shell32.dll,-21787

[PaulTech]

Hi, Repaired a MS Vista 32 bit machine today that had malware. After Hitman ran and rebooted a notepad opened with the following: [.ShellClassInfo]
>> > LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

ref -> http://www.vistax64.com/vista-general/71555-desktop-ini-opening-startup.html

I went after a few desktop.ini but the notepad keeps opening up. The MS Fixit is for XP. Anyone have a tool or technique to handle this one? Thanks for the help!

 

[Xander]

In the start menu's Startup folder, is the ini file hidden?

 

[PaulTech]

Good call! I'll check that.

 

[Xander]

99% of the time, if an .ini file opens on startup, it's because that one's become UNhidden as part of the cleanup process.

 

[PaulTech]

Thanks!

 

[PaulTech]

This command almost works to locate unhidden desktop.ini but also lists other files. Improvements? I used cntl+F to quickly scan through the output file.

run in a cmd window:

DIR %USERPROFILE% desktop.ini /A:-H /S /w > %USERPROFILE%\Desktop\desktopini.txt