Play/Pause key on keyboard launches "shell32.dll".

Quantum

Limp Gawd
Joined
Aug 15, 2004
Messages
215
EDIT: Bumping this post with some additional info - I've uploaded a screenshot of the contents of the right-click menu for DLL files. The left one is without the "Take Ownership" registry mod, and the right hand one is with the mod enabled. It seems the Play/Pause key triggers the boldface menu item. Without the Take Ownership mod, the Play/Pause key just tries to launch shell32.dll, i.e., it triggers "Open with...". If the Take Ownership mod is enabled, the Play/Pause key just launches that menu item instead and takes ownership of shel32.dll, i.e., triggering "Take Ownership" in the menu.


Capture_2.png

______________________________________

As you can see in the title, the Play/Pause media key on my notebook tries to launch "shell32.dll". This doesn't happen if there's a media player (foobar2k, XBMC, etc.) running in the taskbar (maximized/minimized/foreground/background). However, if there's no media player running at all or if it's running in the system tray only, the Play/Pause key will try to launch "shell32.dll". I started noticing this yesterday (I think) when a command prompt flashed by on the screen when pressing the key. I managed to take a screenshot to read the message where it said that (paraphrasing) "shell32.dll is now owned by user: MyWindowsUserName". I checked the file's security settings and noticed the permissions had changed (they're restored now) so I uninstalled the "Take ownership" shortcut that I have in the right-click context menu to prevent further changes in permissions. So, now I don't see the command prompt and permissions don't change, but I get a window asking me to choose with which program to run shell32.dll.

The same thing happens with my brother's (identical) notebook. Both computers are running "vanilla" clean-install Win 7, and my brother's install is barely a week old (upgraded to SSD).

I've been trying to backtrack but can't think of any changes I've made during the last couple of days.

The problem goes away when I uninstall Dritek LaunchManager (supplied by Acer) but breaks some of the keyboard functions. This program is not the cause of the problem (at least not directly) as I've been using it since 2010, and I've also tried updating today without result.

I've scanned the drives with MSE, Malwarebytes Anti-Malware, ESET Nod32 online scanner, Spybot S&D, but none of them find any virus/malware.


PS. Does anyone know a good keylogger type of program that can show me exactly what happens when I press the key?
 
Last edited:
those hotkeys are generally "programmed" by the software.
A lot of times it's nothing more than a glorified macro
So in this case, you need the Dritek software.
I would start by checking in the configuration.
 
The config file for LaunchManager hasn't changed. I've also tried to restore the default config file with no luck. Also tried uninstall and fresh install of newer version, still nothing. I don't think the fault lies in LaunchManager, it rather seems like something else is hijacking the input but I don't know how to find out what it is.
 
Back
Top