Srvany.exe

This file is from Microsoft and is simply used to allow
executables to run as services.
I would think Microsoft would has run a check against
their own reposistory of resource kit files.

Alan Sharp wrote:

> This file is from Microsoft and is simply used to allow
> executables to run as services.
> I would think Microsoft would has run a check against
> their own reposistory of resource kit files.

Alan,

Which version of Windows are you running ?


Steve Wechsler (akaMowGreen)
MVP Windows Server
AumHa VSOP

Windows 2000 SP4
>-----Original Message-----
>Alan Sharp wrote:
>
>> This file is from Microsoft and is simply used to allow
>> executables to run as services.
>> I would think Microsoft would has run a check against
>> their own reposistory of resource kit files.
>
>Alan,
>
>Which version of Windows are you running ?
>
>
>Steve Wechsler (akaMowGreen)
>MVP Windows Server
>AumHa VSOP
>.
>

Alan Sharp wrote:

> Windows 2000 SP4
>
>>-----Original Message-----
>>Alan Sharp wrote:
>>
>>
>>>This file is from Microsoft and is simply used to allow
>>>executables to run as services.
>>>I would think Microsoft would has run a check against
>>>their own reposistory of resource kit files.
>>
>>Alan,
>>
>>Which version of Windows are you running ?
>>
>>
>>Steve Wechsler (akaMowGreen)
>>MVP Windows Server
>>AumHa VSOP
>>.
>>

Alan,

Thanks for the info. Have been getting an education on Srvany.exe thanks
to your post. Agree that MSAS should be able to detect Srvany.exe as a
legitimate file but it does have potential to install malware using
phantom Services. Any suggestion to determine legit vs. illegit
intent ?

Steve Wechsler (akaMowGreen)
MVP Windows Server
AumHa VSOP

"Steve Wechsler [MVP]" <mowgreen@gmail.com> wrote in message
news:Oh5zePC%23EHA.1936@cpmsftngsa05.privatenews.microsoft.com...

> Thanks for the info. Have been getting an education on Srvany.exe thanks
> to your post. Agree that MSAS should be able to detect Srvany.exe as a
> legitimate file but it does have potential to install malware using
> phantom Services. Any suggestion to determine legit vs. illegit
> intent ?

I've seen this happen with lots of stuff. Famatech's Remote Administrator
(RAdmin) is a good example. If you put there (like me) and use it to
remotely control one or more machines, fine. But if someone snuck it on
there without your knowledge, it could be bad news.

Maybe we need a separate category for "Heads up! Did you know this was here?
It can be used to <fill in the blank>."

It is worth noting that:
1. I don't think MS-AS recommended removing some of the "false positives"
like the resource kit stuff.

2. If it really is your software, you can just re-install it and arrange for
it to be ignored.

3. Who turns one of these anti-whatever programs loose to blindly delete
whatever it doesn't like without backing it up? The default settings for a
"scheduled" i.e., unattended scan in MS-AS are to quarantine everything
found.

My $0.02 worth.
--
Jim
"Remember, an amateur built the Ark; professionals built the Titanic."