Seeing msohev.dll tagged as adware agent. Allowing it's removal breaks Office. Here's what we're running/seeing:

Ad-Aware SE Build 1.06r1
Defs: SE1R181 16.07.2007

From the log file:

#:37 [excel.exe]
ModuleName: C:\Program Files\Microsoft Office\Office\EXCEL.EXE
Command Line: "C:\Program Files\Microsoft Office\Office\EXCEL.EXE"
Process ID: 2252
ThreadCreationTime: 7-19-2007 5:10:51PM
BasePriority: Normal

Adware.Agent Object Recognized!
Type: Process
Data: msohev.dll
TAC Rating: 5
Category: Adware
Comment: main_uninstaller.exe.dmp
Object: C:\Program Files\Microsoft Office\Office

Warning! Adware.Agent Object found in memory(C:\Program Files\Microsoft Office\Office\msohev.dll)

Warning! "C:\Program Files\Microsoft Office\Office\EXCEL.EXE"Process could not be terminated!

Hi SDCS,

Thanks for your report. I'm beginning my investigation on this now, but it would be really helpful if you could update Ad-Aware with the latest definition file (I see you're using one from a few weeks ago) and run a scan, then upload the contents of the entire scan with your post. Also, which version of Office are you using?

Thanks for your input!

Regards,

Andy
Lavasoft Research

Hi SDCS,

So far I've been unable to reproduce the same result you experienced - the test was carried out with various versions of Office from Office 2000 onwards using the latest definition file SE1R184 31.07.2007. Each scan result came up clean every time.

Because I haven't been able to reproduce the problem, it would be useful to check the detected file out. If you could zip the file up and send it to me via a PM, I can run some tests to verify its legitimacy. Thanks!

Regards,

Andy
Lavasoft Research

EDIT: to confirm, the versions of msohev.dll that I've looked at are:

9.0.0.3508 - Microsoft Office 2000 component (94,257 bytes)
10.0.2609.0 - Microsoft Office XP component (79,264 bytes)
11.0.5510.0 - Microsoft Office 2003 component (67,128 bytes)
12.0.4518.1014 - 2007 Microsoft Office component (76,088 bytes)

Hi SDCS,

I've checked out the signature database - if you update Ad-Aware with the latest definition file, this detection will not occur. Thanks for bringing this to our attention!

Regards,

Andy
Lavasoft Research

Hi Andy,

Sorry for the delays in getting back to you. Some of our machines are not at this physical location, so it's sometimes a little tough to get info.

We are using Windows 2000 Professional SP4 with Office 2000.

From your last post, sounds like you found something that has been corrected in today's definition file.

I will get a chance to test with the new definitions, tomorrow, and will post results. Thanks for looking in to this!

SDCS

Hello, SDCS

Has this now resolved the original issues reported? If so, I like to go ahead and wrap up this thread

Since there have been no replies to this topic since I last posted, we'll assume this issue is now resolved.

I'll go ahead and archive this topic in the "Resolved" section (read only)

If you should have any further issues, please feel free to post a new topic.