Hello all, could somebody please tell me what this is? I get a D+ alert for it at random moments, but usualy when waking my laptop up from sleep or hibernation, I keep submitting it to comodo for analysis but its not done anything so far, I always allow it. I have attached a screenshot, than you 
[attachment deleted by admin]
Shell32.dll is the principle file used by Microsoft for UI elements, such as icons, animations etc. It’s quite often modified using tools like Resource Hacker to replace the default system icons.
Which version of CIS are you using?
Hello, I dont remember ever knowingly modified this file, A program might have and it might have slipped my memory but the program version is 5.5.195786.1383
Sorry, I wasn’t implying you had modified the file, just pointing out that some do, for theming purposes. Can you remember what you were doing when you received the alert?
Thats quite alright, I know you werent implying that, but the first time I got the alert? i cant really remember but I usualy get it when the computer either wakes up from sleep or from hibernation thats really the only time I ever receive the alert.
Thanks for that. I’ve never seen this alert, but I don’t believe it’s anything to worry about. I’ll run some tests and see if I can recreate.
Alright thank you I mean ive not really been worried because i know it to be a real file and not malware but you can understand where it can get annoying getting the popup.
FWIW I get the popup too and at “return from hibernation” like you. I thought I’d tried everything, but in preparing this post it occurred to me that shell32.dll might appear in two places on my x64 W7 PC and it does.
So I’ve Added shell32.dll to D+ rules/Security Policy as Installer or Updater from two locations: windows\system32 and windows\syswow64
I’ve been thinking though in my case that it might have something to do with an add-on I’m running called ShellFolderFix (v1.1.4 from Georg Fischer). Are you running that by chance Justin21?
I do still get this pop-up occasionally and though I’m not running ShellFolderFix, I’ve replaced that with WindowManager.
Hard to figure this one, as it does not occur on every (or even Many) of my returns-from-Hibernation.
I have the same problem but mine pops up when ever I open anything in the Control panel =/
I have tried putting it as trusted, changed the policies and also did the same for the SYSWOW64 one.
Any help?