PDA

View Full Version : BHO: what is licwmi32.dll ?



zoe01
2006-03-11, 17:31
Hi, today I have found this file in my BHO list:
C:\WINDOWS\system32\licwmi32.dll (18 kilobyte)
I usually keep my pc clean using ad-aware and verify after each installation using bhodemon, and until now i have never been infected with spyware/adware.
I searched for "licwmi32.dll" on google, but no results were found; i don't know what it is - even a hex dump of this file just shows a few api calls.
I was wondering if this file could have been installed by Microsoft's Windows Update website, since I have visited it a few hours ago and it installed its "authenticity verification" tool.
Thanks.

tashi
2006-03-12, 18:47
Hello zoe01. :)

May we see a log please.


Open SpyBot, check for and get any updates available.
Close all browsers, check for problems and fix everything found in red
Then on the toolbar menu select mode and switch to advanced mode, on the left lower down select tools, and view report, ensure all the options are selected near the bottom except

Uncheck[ ] do not report disabled or known legitimate Items.
uncheck[ ] Include a list of services in report.
Uncheck[ ] Include uninstall list in report.

Now select (near the top) view report.
Press export in the save in box choose a place such as your my documents folder, then in your next post near the bottom select the "browse" button; navigate to and attach or post that report.

Cheers.

zoe01
2006-03-12, 21:18
May we see a log please.

Sorry, I forgot to post the log - here is it.
Thanks.

(note: I had already checked my system with Spybot about an hour ago and i only had to fix a few cookies - my HD is 80 GB so I did not perform another scan for this report; also, my system is in Italian language, so the report is in this language too)

raj118
2006-03-13, 00:43
If you just Google "licwmi" it will lead you to some sites that say that "licwmi" is part of the Windows Product Activation Configuration.
I don't know much about computers, but that is what I found.

tashi
2006-03-13, 02:36
zoe01 I have asked Lonny to take a look at your log.

While licwmi is legitimate, licwmi32 raised my antenna. :)

LonnyRJones
2006-03-13, 02:51
zoe01

Please go here and follow instructions.
http://forums.spybot.info/showthread.php?t=288
Start a new topic in our malware section please, post a hijackthis log there.
Someone will then take a look at the system and advise you.

zoe01
2006-03-13, 08:02
I'm sorry, I though I had posted this in the "general malware" section! :scratch: Could some of the Admins please move this thread there?
Thanks

tashi
2006-03-13, 17:11
Hello.

In order to post in the malware forum you need to follow the instructions in the link Lonny provided.

If I move this topic to malware removal it may be over looked by helpers because you have several posts in the thread. They will think you are already being assisted.

So do this:

Go here and follow instructions.
Before you post a log, and who will advise you. (http://forums.spybot.info/showthread.php?t=288)

Start a topic here:
Malware Forum (http://forums.spybot.info/forumdisplay.php?f=22[/url)

Someone will then take a look at the system and advise you as soon as available to do so.

Thank you. :)