Unknown Internet Explorer Bar alerts: shell32.dll & browseui.dll

[Microsoft Spyware Beta NG Server]

On WinXP SP2 I have received MS AntiSpyware alerts for "An Unknown Internet
Explorer Bar Requires Approval" -- one listing shell32.dll and another
listing browsui.dll. Both of these are nominally from Microsoft.

What is going on here?

Why aren't these Microsoft DLLs known?

The alert for browseui.dll came when a new user logged on to the computer.
Are there issues with AntiSpyware and multiple users?

Thanks,

Joe

 

[Andre Da Costa]

by Ron Chamberlin - how possibly remove spyware and unwanted browser helper
objects in Windows, Internet Explorer with Microsoft AntiSpyware.
Boot into Safe Mode (F8) at Start Up;

Empty your temporary files AND your Temporary Internet Files C:\Documents

and Settings\Username\Local Settings\Temporary Internet Files folder ;

Run the scan while in safe mode;

If you are running SP2, open IE--->Tools--->Manage Add-ons, and uncheck any

BHO's that you don't recognize.

Multiple user account scanning is not supported in this beta 1 release, look
for this to be fixed by beta 2.

 

[JoeM]

Thanks Ron and/or Andre,

I did not see any reference to shell32.dll or browseui.dll in your
response. Did you mean to not address that part of the question? Or is that
a way of saying that the MSAS alert doesn't really mention the potentially
dangerous browser object?

Joe

 

[Andre Da Costa]

I skipped those two, so far I have not come across a straightforward answer
for those two. Bill Sanderson could probably answer it much better for you.
Although I do get rare notifications sometimes from Microsoft AntiSpyware is
updating browseui.dll

 

[Andre Da Costa]

Browseui.dll is a System file and is part of Microsoft's Internet Explorer.
You need to replace this file to c:\windows\system32\ to have your problem
solved. Please follow the following procedure, step by step, till you have
your file in place.

First do a `find' in your system to see if you can find the file in some
other location in your disk. Look for browseui.* If it is found at
C:\Windows\System32\dllcache, please copy it to c:\windows\system32\

This is the first preference, as Windows keeps the latest version files in
this dllcache folder.

Next, if you have installed SP2, you will find the file browseui.dl_ in the
i386 folder. Copy it to c:\windows\system32\ and rename it to browseui.dll.

If you are not able to find this file in your system, the next step is to
find it on the Web. One simple way is to apply the latest patch which will
update your IE to the latest and will also replace the missing file. You
will find the cumulative IE patch at http://www.microsoft.com/technet

/security/bulletin/ms05-014.mspx

In this page, please go to the "Affected Components" section and click the
link related to your OS and Service Pack. As there are separate links for XP
with SP1 and XP with SP2, please click on the correct link and download and
update your system with that patch. This ought to solve your problem.

For Shell32.dll

http://www.iamnotageek.com/a/Shell32.dll.php
--

Andre
http://spaces.msn.com/members/adacosta
FAQ for MS AntiSpy http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm

 

[Bill Sanderson]

Yes - there are issues with Microsoft antispyware and multiple users, and I
believe you are seeing one of them. Worth checking the executables in
question, but I think this is bug rather than malware.

The development team acknowledges these shortcomings in the beta as
distributed thus far. I would expect this to change--or at least have
explicitly described boundaries--by the time the product releases.