Monitored install of SpywareBlaster3

Discussion in 'SpywareBlaster & Other Forum' started by toad1771, Mar 30, 2004.

Thread Status:
Not open for further replies.
  1. toad1771

    toad1771 Registered Member

    Joined:
    Mar 30, 2004
    Posts:
    3
    I just uninstalled spywareblaster 2.6.1 and installed 3.0 and, of course, did so using a great freeware installation monitoring tool.

    I found that the following DLL was registered (XPHome):
    c:\windows\system32\msoeacct.dll which is a COM object to import/export MS Outlook Express accounts I believe.

    Why was this registered and should I be concerned about my OE accounts ?

    Toad
     
  2. LowWaterMark

    LowWaterMark Administrator

    Joined:
    Aug 10, 2002
    Posts:
    17,874
    Location:
    New England
    I also have that registered on my XP system... But, no at this point I'm not worried about it as it is a standard Microsoft DLL, but, we'll have to see exactly what it's function is from Javacool. Stand-by. ;)
     
  3. javacool

    javacool BrightFort Moderator

    Joined:
    Feb 10, 2002
    Posts:
    3,997
    Just an FYI, the SpywareBlaster setup doesn't contain that file.

    But I do find that file on all Windows XP systems I have access to, and it is indeed from Microsoft. In addition, I believe it actually comes with Windows XP:

    http://support.microsoft.com/?kbid=224141

    If it applies as far back as the document above states, MS probably distributes it by default with Windows XP.

    Why it was shown as being registered during the SpywareBlaster setup, I haven't a clue. Perhaps it was something else that was running that registered it? Maybe MSN Messenger or Windows Messenger? Or perhaps it is simply registered if you run Outlook/Outlook Express? (In any case, it is a standard Microsoft dll, and appears to be an important Windows component.)

    Best regards,

    -Javacool
     
  4. toad1771

    toad1771 Registered Member

    Joined:
    Mar 30, 2004
    Posts:
    3
    Thanks for the update. I wasn't using any other network program (including OE) at the time of the installation and monitoring it (which pretty much requires you don't do anything else). All I know is afterwards the monitoring tool shows me this Microsoft DLL was now registered and hadn't been before... No worries.

    Toad
     
  5. Vietnam Vet

    Vietnam Vet Registered Member

    Joined:
    Feb 9, 2002
    Posts:
    306
    Hi,

    Running 98SE here. I have this file also with a creation date of Monday, March 03, 2003 3:57:20 PM. It was part of the Outlook Express update Q330994.
     
  6. toad1771

    toad1771 Registered Member

    Joined:
    Mar 30, 2004
    Posts:
    3
    Ok, something funny is going on with Spywareblaster installation.

    version 3.0 installed the following GUID

    HKEY_CLASSES_ROOT\CLSID\{248FCFB3-5914-AF2C-CCBA-9BB5E3C749D5}
    whose default value is
    %SystemRoot%\System32\msoeacct.dll

    Ok, 3.1 installed the same GUID whose default value is
    C:\WINDOWS\System32\wstdecod.dll

    When I register this DLL myself it registers with GUID
    HKEY_CLASSES_ROOT\CLSID\{04E27F80-91E4-11D3-A184-00105AEF9F33}

    There is also a binary value called "qJsGqKb" installed under the CLSID above.

    Obviously, this is a completely bogus CLSID referencing a valid file to keep registry cleaners from detecting it as you can't have the same CLSID referencing two different files (both Microsoft according to the version info). Whaz up ?

    Toad
     
Thread Status:
Not open for further replies.