netyv32.exe

Can anyone help me with an irritating problem?

I use an accounts program (Money Manager), which
needs 'shell.dll' to be in the W/System32 folder (as well
as in W/System, where I think it usually lives.

Every time I exit the program, load another, or reboot,
shell.dll disappears from W/System32. Norton Protected
Recycle Bin tells me it is being deleted by a program
called 'netyv32'. I have found this in the Windows
directory, but even though I have tried renaming it
('xnetyv32x'), it still manages to reported as
deleting 'shell.dll'.

Is there a way round this?

Thanks

Peter

Peter,

The way round this problem is to establish the origin of the file netyv32.exe
and its purpose since it is not part of the Win Me operating system. I can
find no details on the net of a file with that name. What do the properties
(Right click, Properties, Version) and its creation date tell you about its
possible source?

I feel your best step would be to carry out normal triage procedures and treat
this as a suspect file until you know otherwise.

Check your system using your preferred antivirus application making sure first
that you are using an updated current set of viral reference signatures.

Try booting to Safe Mode and emptying both your Windows\Temp folder and also
your Temporary Internet Files (Control Panel | Internet Options | General |
Delete Files and make sure you check the box "Delete all offline content").
Next open MSConfig, (Start | Run, type MSConfig in the box and click OK), open
the Startup tab and look for an uncheck any rogue entries. See if you can now
delete netyv32.exe.

Boot back into Normal Mode.

This would be a good time to download yourself a copy of the free Ad-Aware 6.0
from Lavasoft (http://www.lavasoftusa.com/software/adaware/) and also SpyBot
Search & Destroy (http://www.safer-networking.org/) and use them to check your
system for other commercial parasites remembering that they are only as good
as when you last updated their reference files. I also use a program called
BHODemon (http://www.definitivesolutions.com/bhodemon.htm that checks for
unwanted Browser Help Objects and SpywareBlaster
(http://www.wilderssecurity.net/spywareblaster.html) which can help prevent
some parasites getting a grip on your PC.

Then there is CWShredder
(http://www.zerosrealm.com/downloads/CWShredder.zip or
http://www.spywareinfo.com/~merijn/files/cwshredder.zip) which is the best way
of getting rid of the many forms of the CoolWebSearch hijacker details of
which can be found at http://www.spywareinfo.com/~merijn/cwschronicles.html
and also http://www.pestpatrol.com/pestinfo/c/cws.asp..

Finally if you still continue to experience problems download a copy of
HijackThis from (http://www.spywareinfo.com/~merijn/downloads.html). Create a
folder called hijackthis on C: and copy the file you downloaded to that
folder. Close as many applications as you can including all instances of
Internet Explorer and then run hijackthis.exe and post back the log, provided
that it isn't too long, to this thread, otherwise to the HijackThis Forum at
http://www.spywareinfo.com/forums/ and hopefully this will enable someone to
identify the cause of your problem.
--?
Mike Maltby MS-MVP



Peter wrote:

Can anyone help me with an irritating problem?

I use an accounts program (Money Manager), which
needs 'shell.dll' to be in the W/System32 folder (as well
as in W/System, where I think it usually lives.

Every time I exit the program, load another, or reboot,
shell.dll disappears from W/System32. Norton Protected
Recycle Bin tells me it is being deleted by a program
called 'netyv32'. I have found this in the Windows
directory, but even though I have tried renaming it
('xnetyv32x'), it still manages to reported as
deleting 'shell.dll'.

Is there a way round this?

Thanks

Peter

Mike, thanks very much for all that. I'll pursue it and=20
keep you posted. However, just to say I had already=20
swept with Norton (very up to date) and with a program=20
called Spyhunter, with negative results.

Peter


-----Original Message-----
Peter,

The way round this problem is to establish the origin of=20
the file netyv32.exe=20
and its purpose since it is not part of the Win Me=20
operating system. I can=20
find no details on the net of a file with that name. =20
What do the properties=20
(Right click, Properties, Version) and its creation date=20
tell you about its=20
possible source?

I feel your best step would be to carry out normal=20
triage procedures and treat=20
this as a suspect file until you know otherwise.

Check your system using your preferred antivirus=20
application making sure first
that you are using an updated current set of viral=20
reference signatures.

Try booting to Safe Mode and emptying both your=20
Windows\Temp folder and also
your Temporary Internet Files (Control Panel | Internet=20
Options | General |
Delete Files and make sure you check the box "Delete all=20
offline content").
Next open MSConfig, (Start | Run, type MSConfig in the=20
box and click OK), open
the Startup tab and look for an uncheck any rogue=20
entries. See if you can now=20
delete netyv32.exe.

Boot back into Normal Mode.

This would be a good time to download yourself a copy of=20
the free Ad-Aware 6.0
from Lavasoft=20
(http://www.lavasoftusa.com/software/adaware/) and also=20
SpyBot
Search & Destroy (http://www.safer-networking.org/) and=20
use them to check your
system for other commercial parasites remembering that=20
they are only as good
as when you last updated their reference files. I also=20
use a program called
BHODemon=20
(http://www.definitivesolutions.com/bhodemon.htm that=20
checks for
unwanted Browser Help Objects and SpywareBlaster
(http://www.wilderssecurity.net/spywareblaster.html)=20
which can help prevent
some parasites getting a grip on your PC.

Then there is CWShredder
(http://www.zerosrealm.com/downloads/CWShredder.zip or
http://www.spywareinfo.com/~merijn/files/cwshredder.zip)=20
which is the best way
of getting rid of the many forms of the CoolWebSearch=20
hijacker details of
which can be found at=20
http://www.spywareinfo.com/~merijn/cwschronicles.html
and also http://www.pestpatrol.com/pestinfo/c/cws.asp..

Finally if you still continue to experience problems=20
download a copy of
HijackThis from=20
(http://www.spywareinfo.com/~merijn/downloads.html). =20
Create a
folder called hijackthis on C: and copy the file you=20
downloaded to that
folder. Close as many applications as you can including=20
all instances of
Internet Explorer and then run hijackthis.exe and post=20
back the log, provided
that it isn't too long, to this thread, otherwise to the=20
HijackThis Forum at
http://www.spywareinfo.com/forums/ and hopefully this=20
will enable someone to
identify the cause of your problem.
--=81
Mike Maltby MS-MVP



Peter wrote:

Can anyone help me with an irritating problem?

I use an accounts program (Money Manager), which
needs 'shell.dll' to be in the W/System32 folder (as=20
well
as in W/System, where I think it usually lives.

Every time I exit the program, load another, or reboot,
shell.dll disappears from W/System32. Norton Protected
Recycle Bin tells me it is being deleted by a program
called 'netyv32'. I have found this in the Windows
directory, but even though I have tried renaming it
('xnetyv32x'), it still manages to reported as
deleting 'shell.dll'.

Is there a way round this?

Thanks

Peter=20

.

Peter,

Remember though that Norton is designed to hunt out viruses and not commercial
parasites. You may have used Spyhunter but would strongly suggest that you
also follow through with the other free tools that I mentioned as what one
misses another may catch. Having said that it is still possible that
netyv32.exe is a genuine program that you have installed, as I mentioned its
Properties sheet should help you there.

I should perhaps also mention that SpyHunter is not well regarded by those who
specialise in hunting down commercial parasites

Regards,
--
Mike Maltby MS-MVP



Peter wrote:

Mike, thanks very much for all that. I'll pursue it and
keep you posted. However, just to say I had already
swept with Norton (very up to date) and with a program
called Spyhunter, with negative results.