so how do I recover it; and how do I change my
Recycle Bin name. I tried Windows Explorer and nothing will allowed me to
change the name.

Unfortunately I do have McAfee.