I Dare You******TRY to uninstall Giant

[mark]

gcasServ is a virus because even if you TRY to uninstall MS
antispyware this process keeps running.

I quote André "
No, it is one of processes that allows Microsoft
AntiSpyware to run."

Andre,
what part of "I tried to uninstall it" don't you understand?
I uninstalled through control panel, deleted REG keys,
deleted the file
and STILL the process re-creates itself including REG
keys!!!!!!!!!!
try it yourself.

MS antispyware
uninstall, delete, wipe, delete REG keys

it recreates itself AND REG keys!!!!!!!

it runs again, slowing the system to a crawl


BY DEFINITION:

any program that re-creates itself and runs despite
attempts to uninstall or delete it is......................

A VIRUS!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

MS Giant antispyware is a VIRUS, so is BETA!!! I don't want
it on my system

There is a hidden programing portion that makes this
program rise from the dead no matter how many times or ways
you try to remove it from your system

VIRUS VIRUS VIRUS VIRUS VIRUS VIRUS VIRUS VIRUS VIRUS VIRUS
VIRUS VIRUS VIRUS VIRUS VIRUS VIRUS VIRUS VIRUS VIRUS VIRUS
VIRUS VIRUS VIRUS VIRUS VIRUS VIRUS VIRUS VIRUS VIRUS

 

[JohnF.]

Been there done that.

How about you stop spamming the NGs and give us some details so we can
help you - we've help people with a lot worse problems.

Give your:

OS verison
Patches installed
Other security software
History of malware infections

Steps taken in the uninstallation process thus far.

 

[mark]

XP
current in ALL Updates
Spysweeper catches the attempt to RE-animate
Been running anti spy AND Virus since install
Did a test, formatted, re-installed OS
looked in Task MAN for gcas------not found
Loaded MS anti-beta
ran, restarted 3 times
Task MAN shows gcasServ running
uninstalled MS antispy through Control panel
Reboot, checked TASK MAN and Hello....
gcasServ is running.
you saw what I tried, gcasServ won't die!

Oh BTW John...I am

A+; Network+; MCP98; NetWare 4.11, 5, 5.1 Certified

What were you going to tell me to try that I havent done?

Win 95 was a virus...it sought out Netscape products and
killed 'em

BTW Spam? I am trying to warn people about a problem one
ONE board, se me sending this to multiple boards in a mass
send?

If your going to use a word, do it correctly please.

Thanks

 

[plun]

mark explained :

Win 95 was a virus...it sought out Netscape products and
killed 'em

This one only kills Kazaa folders not containing spyware..............

Maybe MSAS also will eat Firefoxes.........

 

[OldBoy]

If you are a professional (A+; Network+; MCP98; NetWare 4.11, 5, 5.1
Certified) then behave like one
To prove you wrong, I just uninstalled MSAS and did a restart.
It disappeared as it should.

Maybe because I did have a clean system (thanks to MSAS, Sygate Personal
Firewall, Sophos AV, CCleaner) and some experience (40+ years, bragg,
bragg,...)

By the way, experience is not a shield against mistakes........

Gr. Jan

XP
current in ALL Updates
Spysweeper catches the attempt to RE-animate
Been running anti spy AND Virus since install
Did a test, formatted, re-installed OS
looked in Task MAN for gcas------not found
Loaded MS anti-beta
ran, restarted 3 times
Task MAN shows gcasServ running
uninstalled MS antispy through Control panel
Reboot, checked TASK MAN and Hello....
gcasServ is running.
you saw what I tried, gcasServ won't die!

Oh BTW John...I am

A+; Network+; MCP98; NetWare 4.11, 5, 5.1 Certified

What were you going to tell me to try that I havent done?

Win 95 was a virus...it sought out Netscape products and
killed 'em

BTW Spam? I am trying to warn people about a problem one
ONE board, se me sending this to multiple boards in a mass
send?

If your going to use a word, do it correctly please.

Thanks

 

[Bill Sanderson]

Are you running Counterspy?

--
FAQ for Microsoft Antispyware:
http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm

XP
current in ALL Updates
Spysweeper catches the attempt to RE-animate
Been running anti spy AND Virus since install
Did a test, formatted, re-installed OS
looked in Task MAN for gcas------not found
Loaded MS anti-beta
ran, restarted 3 times
Task MAN shows gcasServ running
uninstalled MS antispy through Control panel
Reboot, checked TASK MAN and Hello....
gcasServ is running.
you saw what I tried, gcasServ won't die!

Oh BTW John...I am

A+; Network+; MCP98; NetWare 4.11, 5, 5.1 Certified

What were you going to tell me to try that I havent done?

Win 95 was a virus...it sought out Netscape products and
killed 'em

BTW Spam? I am trying to warn people about a problem one
ONE board, se me sending this to multiple boards in a mass
send?

If your going to use a word, do it correctly please.

Thanks

 

[D@annyBoy]

common sense is

If you are a professional (A+; Network+; MCP98; NetWare 4.11, 5, 5.1
Certified) then behave like one
To prove you wrong, I just uninstalled MSAS and did a restart.
It disappeared as it should.

Maybe because I did have a clean system (thanks to MSAS, Sygate Personal
Firewall, Sophos AV, CCleaner) and some experience (40+ years, bragg,
bragg,...)

By the way, experience is not a shield against mistakes........

Gr. Jan

XP
current in ALL Updates
Spysweeper catches the attempt to RE-animate
Been running anti spy AND Virus since install
Did a test, formatted, re-installed OS
looked in Task MAN for gcas------not found
Loaded MS anti-beta
ran, restarted 3 times
Task MAN shows gcasServ running
uninstalled MS antispy through Control panel
Reboot, checked TASK MAN and Hello....
gcasServ is running.
you saw what I tried, gcasServ won't die!

Oh BTW John...I am

A+; Network+; MCP98; NetWare 4.11, 5, 5.1 Certified

What were you going to tell me to try that I havent done?

Win 95 was a virus...it sought out Netscape products and
killed 'em

BTW Spam? I am trying to warn people about a problem one
ONE board, se me sending this to multiple boards in a mass
send?

If your going to use a word, do it correctly please.

Thanks

 

[Bill Sanderson]

Mark - I believe you may be correct about your surmise that what you are
seeing is a virus:

At this point, I believe you.

Here are a couple of supporting citations:

http://securityresponse.symantec.com/avcenter/venc/data/w3
(e-mail address removed)

http://securityresponse.symantec.com/avcenter/venc/data/w3
(e-mail address removed)

I'll apologize for not knowing about these critters, but
they are quite new.

What are you doing about your virus infection?

http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym


might be helpful.



--
FAQ for Microsoft Antispyware:
http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm

gcasServ is a virus because even if you TRY to uninstall MS
antispyware this process keeps running.

I quote André "
No, it is one of processes that allows Microsoft
AntiSpyware to run."

Andre,
what part of "I tried to uninstall it" don't you understand?
I uninstalled through control panel, deleted REG keys,
deleted the file
and STILL the process re-creates itself including REG
keys!!!!!!!!!!
try it yourself.

MS antispyware
uninstall, delete, wipe, delete REG keys

it recreates itself AND REG keys!!!!!!!

it runs again, slowing the system to a crawl


BY DEFINITION:

any program that re-creates itself and runs despite
attempts to uninstall or delete it is......................

A VIRUS!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

MS Giant antispyware is a VIRUS, so is BETA!!! I don't want
it on my system

There is a hidden programing portion that makes this
program rise from the dead no matter how many times or ways
you try to remove it from your system

VIRUS VIRUS VIRUS VIRUS VIRUS VIRUS VIRUS VIRUS VIRUS VIRUS
VIRUS VIRUS VIRUS VIRUS VIRUS VIRUS VIRUS VIRUS VIRUS VIRUS
VIRUS VIRUS VIRUS VIRUS VIRUS VIRUS VIRUS VIRUS VIRUS

 

[JohnF.]

Bill,

Let's hope your find works - I don't see gcasserv on their lists but that
doesn't mean they are not now pretending to be that process as well.

You are just too cooperative!

--
If you are under attack and MSAS does not seem to help:

*Submit suspected spyware report in the tools menu of MSAS*

1. Download:
lspfix.exe www.cexx.org/lspfix.htm
winsockxpfix.exe www.snapfiles.com/get/winsockxpfix.html
ccleaner.exe www.ccleaner.com
killbox.exe www.bleepingcomputer.com/files/killbox.php

2. Reboot into safe mode - http://tinyurl.com/pfca

3. Clean out all temp file locations - ccleaner.exe
(be sure to configure to delete all temp files
and not just those 48 hours old or older)

4. Run MSAS at least twice in full/deep mode

5. Run a robust, updated antivirus software scan

6. Reboot into normal mode,see if problem has been corrected

7. Install and use killbox to delete stubborn files

8. If you think something is there but can't see it:
- Download:
Blacklight by F-Secure to look for rootkits
www.europe.f-secure.com/exclude/blacklight/blbeta.exe
RootKitRevealer by SysInternals
www.sysinternals.com/ntw2k/freeware/rootkitreveal.shtml

Battle Notes:
- If you have trojans (files that won't go away),
you may have to disable System Restore on XP:
http://tinyurl.com/movy

- If your Internet connectivity quits:
http://support.microsoft.com/kb/892350
http://support.microsoft.com/kb/811259
LSPFix - www.cexx.org/lspfix.htm
Winsockxpfix - www.snapfiles.com/get/winsockxpfix.html

- Install SpywareBlaster to block thousands of malware apps
from installing on your machine. It does not actively
run on your machine, you run it, it makes changes that
protect you.
http://www.javacoolsoftware.com/

- This program will not detect or remove viruses
http://www.microsoft.com/athome/security/viruses/default.mspx

**For a detailed attack plan **
http://spywarewarrior.com/sww-help.htm

*** For assistance in battling infestations***
- Get HijackThis.exe from:
http://tomcoyote.org/hjt/hjt199//HijackThis.exe
- Save it to C:\hjt (new folder)
- Open it and select "Scan and Save Log"
- Note where you saved the log
- Send it to Ron Kinner as an attachment
- Ron's email address is (e-mail address removed)
- Put Hijack in the subject so he knows it's not spam
- He will tell you what to do next


Application Notes:
Registering a VB6 dll seems to fix missing agents:
1) Open up a command prompt (start -> run -> cmd)
2) Type in the following "regsvr32 msvbvm60.dll" (without the quotes).
3) Close and re-open Windows AntiSpyware

- To report false positives:
www.microsoft.com/athome/security/spyware/software/isv/fpform.aspx

- To submit disputes or requests:
www.microsoft.com/athome/security/spyware/software/isv/cdform.aspx

- To learn more about how MS analyzes suspected spyware:
www.microsoft.com/athome/security/spyware/software/isv/analysis.mspx

Alternative Anti-Spyware Applications:
- Spybot Search and Destroy
http://www.majorgeeks.com/download2471.html
- LavaSoft AdAware
http://www.majorgeeks.com/download506.html
- AdAware VX2 Cleaner Plugin
http://www.majorgeeks.com/download4283.html
- BHODemon
http://www.majorgeeks.com/download3550.html
- CWShredder (CoolWWWSearch)
http://www.majorgeeks.com/download3019.html
- PestPatrol
http://www.majorgeeks.com/download1187.html
- Webroot Spysweeper
http://www.majorgeeks.com/download3263.html
- Spyware Doctor
http://www.majorgeeks.com/download4241.html
- Ewido Security Suite
http://www.ewido.net/en/

Recommended Software to help protect you:
- Windows XP Service Pack 2
http://www.microsoft.com/windowsxp/sp2/default.mspx
- SpywareBlaster
http://www.javacoolsoftware.com
- Outpost Firewall Pro
http://www.agnitum.com/products/outpost

 

[Bill Sanderson]

Now that I'm awake, I should re-read the article. And the OP(s) need to do
full scans with current definitions, so we can get a good reading.

 

[Hank]

One post on a message board IS SPAM. Because it's read by
multiple people, so the intent is "bulk".

I've always found that people who like to declare all
their certifications, are often amongst the most short-
sighted people around. What's that old saying ... "Jack
of all trades. Master of none."

Hank