Program did not prevent an install

[Scott]

I was evaluating a program used to scan for installed
rootkits. I downloaded the program - Rootkitrevealer -
from sysinternals. When I ran the program, Microsofts
Spyware program notified me that a program ux.exe, wanted
to run as a service. I selected BLOCK.
Nevertheless the program started running as a service.

YIKES !!!


Microsoft AntiSpyware version 1.0.509
Windows OS: XP
Windows OS Version Info: 148
Windows OS Major Version: 5
Windows OS Minor Version: 1
Windows OS Build: 2600
Current Path: C:\Program Files\Microsoft AntiSpyware
Install Path: C:\Program Files\Microsoft AntiSpyware\
Session.RunMode: 5
Session.TimeBombDaysRemaining: 73
Session.TimeBombExpirationDate: 7/31/2005
Real-time protection running: True
Real-time protection enabled: True
Security Agents Application Enabled: True
Security Agents Internet Enabled: True
Security Agents System Enabled: True
Security Agents Checkpoints: 59
Definitions Update Date: 5/13/2005 10:38:23 AM
AutoUpdater Enabled: 1
AutoUpdater AutoApply Enabled:
Definitions Increment Version: 70/70
Definitions ThreatAuditThreatData: 1332931
Definitions ThreatAuditScanData: 2377784

 

[Andre Da Costa]

From Bill Sanderson:
Microsoft Antispyware does remove some spyware which has root-kit
characteristics. Microsoft is well aware of this issue and I'm sure more
such detections will be added.

Blacklight is a good thing, as is Sysinternals RootkitRevealer.