notepad popping up

[root]

Friend of mine has XP. She says after she logs onto windows, notepad throws up a window (name of file is desktop, she says)
It contains the following:
[.shellclassinfo]
[email protected],21786

The last thing that was done to her system was removing the loveletter virus using the symantec tool.

It also put a shortcut to the file on her desktop. Why would this have happened. What does it mean? And how can I safely tell her to stop this from happening?

Thanks.

 

[Rollin' Rog]

I can tell you that it is a desktop.ini file pointing to a particular icon. I don't know which, I don't seem to have the corresponding one in my XP. It may or may not be safely deletable.

But what I would do is make sure "hide protected system files" is checked in Folder Options > View, as these files should not otherwise appear.

And you can also troubleshoot by running msconfig and unchecking startup files to see if any there are responsible.

Wouldn't hurt to run something like Spybot either...

http://tomcoyote.com/SPYBOT/

 

[root]

Yeah, I realized that it was the desktop.ini file.
And I had her check in the startup folder for all users.
I told her to move it from there (not delete it, just in case).
However, she said it still appears. This advice was given long distance, and she is new, so I am assuming she did it all right.
I asked her if these files were dimmed, which would indicate that it wasn't normally visible. She said no. But, even if it was, it shouldn't pop up.

I will tell her to check msconfig next time I speak to her. Any idea why this would happen all of a sudden. I have seen this reported by other, with no real explanation about why or how to get rid of it.

 

[Rollin' Rog]

http://tomcoyote.com/SPYBOT/

It might be a good idea to install, update and run Spybot.

And the command sfc /scannow will do a system check for altered or missing system files and replace them automatically or prompt for a CD.

I did a registry search for that shell32.dll,21786 and at first thought I had found something, then realized that the "mru" key for Search Assistant:

HKEY_USERS\S-1-5-21-3341562259-4036164967-2552189465-1006\Software\Microsoft\Search Assistant\ACMru\5604

... simply reflected a previous search. But if she searches, she may find something at another key.

and I did a little sleuthing inside the shell32.dll, it appears the number points not to an icon but to the string "start menu"; of course I don't know what to make of it either Perhaps there is a "dead link" on the Start Menu throwing that out.

 

[root]

I don't know. It is hard to do this long distance, and she is a real newbie. I don't want her even searching in the registry. Still trying to figure out what caused this. I did a google search and am finding a bunch of people reporting this happening....

 

[root]

Oh, and BTW , I am having her run Ad-Aware which is similar to Spybot...
I just wish I had something definite to tell her, that I know would work.

 

[Rollin' Rog]

Ad-aware is pretty out of date. If you can get her to install, update and run Spybot, she'll get much better coverage.

 

[root]

Even with the latest updates and ref files?

 

[Rollin' Rog]

Yes, they are working on a new "engine". The old one hasn't been updated in months. A lot has come down the pike since then.

http://forums.techguy.org/t110741/s.html

 

[root]

I'll check out spybot, but still am not sure it will take care of this problem though.

Thanks

 

[Mollie]

"Notepad Starts With "[.ShellClassInfo] [email protected]%SystemRoot%\System32..."

http://support.microsoft.com/default.aspx?scid=kb;en-us;330132



Mollie
_ _ _
"It could probably be shown by facts and figures that there is no distinctly native American criminal class -- except Congress." Mark Twain

 

[root]

thanks...
with the one I have, it has 21786, rather than 21787....

is it still safe to delete this?

someone, please advise

 

[Rollin' Rog]

I suppose you could save a copy someplace and see what happens. Even just leave it in the recycle bin for a while.

 

[root]

yeah, I was thinking I'll have her try that

 

[Lardog]

Root,

If you are running XP also, you can have her send you a remote assistance request, which will allow you to connect to her local session, while she watches, and fix the problem for her, instead of trying to tell her how to do it.

This feature is a life save for all of those who have assumed the role of tech support for family and friends.

For more info on how to use remote assistance, check out the help files.