msole.dll - legit file or virus?

[slim_lim]

Anybody else have this file in their Windows\System directory? It is marked hidden + system, but has no vendor information like most MS files do. It is loaded when IE is started.
.

[diggingforgold]

It's a Microsoft Outlook Express .dynamic link library.

It's not included in my installation of WinXP Pro. What OS are you running? And what versions of IE/OLE do you have.

[Andyman902042]

Are you sure it's not MSOE.dll (without an L)

l didn't get many results for msole.dll (http://www.google.com/search?hl=en&lr=&ie=UTF-8&oe=UTF-8&q=msole.dll&btnG=Search), but I got alot for mose.dll (http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=msoe.dll&spell=1).

[slim_lim]

That's just the thing -- it is NOT msoe.dll (MS Outlook Library). It is msole.dll. In the Registry it is registered as "Windows OleServer" and as one of the Browser Helper objects.
It appeared in my Windows/System afeter upgrading from IE 5.5 to IE 6.0 from Microsoft Windows Update and applying a bunch of security patches. The reason I updated is that over the past 3 days I experienced a number of attacks whereby arbitrary adware/trojan files were downloaded and executed on my computer just by visiting a website! -- even though my security settings were set to prevent any kind of automatic installation. Obvioisly, there is some big hole in IE 5.5, so I had to upgrade to 6.0.
In light of the recent attacks, I'm suspicious about a hidden system file with no vendor info that I cannot find anything about on Google running on my system. Another thing: I downloaded the Google Toolbar, and IE started crashing on exit. I then unregistered msole.dll, removed it from the Browser Helper Objects registry entry, and moved the file to a temporary directory. Now it is not loaded with IE and it doesn't crash with Google Toolabr anymore. No adverse effects so far.
So, I'm curious: anybody else have this file? I'm almost inclined to believe it is a trojan, except I'm 99% sure it came from Windows Update. I'm running Win 98, btw.

[Andyman902042]

Well, it looks like you did the right thing. It does seem very suspicious. Maybe it got installed when you got the trojans. You can download Resource Hacker (http://www.users.on.net/johnson/resourcehacker/) and see what kind off stuff the file contains.

[Sophisticated]

did you download any windows updates if so its intergated with a file off the windows update name .NET or something

[slim_lim]

OK, I figured out what it is! It's definitely a trojan -- one of the hijacks before the update replaced my wmplayer.exe with an infected execuatabe. When I run it, it creates msole.dll and registers it to run when IE starts.
This is definitely something new -- niether Adaware nor Spybot can detect it. I cleaned both files out, but now I'm scared that there are other nasties running that I haven't found yet. :eek:

[slim_lim]

Ok, I think I know what it was exactly now:

In fact, I remember cleaning out pup.exe and some other file with Adaware, but strangely it failed to get wmplayer.exe and msole.dll.

[batharoy]

GOOD JOB on tracking this down slim.:clap:

And thanks for the usefull links.

:beer: :beer: :beer: