Windows Secrets Newsletter • Issue 89 • 2006-12-14 • Circulation: over 400,000

By Fred Langa There’s an easy way and a hard way to replace missing or corrupted DLLs. As you can probably guess, I’ll show you the fast and easy way! Then I’ll discuss a free "ultra-high security password generator," continue our coverage of AOL’s antivirus tool, and more.

How to fix an AWOL Shell.dll

Reader Rick Granlund has a problem that’s bad enough in itself, but which also could be a symptom of a deeper issue. Either way, it’s fixable:

• “I have a problem that may be common and yet the cure eludes me. When I attempt to install software in my XP Pro SP2 machine, I get the dialog box ‘Missing SHELL.DLL.’ How do I find and reinstall the SHELL.DLL with minimum disruption to my system?”
  

The fix is easy, Rick, but first — it’d be best if you could find out why Shell.dll disappeared.

For example, there’s a fairly common browser hijacker that can cause this problem. You didn’t mention any other symptoms, but the hijacker usually adds "Home Search Assistant," "Shopping Wizard," and "Search Extender" to your system, and may also reset your browser’s home page so that a popup appears at every start.

If malware such as this is working on your system, then it will do no good to repair Shell.dll because the malware will simply corrupt the new copy.

I suggest you begin by using your favorite antimalware tools to make sure your system is squeaky clean and free of all malware. Major test labs currently rate Webroot’s Spy Sweeper and PC Tools’ Spyware Doctor as the best antispyware products. For more information, see the Security Baseline page at WindowsSecrets.com.

If “Home Search Assistance” and its related friends are, in fact, causing your problem, the free AboutBuster utility can remove them.

Once you’re sure your system is clean, you can download a fresh copy of Shell.dll from any number of online sources. DLL-files.com, for example, has a good Shell.dll page. Copy the DLL file into your DLLcache folder (usually found at C:WindowsSystem32DLLcache). Then re-register the DLL this way:

Step 1. Click Start, Run.

Step 2. In the Run dialog box, enter (change C:Windows to the correct location on your system):

   regsvr32 C:WindowsSystem32DLLcacheShell.dll

Step 3. Click OK.

Step 4. Reboot, and your Shell.dll problems should be fixed!

By the way, the above steps can resolve a huge number of problems with other missing/corrupted DLLs. Just use the example above as a template, downloading whatever DLL you need and substituting its name in the regsvr32 command.

A free but high-powered password generator

You’re reading Windows Secrets, so it’s a good bet that you already know the importance of having good passwords. Or, to put it the other way around: You know that using a simple, easy-to-guess password is like leaving your spare house key under the doormat. It won’t fool anyone who wants in.

I’ve recently run across a couple of new (and free) online password services that you may find useful.

1. PassNerd. I can only give a limited thumbs up to PassNerd. Every time you load the PassNerd home page, the site generates a new password for you. You can select simple or complex passwords (complex is better) in lengths up to 64 characters (longer is better).

The site is easy to use and the passwords appear to be quite random, but other parts of the site give me pause. The Tips section, for example, recommends “alphabet math” and “keyboard transposition” as good ways to generate your own passwords.

Both these techniques are relatively low-security, because the common substitutions of numerals for letters are now built into modern cracking tools. They are emphatically not strong ways to produce passwords! (For more info, see “Looks Strong, But Don’t Be Fooled!” from the 2005-06-23 issue of the LangaList.)

2. Perfect Passwords. By contrast, I can give an unequivocal recommendation to Steve Gibson’s Perfect Passwords. You can see why as soon as you read the background information on that page.

In particular, Steve’s use of SSL encryption to deliver the generated passwords to you helps ensure that you and you alone will see the results, and that the results will be cache-resistant. (In fact, in most systems, the pages won’t be cached at all.)


Figure 1. Perfect Passwords is one of the very best online password generators I’ve found.

By default, Steve’s page produces passwords of 63 and 64 characters. If you need a longer password, you can splice several of the 63-character passwords together. If you want a shorter password, you can copy only the number of characters you need. (While you’re on the site, check out Steve’s list of  other free tools, too.)

If you don’t need extremely long passwords that would survive weeks of brute-force attack by a supercomputer, you might prefer to use a "passphrase" technique. This allows you to create easy-to-remember passwords that are strong and as short or as long as you wish. For details, see my InformationWeek article entitled "How To Build Better Passwords.”

More on AOL’s free Active Virus Shield

My Dec. 7 article discussed Active Virus Shield, a free program AOL is offering that’s based on the Kaspersky antivirus product. This generated quite a few questions from readers. For example, consider this from Bill Sawyer:

• “You warned of not trusting AOL. Although I agree, my question is this. If I already have an AOL/Aim Instant Messenger free account, wouldn’t you think I might as well use the free AOL antivirus program? I’m already registered with them for the Messenger and they’ve already ‘got my number,’ so to speak.”

I see your point, Bill. But the advertisers associated with Active Virus Shield may be different from those who market via AIM. Those, advertisers, in turn, may differ from those who sell their wares through AOL proper.

Each class of software attracts different users or is aimed at different interests among users. So each poduct is an opportunity for AOL to strike deals with different advertisers. Signing up for different AOL adware offerings may well get you on different and independent mailing lists and result in more spam — er, I mean, “opt-in e-mail communications from AOL’s marketing partners.”

But several other readers had an alternate suggestion that might help you sidestep the spam. C. D. Tavares writes:

• “Use a temporary address at Spambob.com. You can read whatever setup mail AOL sends you, activate your account, and then never have to look at that mailbox again."

Reader Eric Newman had a similar thought:

• “I read your column in the Windows Secrets newsletter about AOL Active Shield. But I think you need to hold your nose and not dismiss this one out of hand. Go to 10minutemail.com, get an e-mail address (for 10 minutes) to get the code, and install AOL Active Virus Shield."

I normally have ethical qualms about using temporary e-mail addresses for free software that requires a registration. That kind of software is offered for free in return for your e-mail address. That’s the implied contract, and using a temporary e-mail address is a kind of small lie. It’s a gray area, yes, but it makes me uncomfortable.

There are some password-workaround sites, such as BugMeNot.com, which I think are on the very darkest side of the gray area, and skirting very close to a form of fraud. Petty fraud, maybe, but fraud nonetheless.

There are cases where registration is optional, however, or — as with AOL Active Virus Shield —  when the publisher explicitly states that you don’t have to accept its mailings in order to use the software. If so, using a temporary e-mail address harms no one and is just another way of making sure you’re opting out of any mailings. I see no ethical issues at all with that use of a disposable e-mail address.

For lots more information, see Brian Livingston’s articles, “Get a disposable e-mail address” and “More ways to use disposable addresses” from the Mar. 30 and Apr. 13 issues of the Windows Secrets Newsletter.

Wait for the green light before powering on

Reader Michael Thomas offers this nice tip about powering a PC all the way off:

• “In the Nov. 30, newsletter, Fred Langa talked about turning the PC off using the power switch in the back to ensure that the computer is fully powered off. This is definitely true, and serial ports are particularly susceptible to getting into a bad state requiring a complete power-down.
  
  “One important note on this: Some motherboards continue supplying power to the bus for a few seconds after the PC is turned off or unplugged. (I don’t know why this is, but I assume there are some capacitors that need time to discharge.) So turning the power off and then on again too quickly will prevent the PC from actually powering down. It will be no different than if you just powered off from the front power switch.
  
  “To be sure the PC has completely powered down, wait at least 10 seconds before turning it back on. If you’re too impatient for that, watch the Ethernet port. As soon as the light on the Ethernet port turns off, the PC is truly powered off.”
  

You’re right, Michael. Many newer systems also have an LED mounted right on the motherboard so you can see when the residual power has dissipated after a total shutdown. Thus you know when it’s safe to start working inside the case or on the motherboard. This LED likewise goes out after a typical delay of 5-10 seconds or so.

You may be able to see the motherboard LED in some PCs that have side vents. In others, Michael’s trick of watching the Ethernet port’s “link” or “ready” light wink out is an excellent idea.

Fred Langa is editor of Windows Secrets & LangaList. He edited the LangaList e-mail newsletter from 1997 to 2006, when it merged with Windows Secrets. Prior to that, he was editor of Byte Magazine and editorial director of CMP Media, overseeing Windows Magazine and others.