IRP Hook Rootkit help [Solved]

but it still came up on restart!

What is "it"?

The notepad page with this on: [.ShellClassInfo] LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787 It only comes up once instead of twice and the icon has gone from the desktop.

Please go to the following folders and see if there is a Desktop.ini in any of them…

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
C:\Documents and Settings\All Users\Start Menu\Programs
C:\Documents and Settings\All Users\Start Menu

If there is a Desktop.ini in any of them, open it and see if it contains the following lines:

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787

If the lines are there, right-click on the file and select Delete and then accept any prompts.

Restart your system and let me know if you still receive the same message.

The one in C:\Documents and Settings\All Users\Start Menu says: [.ShellClassInfo] LocalizedResourceName=@shell32.dll,-21786 [LocalizedFileNames] Windows Catalog.lnk=@%SystemRoot%\system32\shell32.dll,-22075 Activate Windows.lnk=@%SystemRoot%\system32\oobe\msoobe.exe,-2000 Set Program Access and Defaults.lnk=@xpsp1res.dll,-10077 and the one in C:\Documents and Settings\All Users\Start Menu\Programs says: [.ShellClassInfo] LocalizedResourceName=@shell32.dll,-21782 There wasn't one in C:\Documents and Settings\All Users\Start Menu\Programs\Startup, only a Microsoft Office 2000 shortcut. Not sure which if any to delete. Please advise!

Hi, Ok that is not what I was expecting. Unfortunately we are starting to move outside of my area of knowledge. With this problem you might try to post a new topic in the Windows forum here and let the techs there help you out. If it has been sometime since you have actually formatted your system and put a fresh copy of Windows on your computer this might be a time to give it a go. Sometimes Windows just gets sloppy and needs to be made new. If you start a new topic, be sure to let them know your latest set of problems as well as posting a link to the topic here so that they can see what it is we have done.

Hmm, I have done a post on the Windows forum and have had a couple of replies but they don't seem to be reading the problems and the suggestions aren't very helpful so far. I will persevere! I also found suggestions on another site about using CHKDSK and the recovery console. Sounds like that might repair the files that have gone wrong? We haven't tried that before. Scannow hasn't worked at all.

First open a command prompt > Click Start > Run > and type cmd and press Enter.
This will open the command prompt.

Copy the contents of the code box > right click in the command window and select paste >> Press Enter

chkdsk /r

Follow any prompts and let the scan run

Once complete, let me know how your system is running.

No change. Still the same as before and notepad screen still pops up at the end of startup

Hi,

Ok…let's run chkdsk a little bit differently this time.

This time use the following and let it run…

chkdsk /f

Okay, now I've really messed up! I tried to do a repair reinstallation from the CD and it started out ok but then wouldn't copy some of the files. I used the fix from here http://www.daniweb.com/hardware-and-softwa…ling-windows-xp and it seemed to work. The installation finally completed but when I got onto my desktop there were problems like "the procedure entry point DecodePointer could not be located in the dynamic link library KERNEL32.dll" and nothing would work properly. Aaagh! I am trying to run the repair installation once more from the beginning to see if the files will copy properly this time. I hope it's not irreversible screw up

I am not sure what it is you might have done. Did you not run the last set of instructions that I provided? I think your best bet now would be to go ahead and save whatever files, pictures, music and anything else you would like to keep and just reinstall your system. Even if you only have an XP disk with SP1 on it that is fine. You will just have to download and install all the new updates which may take some time but a lot easier than trying to recover whatever it is that you have proceeded with.

Still here?

I haven't touched the computer since this happened. I am waiting for a friend to help me do a clean install as I'm not confident that I can do it.

Ok thanks for letting me know. I think that might be the best course of action. If you like you can post a topic in the Windows forum and they can help you through that as well.

I seem to be back online! I was able to download XP service pack 3 from another source on usb and load it on and it seems to have fixed a bunch! I haven't lost anything it seems. I am just updating and there are 113 updates to download!! I haven't checked everything yet, but it seems the one obvious problem I still have is the notepad page coming up on start up. Don't know what to do about that. It's nice to have the use of the computer again