[lantis33]

First, please forgive my very limited computer knowledge so if I say anything funky, chalk it up to that.

Recently, I've gone through a lot. I was attacked by virtumonde/virtumundo and think that I've gotten rid of it (AdAware, Spybot, Spy Sweeper) and it's been gone for two weeks now.

Last night, when I went to start my computer, my user account was corrupted and I couldn't start up that account. I went through the administrator, created a new account, copied all my documents and such over to the new account and deleted the original account from the system.

Now, or in that process, I started having a desktop-notepad message pop-up at startup saying:

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787


As stated, I have AdAware, Spybot, Spy Sweeper, and also Avast and STOPzilla (this was for the nasty pop-ups that came with virtumonde) and HJT.


Any thoughts on how to get rid of the Notepad pop-up?

[Advertisements]

desktop-notepad message

what does that mean?
could you describe the full error...

[dsenette]

desktop-notepad message

what does that mean?
could you describe the full error...

[lantis33]

I click on my user account name, and when my desktop loads, there's a message window that pops-up that the subject bar (the bar at the top) says "desktop-Notepad" and the body of the text says:

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787


That's all. I'm assuming something is trying to load from my desktop that my system doesn't like meaning, it must be malware or something. Am I right?

[gerryf]

Corrupt desktop.ini, more likely

Start Windows Explorer.

On the Tools menu, click Folder Options>View tab, then look udner Advanced settings and uncheck Hide extensions for known file types and the Hide protected operating system files

click OK.

Locate EACH of the following folders, right-click the Desktop.ini file (if the file exists in that folder), and then click Open:

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
C:\Documents and Settings\All Users\Start Menu\Programs
C:\Documents and Settings\All Users\Start Menu




If ANY of these files contains the following line:
[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

close the file and then Delete it. Windows will recreate on reboot


Reboot

[lantis33]

wow! I can't believe it was that simple! The pop-up is gone now. Thank you so much!

[gerryf]

the weird thing about it is how did it get that way...it's the second one this week for a very rare problem

[lantis33]

hmm, well, did the other person have a corrupted user profile? If not, does that mean it was caused by a virus/worm/trojan of some sort?

Whatever the case, if you need any information from me, let me know and I'll be happy to assist.

[mcpscomp]

Hey gerrif.
I had this problem few days back and got it fixed just the way you show Lantis33. The only thing was I Just did it because I think that would work. Any way, It happen on my fresh instaled XP with all the up date and RIGHT AFTER ZONE ALARM installed. I Played with this old computer for hundred of time but this time, with the combination of all the NEWEST XP UP DATE and ZONE ALARM will do it. What make me so sure about it is at first I think I didn't do it right and I wipe every thing out, get every thing redone and watch.... It sure hapen right after zone alarm installed. and it come up on every single user account. you will have to do same thing to every account to get rid of it.
Hope this will bring up some thing for you to look at.

[gerryf]

Does zonealarm adjust your desktop appearance?

dekstop.ini is used for, among other things, customizing the appearance of an explorer window

That is interesting on the zonealarm thing. I can no longer recommend zonealarm. It seems to be creating more and more issues the older the software gets.

[mcpscomp]

I don't think it has any thing to do with desktop appearance but that remind me of that I didn't let it create desk top shot cut durring installation. By right it shouldn't matter but we never know what they trying to do any more.

[lantis33]

that must have been my problem too. I have zone alarm as well but never placed it as being the sorce of the notepad message.