On Tue, 09 Mar 2010 09:41:07 +0100, scott <sco### [at] scottcom> wrote:
>>> I simply copied shell32.dll from C:\Windows\System32 into C:\Windows
>>
>> Not a good idea.
>
> OOC why not?

Just off the top of my head:
- Files that share the name, but not the path, of a system file are common  
indicators of malware.
- The original file in 'system32' is protected against unauthorised  
changes (though less so in WinXP if you are using an administrator  
account).
- The original file in 'system32' is affected by system updates.
- You are treating a symptom, not the cause.


>> Try using ShellExView to see if there is a misconfigured shell  
>> extension, or a remnant of some malware.
>
> What am I looking for in ShellExView?  A lot of them have  
> system32/shell32.dll as the filename, but none are pointing to  
> windows/shell32.dll.  I wonder why explorer.exe is looking there for it?

Try searching for it in AutoRuns (from SysInternals). If it does not show  
up there, try searching for it in the registry.

Also keep in mind that it might not be registered as  
"windows\shell32.dll". It could be "%WINDIR%\shell32.dll",  
"%SYSTEMROOT%\shell32.dll" or some other variant.



-- 
FE

Post a reply to this message