shell execute hook

[sonsie]

Microsoft antispyware has a function called 'advanced tools', and an option there is 'system explorer'. Under that, you can view BHOs, downloaded activeX's, etc.

 

The whole time I've been running the antispyware, there have been 3 items under 'shell execute hooks' and they've all had the star beside them which means they're known and are ok. Suddenly, one of them has the exclamation mark, which means it's an unknown. It doesn't say anything dangerous-sounding in the details, and the publisher is Microsoft. I searched in different places for it for a couple of hours - google, microsoft, here, castlecops - but couldn't really find anything definitive. I'm pretty sure it's not bad, but am wondering why it suddenly doesn't have a star next to it. I clicked the link to send it to spynet for evaluation, but don't even know how they notify me, if they do. Does anyone know anything about this? experienced it? Here's the info:

 

URL Exec Hook

This is an unknown Shell Execute Hook.

 

Name: Microsoft Windows Shell Common Dll

Description: Windows Shell Common Dll

Publisher: Microsoft Corporation

File path: C:\WINDOWS\system32\shell32.dll

File version: 6.0.2900.2869

 

Technical Details:

CLSID: {AEB6717E-7E19-11d0-97EE-00C04FD91972}

Original file name: SHELL32.DLL

 

(oh, and this happened a couple of days before I cleaned and defragged the registry)

 

sonsie

[Humpty]

You can upload the file to the link below and have it scanned with about 20 different AV engines just to make sure it's OK.

 

Virus Total

[sonsie]

Well, the scanning service stopped in the middle of my upload, and rather than waiting, I remembered another similar service mentioned here: http://virusscan.jotti.org/

 

My file was clean, as I kind of thought it would be. Kind of weird though - in the report it said "OK (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)"

 

I'm not sure what that means. I know I've never scanned anything on that site.

 

Thanks again, Humpty. Now I know of 2 of those scanning sites.

 

Don't fall off your bike and break your Dumpty! vrrooom vrrroooom

 

sonsie

[Andavari]

I could have sworn shell32.dll for WinXP SP2 was updated just a couple of days ago via one of the Automatic Updates, however I don't know for sure because I didn't track the installations.

[JohnDemolition]

I could have sworn shell32.dll for WinXP SP2 was updated just a couple of days ago via one of the Automatic Updates, however I don't know for sure because I didn't track the installations.

 

i used M$ Update on tuesday and i could tell that it replaced my shell32.dll because the one i had was edited with Vista icons. now i guess i have to do it again

[sonsie]

Interesting - I typed in the AEB6717E-7E19-11d0-97EE-00C04FD91972 thingy into google. Yesterday I searched for info about it using different search terms so got different results.

 

Anyway, I didn't bother looking for long, but I found forums discussing this same number (CLSID number, I guess?) back in 2002 and 2005. Someone suggested that it may be a beta. But apparently it's harmless. I found one post that described exactly what I've experienced with it suddenly becoming an 'unknown'. Lots of responses to that post with similar problems.

 

sonsie