shell32.dll

[BonePilot]

Hello,
I'm a newb to this site, looking for a little help.
My AVG virus scanner found shell32.dll to be "changed."
Is this something that a certain virus does?
I tried to use KillBox to kill and delete the shell32.dll on shutdown and install the one off the CD on reboot. Not sure if it worked, since AVG flagged it again as being "changed."

Any help would be greatly appreciated!

Thanks,
BonePilot

EDIT: Oops! Running Win XP Media Center edition, with SP2.

[jholland1964]

The most normal reason for shell32.dll to be changed is you installed a recent MS HotFix.. shell32.dll is a library which contains Windows Shell API functions, which are used when opening web pages and files.

Killbox should NEVER EVER be used unless directed by a helper on a forum such as this one. It is a LAST RESORT or last step operation to rid the computer of usually the remainders of viruses or trojans.

I hate to say it but you could have done some irreparable damage by using killbox before knowing what you were removing.

Your AVG is now again showing the shell32.dll is changed because you put the original copy back on the computer while the probable cause of the first change was the install of a hotfix for the file which changed it in the first place, so yes it is changed.

[BonePilot]

Thanks!
And I understand that KillBox is a dire measure. I was just making sure that some virus didn't re-write the shell32.dll for some nefarious purpose.
I'm a newb to this site, not necessarily to tinkering with Bill Gates' sorry products!

Again, many thanks.

[jholland1964]

What you should have done is do more research before taking this drastic measure. You also should have followed the instructions given on this link READ ME Before Posting A Request For Assistance!
and done those scans and a couple of the online scans to be certain that this was NOT a virus AND clean up the computer in the process. It is never a recommendation to take these types of drastic steps before ruling out everything else. Many times files will be changed because of a hotfix or some sort of update, this would be considered normal in most cases. Certainly there are instances where a virus or some sort of "invader" can change vital files BUT in those cases the user normally would notice OTHER symptoms of infection also.