False Positive in Microsoft Windows 2000 Resource Kit

[John Gruener]

Beta 1.0.501, Defs 5682 is reporting that C:\Program
Files\Resource Pro Kit\instsrv.exe is a Trojan and
recommends removing it.

I don't think so!

- John

 

[Ron Chamberlin]

Hi John
Thanks for the report on the Resource Kit hit. You're not the first tho.


Ron Chamberlin
MS-MVP

 

[John Gruener]

Well, sorry about that Ron, but I had done a search on the
entire newsgroup for "instsrv.exe" and did not come up
with any hits. Perhaps I didn't search correctly.

In any case, it would seem that MSAS should be finding the
Trojans that use instsrv.exe (as well as srvany.exe),
rather than flagging a legitimate program as a threat
because it may be "used in a malicious manner" by a known
Trojan.

After all, are not other legitimate Windows programs like
explorer.exe, cmd.exe, and countless others "used" by
these Trojans?

- John