Windows Forum

Ask something
Discussion Locked

Shell32.exe not found

0 helpful
8 replies

by compuman

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Ok here is the problem one of my clients picked up a trojan and the antivirus got rid of the file shell32.exe that the trojan tried to put on the computer.Now here is the tricky part the trojan changed registry keys to point all exe's to the shell32.exe to open programs. So now I cant open any programs with .exe extention even in safe mode.I could edit in command mode but I dont know what trojan got into the computer and what keys to delete. Any Ideas what I can do to rectify this problem??

8 replies

by bobho

The 2 registry keys that the trojan changed are probably:

HKEY_CLASSES_ROOT\exefile\shell\open\command\(Default)
HKEY_CLASSES_ROOT\batfile\shell\open\command\(Default)

The value of these two keys normally defaults to "%1" %*
and they probably now read SHELL32 "%1" %*

You should be able to change these keys by going to a dos prompt and typing "regedit" (no parenthisis). This should start regedit because the dos prompt does not use the registry for starting executable files. Change thevalues back to the defaults and test the system.

Hope this helps,

DrBob:>)

This discussion is closed to new replies.