Recently I ran Microsoft's Anti-Spyware suite, and it
detected a toolbar spyware program from Claria on a friends
computer (Win XP Home SP2 w/ all current patches).

Having no problems with this program in the past, I had it
delete said program, and while watching it delete files
related to the toolbar, it deleted shell32.dll
(C:\windows\system32\shell32.dll and
C:\windows\system32\dllcache\shell32.dll). Thankfully I
was able to repair the damage through recovery console, but
I was shocked that the program deleted a critical system
file without even so much as a prompt about it, and worse
yet that it considered these files to be a part of such a
common spyware suite, although I must applaud how the
program deleted the file in both locations. It does it's
job well, even on system files.

I understand that this program is still in beta, and this
is the price to be paid for using any beta software,
however I feel it is an issue that someone at Mircosoft
should address.

Thank you for your time, please keep developing quality
products.

~Liz

From Mikolaj:
You can try this
http://www3.ca.com/securityadvisor/p...x?id=453094083

Shell32.dll
http://www.iamnotageek.com/a/Shell32.dll.php
--

Andre
http://spaces.msn.com/members/adacosta
FAQ for MS AntiSpy http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm

"Liz" <(E-Mail Removed)> wrote in message
news:009201c54447$5aa44910$(E-Mail Removed)...
> Recently I ran Microsoft's Anti-Spyware suite, and it
> detected a toolbar spyware program from Claria on a friends
> computer (Win XP Home SP2 w/ all current patches).
>
> Having no problems with this program in the past, I had it
> delete said program, and while watching it delete files
> related to the toolbar, it deleted shell32.dll
> (C:\windows\system32\shell32.dll and
> C:\windows\system32\dllcache\shell32.dll). Thankfully I
> was able to repair the damage through recovery console, but
> I was shocked that the program deleted a critical system
> file without even so much as a prompt about it, and worse
> yet that it considered these files to be a part of such a
> common spyware suite, although I must applaud how the
> program deleted the file in both locations. It does it's
> job well, even on system files.
>
> I understand that this program is still in beta, and this
> is the price to be paid for using any beta software,
> however I feel it is an issue that someone at Mircosoft
> should address.
>
> Thank you for your time, please keep developing quality
> products.
>
> ~Liz

That's nasty--glad you were there to help recover.

Thanks for the clear report--I hope this will be enough for them to find
what happened in this case.

--
FAQ for Microsoft Antispyware:
http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm

"Liz" <(E-Mail Removed)> wrote in message
news:009201c54447$5aa44910$(E-Mail Removed)...
> Recently I ran Microsoft's Anti-Spyware suite, and it
> detected a toolbar spyware program from Claria on a friends
> computer (Win XP Home SP2 w/ all current patches).
>
> Having no problems with this program in the past, I had it
> delete said program, and while watching it delete files
> related to the toolbar, it deleted shell32.dll
> (C:\windows\system32\shell32.dll and
> C:\windows\system32\dllcache\shell32.dll). Thankfully I
> was able to repair the damage through recovery console, but
> I was shocked that the program deleted a critical system
> file without even so much as a prompt about it, and worse
> yet that it considered these files to be a part of such a
> common spyware suite, although I must applaud how the
> program deleted the file in both locations. It does it's
> job well, even on system files.
>
> I understand that this program is still in beta, and this
> is the price to be paid for using any beta software,
> however I feel it is an issue that someone at Mircosoft
> should address.
>
> Thank you for your time, please keep developing quality
> products.
>
> ~Liz