Monitored install of SpywareBlaster3

I just uninstalled spywareblaster 2.6.1 and installed 3.0 and, of course, did so using a great freeware installation monitoring tool.

I found that the following DLL was registered (XPHome):
c:\windows\system32\msoeacct.dll which is a COM object to import/export MS Outlook Express accounts I believe.

Why was this registered and should I be concerned about my OE accounts ?

Toad

 

Just an FYI, the SpywareBlaster setup doesn't contain that file.

But I do find that file on all Windows XP systems I have access to, and it is indeed from Microsoft. In addition, I believe it actually comes with Windows XP:

http://support.microsoft.com/?kbid=224141

If it applies as far back as the document above states, MS probably distributes it by default with Windows XP.

Why it was shown as being registered during the SpywareBlaster setup, I haven't a clue. Perhaps it was something else that was running that registered it? Maybe MSN Messenger or Windows Messenger? Or perhaps it is simply registered if you run Outlook/Outlook Express? (In any case, it is a standard Microsoft dll, and appears to be an important Windows component.)

Best regards,

-Javacool

 

Thanks for the update. I wasn't using any other network program (including OE) at the time of the installation and monitoring it (which pretty much requires you don't do anything else). All I know is afterwards the monitoring tool shows me this Microsoft DLL was now registered and hadn't been before... No worries.

Toad

 

Hi,

Running 98SE here. I have this file also with a creation date of Monday, March 03, 2003 3:57:20 PM. It was part of the Outlook Express update Q330994.

 

Ok, something funny is going on with Spywareblaster installation.

version 3.0 installed the following GUID

HKEY_CLASSES_ROOT\CLSID\{248FCFB3-5914-AF2C-CCBA-9BB5E3C749D5}
whose default value is
%SystemRoot%\System32\msoeacct.dll

Ok, 3.1 installed the same GUID whose default value is
C:\WINDOWS\System32\wstdecod.dll

When I register this DLL myself it registers with GUID
HKEY_CLASSES_ROOT\CLSID\{04E27F80-91E4-11D3-A184-00105AEF9F33}

There is also a binary value called "qJsGqKb" installed under the CLSID above.

Obviously, this is a completely bogus CLSID referencing a valid file to keep registry cleaners from detecting it as you can't have the same CLSID referencing two different files (both Microsoft according to the version info). Whaz up ?

Toad