To W. Vogel - I have followed your directions and tried to clear this line as
you have previously instructed using both methods - [.shelclassinfo localized
resource name=systemroot%\system32\shel32.dll -21787 - but on startup, the
window Desktop Notepad still pops up with this line. I still cannot save any
settings.

In Method 1, I deleted the desktop.ini files containing that line in the
following --
drive:\Documents and Settings\All Users\Start Menu\Programs\Startup
• drive:\Documents and Settings\All Users\Start Menu\Programs
• drive:\Documents and Settings\All Users\Start Menu

When doing a search for the desktop.ini file, these files no longer come up.

I also unchecked "Hide extensions for known file types" and "Hide protected
operating system." But when I shut down the computer and turn it back on,
these are checked again.

I tried the 2nd method with msconfig - There was one Adobe file with Common
Startup and I deleted that. That remains deleted.

I also cleaned out the Temp files that contain this line, but when I shut
down the computer and start up again and do another search, the same files
are contaminated again.

The virus - W95/CTX - has obviously found a way to get around fixing this
problem. The usual method is not working.

What else do you suggest?? There must be another way.

Thanks,
Barbara

Barb,

You need to post back in one of the same threads as you posted in
originally. It makes it too hard for anyone to find your posts otherwise.

Don't delete the line within the desktop.ini file, delete the whole
desktop.ini file.

The only desktop.ini file(s) that you would want to delete are any that
contain these lines:

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell 32.dll,-21787

However, you shouldn't have any desktop.ini files in any temp folders, so
those would be OK to delete, no matter what the desktop.ini files have in
them.

This temp folder, C:\WINDOWS\Temp ??

Or this one, C:\Documents and Settings\Your Name Here\Local Settings\Temp ??

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:B1F043C0-BCEB-4DA1-9F94-7763CE4F4DA3@microsoft.com,
Barbara <Barbara@discussions.microsoft.com> hunted and pecked:
--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:7B911C07-10F7-4FB8-B3C6-D2235A6518AC@microsoft.com,
Barbara <Barbara@discussions.microsoft.com> hunted and pecked:

Ok - I just figured out how to post back in.

Yes I did that. I did not just delete the line - I deleted the whole file
-desktop.ini - if it contained [.ShellClassInfo]>
LocalizedResourceName=@%SystemRoot%\system32\shell 32.dll,-21787

Yes I did delete the files in the Temp folders that contained that line, but
it doesn't stay deleted. When I restart the computer and do a search, the
same Temp files are contaminiated again. I have cleaned them 3 times but they
don't stay cleaned. The only files on the computer right now that contain the
desktop.ini file are in the Temp files. Unless there are more files and
Search is not finding them.

Also, the 2 files in Windows Explorer you said to uncheck - Hide extensions
and Hide operating systems - I have unchecked them 3 times but, when shutting
down the computer and starting it back up, they are checked again.

But isn't that the problem. No settings can be saved. So why would it save
any settings in Windows Explorer any more than any where else?

I have re-scanned with McAfee to make sure the virus is gone and it is gone
- so I'm not being re-infected.

This virus - W95/CTX - is a new virus that came out yesterday. McAfee did
not stop it on my computer. I had 27 infected files. When I look at these
files, some are the ones I have cleaned, but there are many other kinds of
files. The files have been quaranteened because McAfee software says you
cannot clean them.

Obviously, the maker of this virus has found a way to twart the standard way
to fix this problem. The standard way doesn't work. Any ideas?

thanks,
Barb



"Wesley Vogel" wrote:

These are files that should exist. Depending on XP's language they make parts of Start appear in the correct language. If it opens in notepad at start then YOU removed the hidden attribute from the file.



--
--------------------------------------------------------------------------------------------------
Goodbye Web Diary
http://margokingston.typepad.com/har....html#comments
=================================================
"Barbara" <Barbara@discussions.microsoft.com> wrote in message news:3E056AB0-87FE-49D5-989F-A69DD8BCFF79@microsoft.com...

David,

I opened an email attachment yesterday and got a window that said something
was intruding and then everything went haywire. A virus corrupted 27 files
named - W95/CXT-

After restarting the computer, I got a window from Notepad with this in it
--- [.shellclassinfo localized resource name=systemroot%\system32\shel32.dll]
- I did not remove anything. It was removed by this virus. I have never seen
this before yesterday.

According to McAfee, the W95/CXT virus is a new virus that came out 3/10/06.
It wiped out Outlook Express, all of my Favorites, most of the icons on
desktop, and now none of my settings will save, even though when I shut down
the computer it says it's saving my settings.

I am a little confused when you say "These are files that should exist. "
as I am getting direction that this file should not exist and directed to
this web page to correct the problem. http://support.microsoft.com/kb/330132
- I have followed the directions, both method 1 and 2, and it does not help
the problem.

Can you tell me how to correct this problem so my settings will save?

Thanks,
Barb

"David Candy" wrote:

Microsoft are wrong. The file should be there and should be hidden. It replaces the name of the folder Startup with whatever startup is in any language. In english the word is startup so it makes no difference. This particular line in the file is for the Per User startup folder.

Explorer shell executes (same as dbl clicking a file) any non hidden files in this folder.

It doesn't matter much on english language if the file is deleted or not.

I'd say you are logging on with a new profile each logon? Are My Docs etc still there?
--
--------------------------------------------------------------------------------------------------
Goodbye Web Diary
http://margokingston.typepad.com/har....html#comments
=================================================
"Barbara" <Barbara@discussions.microsoft.com> wrote in message news39BE663-C327-40C0-9426-286A24CB1B92@microsoft.com...

Barb,

Make sure that your McAfee has the latest updated DAT files!!!

Apparently there was something wrong with the 4715 DAT files, you need the
4716 DAT files. And you need to take some other steps.

[[The 4715 DAT files contain an incorrect identification on W95/CTX under
the following products:
On Demand Scanner (ODS) Components Only
(the detection does not occur with the On Access Scanner (OAS), nor with
gateway or email scanners)

a.. VirusScan Enterprise 8.0i
b.. VirusScan Enterprise 7.1
c.. VirusScan Enterprise 7.0
d.. Managed VirusScan 4.0
e.. Managed VirusScan 3.5
f.. VirusScan Online 11
g.. VirusScan Online 10
h.. LinuxShield
i.. VirusScan 7.03 (consumer)
These product may report certain executable files as being infected with a
variant of W95/CTX. At that point the files may be renamed as
filename.exe.vir. However, the point product's secondary action can result
in the file being deleted.

Correct W95/CTX detections are reported as W95/CTX.6886 or W95/CTX.10853]]

[[The 4716 DAT files have been posted to correct this issue. If you are
seeing W95/CTX detection, ensure that you are running the 4716 DAT files or
newer.]]
from...
W95/CTX
http://vil.nai.com/vil/content/v_138884.htm

Click the link to read the whole McAfee article.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news39BE663-C327-40C0-9426-286A24CB1B92@microsoft.com,
Barbara <Barbara@discussions.microsoft.com> hunted and pecked:

David and Wesley,

I am trying to understand this about the DAT files. I went ahead and did a
system restore. The 2 methods I tried yesterday did not correct the problem.
During the restore process, it asked if I wanted to delete the quaranteened
files (the virus infected files) and I said yes. So they are gone. In the
past when I've had viruses that ruined my computer, I tried Restore but it
didn't work and I had to reinstall Windows - but this time it worked. I set
the date back to 3/9/06 and SURPRISE !!! - My computer is back again. I had
to remove McAfee and reinstall it but everything else seems to be working
fine.

I read the info you provided in this link and looked at the About - it says
I have DAT Version 4716 created 3/10/06.

Question: Is W95/CXT a virus? Did it come thru an email attachment I
opened?? If not, how did I get it?? Where did it come from??

Is there anything else I need to do??

Thanks again,
Barb

"Wesley Vogel" wrote:

Correct W95/CTX detections are reported as W95/CTX.6886 or W95/CTX.10853

McAfee doesn't say how you get W95/CTX.6886 or W95/CTX.10853.

SWAG: It looks to me like W95/CTX was a false positive (incorrect
identification). McAfee screwed up something, so some files got deleted
that did not need to get deleted and in the process screwed up your profile.

I dumped McAfee a long time ago and I use a different AV software.

AVG Free for Windows is a free anti-virus protection tool developed by
Grisoft for home use.

Get Your AVG 7 for free!
http://free.grisoft.com/freeweb.php/doc/2/lng/us/tpl/v5

Tips for using AVG Free 7.0 Antivirus
http://mvps.org/winhelp2002/avg7.htm

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:E2179680-5D7D-4B0C-8938-CAC18667FBE6@microsoft.com,
Barbara <Barbara@discussions.microsoft.com> hunted and pecked:

Wesley,

Yes it appears that McAfee does not protect my computer as this is the 3rd
time I've had viruses. Is Norton any better? I'm going to post a new
question related to problems I've been having since the last time I had
viruses that messed up my computer.

I am trying Grisoft on my old Windows ME computer in the other room. (I'm
definitely getting rid of McAfee.) But it's not free. The trial is free for
30 days but then you have to pay for it. Good to know you recommend it. I
will go ahead and get it on this computer.

Thanks again. I can't afford a new computer right now so I'm trying to make
this one last a while.

Barb

"Wesley Vogel" wrote:

McAfee sucks. Norton is not much better, though I have never used Norton.

You must have downloaded the wrong version of AVG.

[[AVG Free Edition is for private, non-commercial, single home computer use
only. Use of AVG Free Edition within any organization or for commercial
purposes is strictly prohibited.]]
http://free.grisoft.com/freeweb.php/doc/2/lng/us/tpl/v5

The AVG version on from the link above is the FREE version.

This page has a trial version of AVG Professional (Pay version)
http://free.grisoft.com/doc/11/lng/us/tpl/v5

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:C306523E-94FB-4F36-9274-8B24E60E11D8@microsoft.com,
Barbara <Barbara@discussions.microsoft.com> hunted and pecked:

Wesley,

Thanks again.

The End.

(I'll be back)

Barb

"Wesley Vogel" wrote:

It made the news.

McAfee Update Breaks Hundreds Of Apps
For over five hours Friday, McAfee's anti-virus software erroneously flagged
hundreds of legitimate executables as a malicious virus, leading some
customers to quarantine or delete the offending files and render
applications such as Microsoft Excel inoperative.
http://www.informationweek.com/news/...1503325&pgno=1

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:67F044D8-0F5E-4D28-9C93-8E060B6A0AA1@microsoft.com,
Barbara <Barbara@discussions.microsoft.com> hunted and pecked:

Yes I see! There are 2 ways to correct the problem as I've learned. First, do
a system restore. Second, get rid of McAfee. I did both.

Barb

"Wesley Vogel" wrote:

:-)

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:27614D26-F578-4BAA-9F8C-76E548DD7E96@microsoft.com,
Barbara <Barbara@discussions.microsoft.com> hunted and pecked: