Shell32.dll Wants to open with ANY keypress

[gazza321]

Hi All - a very frustrated newbie here.

I did have Vista installed on my laptop, and recently a strange occurunce started happening - everytime I pressed ANY key on my keyboard Windows Media Player would aggresively open, and dominate my desktop, I tried AVG, trojan reomver, and NOD32 - none of them found a problem.

I searched google endlessly looking for an answer - all I could find was someone saying that the got aorund this problem by installing Windows 7.

Last night I sat down and installed Windows 7, all of the install went fine, not a glitch - when it was all finished I jubilantly pressed the G key on my keyboard feeling smug that I had gotten rid of the virus/torjan - but guess what, out came Windows Media Centre -AAARRRGGGGHHHHHH - So what I went on to do, is disable Windows Media Centre in Windows Features within Control Panel - of course this stopped WMP popping up - but now I have Windows giving me an error message to say 'Shell32.dll wants to open, but Windows does no know what to associate the file with' - So I guess now I have switched WMP off, the infected Shell32 wants to run, but I can't as I have disabled WMP - hence why I am getting the error message..

My question to the tech wizards, is how can I replace/rebuild/reinstall a non-infected Shell32.dll file? Is it indeed the System Shell32.dll that is at fault/??

I assume that this is an altered file due to a virus as no virus proggys pick it up - but who knows, it might be a clean install if nothing found

For everyones info, I am running Windows 7 Ultimate 32 Bit

Thanks everyone

Gaz

 

[Thorsen]

Try scanning your computer from win7 http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

This will find and fix problem files if it finds any errors.

 

[blackroseMD1]

After you run SFC /scannow, if you still have the problem, I would recommend doing a scan and a boot time scan with MalwareBytes, just to see if it picks anything up. It's worth a shot, and might save you a reinstall.

 

[gazza321]

Thanks Blackrose & Thorsen

Does anyone have any idea if I extract the shell32.dll from my 7 install disk and overwrite the existing, will it overwrite the infected file?

Gaz

 

[blackroseMD1]

Thanks Blackrose & Thorsen

Does anyone have any idea if I extract the shell32.dll from my 7 install disk and overwrite the existing, will it overwrite the infected file?

Gaz

It might, but I would use that as a last resort before a reinstall. It could cause system instability, especially if Windows updates have been installed.

 

[gazza321]

Thanks Blackrose & Thorsen

Does anyone have any idea if I extract the shell32.dll from my 7 install disk and overwrite the existing, will it overwrite the infected file?

Gaz

It might, but I would use that as a last resort before a reinstall. It could cause system instability, especially if Windows updates have been installed.

No updates have been allowed since I upgraded to Win 7 last night - I have switched updates off until I can get right of this damned virus.

 

[fseal]

Have you tried using a different keyboard?

Maybe the media keys are going crazy on the one you have (Or the KB is going crazy and outputting media key ascan codes even if it doesn't have media keys)

 

[gazza321]

Have you tried using a different keyboard?

Maybe the media keys are going crazy on the one you have (Or the KB is going crazy and outputting media key ascan codes even if it doesn't have media keys)

I haven't tried another Keyboard - why didn't I think of that????????

**Edit** If it is the keyboard, would I need a new keyboard, or a new HID driver?

 

[Mark Phelps]

What happens in a lot of these cases is that some malware modified the shell entry in the registry to tack on their program, thus redirecting the keystrokes to their program. They also generally make other registry changes that will prevent the installation and/or launching of wellknown AV programs.

I've disinfected more than one machine with these problems and have found the combination of the following products to do an excellent job of both cleaning the system and restoring it to working condition:
1) Malwarebytes anti-malware
2) Superantispyware

Both of these can be had for free from their respective download sites, plus the second of these uses a randomly-generated filename -- thereby making it nearly impossible for malware to block its launching.

Strongly recommend you use these tools before you go hacking around making changes on your own.

 

[fseal]

If it stops with a different KB then likely you just need to recycle that one and get a new one, nothing else should need to be changed.

If it does it with a second KB then.. well that's a puzzler

 

[anthanog44]

Hi gazza321
Im sorry to say I have exactly the same problem with windows 7 ultimate 32 I had exactly the same media player and the dll error reports as you. I have tried everything. I noticed tonight that the situation got very much worse between 10 and 11 pm I wonder if this is time related? considering someone mentioned keyboards, you don't by any chance use a wireless linked mouse and kb such as the Logitech device? I wondered if other users are interfering with the signal by using similar wireless devices.
can you say if you have solved the problem and how or what you have dome about it. mine gets that bad that I cant delete the error reports as fast as they appear. it is nothing to do with the shell32 file itself I have checked and its all intact. I also did a reinstall over the top of the existing with no joy.
I have also replaced bullguard anti v with Avast but with no difference. something is essentially clicking the dll file. I have now changed the old KB with a wired one just in case.

regards

 

[anthanog44]

Hi Gazza321
5.30 am update
I have just run the two software items suggested by Mark Phelps. the first(antimaleware) found nothing. THe second (superantispyware) found 28 items mostly harmless cookies however there was a single serious threat- a download of visual basic 2010 which I thought I had deleted. I have removed all these items on a sob (---- or bust) basis and will keep you informed of any progress later today. I would suggest it is highly unlikely that these deletions will have any effect as we would have both had to have had the same problems. However, the wired keyboard might. Hopeing for the best Ill try to get some sleep now.

 

[anthanog44]

Hi Gazza321
2.52pm update:
I may have cracked it! Just been playing games for approx. 1 hour without interruption, but this evening without error could be the proof I will update again at about 11.30pm. This gives 2 options
1/ dangerous files interfering
2/ Wireless keyboard
personally I think the latter if you too have such a keyboard.
regards AR

 

[Thorsen]

anthanog44, these posts by Gazza are almost 3 years old this thread being the only thread he posted in.

I would suggest creating a new thread and detail your issue so that people won't get confused with the posts.

also filling in your system specs will help people who want to try and resolve your issue.

 

[anthanog44]

hi thorsen
I hadn't noticed the date, I spent so much time searching for anyone with the same problem.
Surely the point is that this is a problem which can pose difficulties for others. My latest posts indicate that I have possibly found the problem and defined how I came to the answer which others could try.
As I have had no further error reports today and now believe the answer was either a wireless keyboard/mouse or a dangerous download. Furthermore I have restarted the window media centre which was the original indication of the fault.
Having purchased windows 7 I will use it, despite its nuisance factor as compared to XP.

Unlikely to be back as my 54 year interest in computers is coming to an end.

Regards AR

 

[Thorsen]

Oh. I had mis-read. I thought you were still seeing the issue and looking for help to locate the cause. thanks for posting the observations that you had seen for this. the more info the better and hopefully it helps others in the future as well I happened to have posted in this thread and saw it come up in my subscribed threads. at first I didn't know the thread was that old or what I had even posted prior.

also, this forum has tons of older members. and our most knowledgeable members usually