Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows Recovery Series Removed and desktop notepads everywhere


  • Please log in to reply
3 replies to this topic

#1 mgm99t

mgm99t

  • Members
  • 26 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:05 PM

Posted 09 May 2012 - 12:55 PM

Hello All

I would first like to say that I am grateful for all the folks at Bleeping Computer. I have been assisted by them more than once and remember they do accept donations to keep the site going.

I recently had the virus windows recovery tool and it hid all of my documents. Very scary moment for me. I went through the process to remove it with malware bytes and secunia psi and went into the command prompt to unhide everything. Now in all of my documents, pictures, videos, desktop I have a notepad log file with:


[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787


This also pops up every time the laptop starts up. Should I be concerned? How do I stop it from popping up on every boot up?

This one is in my documents:


[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21770
IconResource=%SystemRoot%\system32\imageres.dll,-112
IconFile=%SystemRoot%\system32\shell32.dll
IconIndex=-235

This one is in my pictures

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21779
InfoTip=@%SystemRoot%\system32\shell32.dll,-12688
IconResource=%SystemRoot%\system32\imageres.dll,-113
IconFile=%SystemRoot%\system32\shell32.dll
IconIndex=-236
[LocalizedFileNames]
Sample Pictures.lnk=@%SystemRoot%\system32\shell32.dll,-21805

Thanks for your help.

Mark

BC AdBot (Login to Remove)

 


#2 narenxp

narenxp

  • BC Advisor
  • 16,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:09:05 PM

Posted 09 May 2012 - 01:15 PM

Open your C drive

On top click on Organize-Folder & search options

Click on view tab

In advanced settings

Make sure to check mark DON'T show hidden files

check mark HIDE protected operating system files

Click ok

Now,press Windows+R key and type

shell:common startup and click ok

Delete the desktop.ini file from the startup folder

good luck

Edited by narenxp, 09 May 2012 - 01:21 PM.


#3 mgm99t

mgm99t
  • Topic Starter

  • Members
  • 26 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:05 PM

Posted 10 May 2012 - 11:22 AM

Thanks for the expedient reply to my issue. I went through all of the steps you had suggested and I did not need to uncheck or check anything. Everything is as you suggested.

Upon starting up my computer today the desktop notepad still poppped up with:

[b][.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

Also when I go into shell:common startup the only thing that shows is secunia and nkbmonitor and not a desktop.ini file

and the configuaration folders are still showing n my pictures, videos and my documents. Any further suggestions would be appreciated.

Thanks again

Mark

Edited by mgm99t, 10 May 2012 - 11:25 AM.


#4 narenxp

narenxp

  • BC Advisor
  • 16,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:09:05 PM

Posted 10 May 2012 - 12:36 PM

Download

http://go.microsoft.com/?linkid=9767717

Run the fixit,this should take care of startup issue

and the configuaration folders are still showing n my pictures, videos and my documents. Any further suggestions would be appreciated.

Do you mean the desktop.ini files? They are legitimate ones




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users