Is "mssecurityupdatepatch.exe" spyware (under Win2000) ?

[Peter Meister]

After having worked for a couple of years with Win2000 successfully I observed some new popup messages
from my firewall during the last weeks.
They inform me that a program called

C:\winnt\system32\mssecurityupdatepatch.exe

wants to contact some server outside.
Is this a valid part of Win2000?

If yes, where can I turn off this autoupdate function?
If no, can I delete simply this program?
and - Moreover - Why didn't Ad-aware and SpyBot Search & Destroy do not identify this program as spyware ?

Peter

 

[George Hester]

No file of that name should exist in C:\WINNT\system32

This is the usual name for the bogus ms security updates popular in Newsgroups and e-mail.

Fix your newsgroups you send to. Do NOT include Newsgroups that are NOT on the Microsoft newserver.

 

[N1POP]

C:\winnt\system32\mssecurityupdatepatch.exe

Sounds more like a trojan/virus. Have you tracked down the
destination IP? If it isn't Microsoft space, then I'd consider it
malware.

 

[Jeffrey Morse]

After having worked for a couple of years with Win2000 successfully I observed some new popup messages
from my firewall during the last weeks.
They inform me that a program called

C:\winnt\system32\mssecurityupdatepatch.exe

wants to contact some server outside.
Is this a valid part of Win2000?

If yes, where can I turn off this autoupdate function?
If no, can I delete simply this program?
and - Moreover - Why didn't Ad-aware and SpyBot Search & Destroy do not identify this program as spyware ?

Peter

I'd delete that file if I were you. The only reference I found for it was
in a Computercops.biz forums post:

http://www.computercops.biz/modules.php?name=Forums&file=viewtopic&p=139757

He was asked to upload the file to them so they could dissect it and see
if it was malicious. It sounds an awful lot like the subject lines used
by Swen.A, which is also known as the Begbie trojan. I would strongly
suspect it to be similar (you may have to terminate it in Task Manager
if it is running).