Re: HELP! DLL's being replaced and added without permission

From: Lars M. Hansen (badnews_at_hansenonline.net)
Date: 12/10/04


Date: Fri, 10 Dec 2004 06:59:19 -0500

On Thu, 09 Dec 2004 23:04:18 -0500, Hal spoketh

>
>First of all, I want to thank you for assistance, I did read your
>previous post, but I want to make a couple points clear.
>
>I download my email using Eudora Mail Reader, I do not use a browser
>for email. McAfee VirusScan E-mail Module scans all incoming mail.
>As soon as Eudora finished uploading my email I the got the Sygate
>warning.

Doesn't matter if you use a browser or not. Most larger applications
today uses DLLs and many uses the same DLLs. That's where a huge number
of system functions are stored, and there's little point in re-inventing
the wheel, so they use what's already there. My browser reference
earlier was merely meant as an example.

>
>Can you explain why the Binary dump in that warning contained all the
>header information from the emails I just received and stated the dll
>that was uploaded is mcscan32.dll

Because the DLL in question is the "program" that scanned the e-mail for
viruses.

>
>I know that this dll is used by McAfee, what Sygate is saying in its
>warning, is that the information displayed in the Binary dump is
>associated with that dll.
>
>The question is for what purpose, and how do I stop it. I do not like
>any program to gather information on my emails or computer use!

It isn't. It's scanning your e-mail for viruses.

>
>Secondly, I mentioned web sites that are also sending dll's. I have
>not recently upgraded any program on my computer but my computer now
>contains over 3000 dll's and growing every day.

Welcome to the club. I have 7561 DLLs on this workstation.

>
>Can you also explain why the number of dll's on my computer are
>increasing each day. I have turned off Auto-upgrades for windows and
>in any program that has a check box for that purpose.
>

DLLS should only be added to your system when you install something,
intentional or unintentional. Where does it all come from? Video codex,
toolbars for your browser, audio decoders, video drivers, audio drivers,
nic drivers, USB device drivers; virtually any new or enhanced feature
added to your browser, e-mail software, banking software, firewall,
anti-virus software or any other software or hardware that you may have
updated may come in the form of a DLL. Even if you have turned of some
updates (which is a BAD idea), there may still be other programs that
are updating in the background.

If you are noticing a significant increase in the number of DLLs on your
system on a daily basis, then I would be worried about you perhaps
having a trojan that lets other people put more crapware on your
computer. Check your system thoroughly with Spybot S&D and HiJackThis,
and

>If you can come up with a acceptable reason why I keep getting more
>and more dll's each day, other than they are being used for spying, I
>would be grateful.
>
>
>But my main reason for my original post is to stop anything from
>automatically installing onto my computer, be it dll's or anything
>else.
>

If you want to stop anything from being installed on your computer, then
disable these features in the programs. The biggest sinner in this
respect would be Internet Explorer, but that can be stopped by, first,
updating the browser, then configuring it in such a way that it won't
download any and all activeX component it finds...

Lars M. Hansen
http://www.hansenonline.net
(replace 'badnews' with 'news' in e-mail address)



Relevant Pages

  • Re: toolbar virus???
    ... Get ProcessExplorer from SysInternals, start you browser, and first Kill any ... dlls would have valid version Information. ...
    (borland.public.delphi.non-technical)
  • Newbie confusion?
    ... Occasionally I get errors displayed in the browser while visiting my ASP.NET ... Compiler Error Message: CS0433: The type 'RSWEBNET.InventoryGrid' exists in ... Anyway, there is a conflict between to DLLs, I guess. ... new DLL-hell on my behalf? ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Beschwert Euch mal!
    ... Um Flash zu deaktivieren muß ich die DLLs aus dem Plugin-Verzeichnis entfernen. ... Dann die DLLs raus und Browder wieder anfahren. ... Guck ich dann eine andere Seite, wieder erst Browser runter, DLLs wieder rein, Browser wieder hoch. ...
    (de.comp.os.os2.misc)
  • how to add refered dlls in usercontrol hosted in IE
    ... I am have an application which uses cotnrols and i want to expose it using ... browser in an asp.net application. ... load type etc and when i even look into loaded dlls i dont see other dlls. ...
    (microsoft.public.dotnet.framework.windowsforms.controls)
  • discontinued ATI PCI 128 All-In-Wonder-video card driver
    ... I can't seem to find the drivers for the discontinued ... site but the download doesn't work..I get this on screen ... Your browser did not send a referrer. ...
    (microsoft.public.windowsxp.basics)