Beta Spyware warning

I have had the Microsoft AntiSpyware running for a few months and no
complaints. I also have a program called "Startup Inspector for Windows" on
my computer which I got at http://www.windowsstartup.com/. Startup Inspector
looks at the programs that run on startup and tells you what they are and
suggests if you should disable them or not.

Microsoft AntiSpyware puts a program in the registry startup call
gcasServ.exe. In the past, Startup Inspector had no information on this
program. Now, Startup Inspector says in the comments for gcasServ.exe ;
"Added by a variant of the RBOT WORM! Do not confuse with the Microsoft
AntiSpyware executable of the same name."

I uninstalled Microsoft AntiSpyware, rebooted, redownloaded it, then
reinstalled it. Then I ran Startup Inspector which still gives the same
warning.

I wonder if there is a way if I can find out if I actually have the RBOT
worm of if Startup Inspector is full of beans.

Thanks

Ted
Fri Aug 05 13:27:04 CDT 2005

Perhaps Startup Inspector was not intended to be used with software in beta
release.

--
Ted Zieglar
"You can do it if you try."

"James R. Brown" <heavy-duty@earthlink.net> wrote in message
news:LGNIe.3663$ns.1408@newsread1.news.atl.earthlink.net...
> I have had the Microsoft AntiSpyware running for a few months and no
> complaints. I also have a program called "Startup Inspector for Windows"
on
> my computer which I got at http://www.windowsstartup.com/. Startup
Inspector
> looks at the programs that run on startup and tells you what they are and
> suggests if you should disable them or not.
>
> Microsoft AntiSpyware puts a program in the registry startup call
> gcasServ.exe. In the past, Startup Inspector had no information on this
> program. Now, Startup Inspector says in the comments for gcasServ.exe ;
> "Added by a variant of the RBOT WORM! Do not confuse with the Microsoft
> AntiSpyware executable of the same name."
>
> I uninstalled Microsoft AntiSpyware, rebooted, redownloaded it, then
> reinstalled it. Then I ran Startup Inspector which still gives the same
> warning.
>
> I wonder if there is a way if I can find out if I actually have the RBOT
> worm of if Startup Inspector is full of beans.
>
> Thanks
>
>

PA
Fri Aug 05 13:39:33 CDT 2005

gcasServ.exe is a valid MWAS-related file, assuming it's located in the MWAS
program folder (e.g., C:\Program files\Window AntiSpyware). Is it? Does a
search in Explorer find any other instances of gcasServ.exe?

Have you a reliable, up-to-date anti-virus app installed? Does a full
system scan find anything?

Are you fully up-to-date at Windows Update?

Microsoft has established separate newsgroups for the Microsoft Windows
AntiSpyware Beta.
http://communities.microsoft.com/newsgroups/default.asp?ICP=spyware&sLCID=us
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE) & Security

James R. Brown wrote:
> I have had the Microsoft AntiSpyware running for a few months and no
> complaints. I also have a program called "Startup Inspector for Windows"
> on
> my computer which I got at http://www.windowsstartup.com/. Startup
> Inspector
> looks at the programs that run on startup and tells you what they are and
> suggests if you should disable them or not.
>
> Microsoft AntiSpyware puts a program in the registry startup call
> gcasServ.exe. In the past, Startup Inspector had no information on this
> program. Now, Startup Inspector says in the comments for gcasServ.exe ;
> "Added by a variant of the RBOT WORM! Do not confuse with the Microsoft
> AntiSpyware executable of the same name."
>
> I uninstalled Microsoft AntiSpyware, rebooted, redownloaded it, then
> reinstalled it. Then I ran Startup Inspector which still gives the same
> warning.
>
> I wonder if there is a way if I can find out if I actually have the RBOT
> worm of if Startup Inspector is full of beans.
>
> Thanks

James
Fri Aug 05 20:22:01 CDT 2005

I will go to the correct newsgroup. Also, yes I have a virus checker
installed, Yes, I did a full virus scan. Yes, I am fully up to date.

Thank you for your answer

"PA Bear" <PABearMVP@gmail.com> wrote in message
news:%23ek3N0emFHA.2444@tk2msftngp13.phx.gbl...
> gcasServ.exe is a valid MWAS-related file, assuming it's located in the
> MWAS program folder (e.g., C:\Program files\Window AntiSpyware). Is it?
> Does a search in Explorer find any other instances of gcasServ.exe?
>
> Have you a reliable, up-to-date anti-virus app installed? Does a full
> system scan find anything?
>
> Are you fully up-to-date at Windows Update?
>
> Microsoft has established separate newsgroups for the Microsoft Windows
> AntiSpyware Beta.
> http://communities.microsoft.com/newsgroups/default.asp?ICP=spyware&sLCID=us
> --
> ~Robear Dyer (PA Bear)
> MS MVP-Windows (IE/OE) & Security
>
> James R. Brown wrote:
>> I have had the Microsoft AntiSpyware running for a few months and no
>> complaints. I also have a program called "Startup Inspector for Windows"
>> on
>> my computer which I got at http://www.windowsstartup.com/. Startup
>> Inspector
>> looks at the programs that run on startup and tells you what they are and
>> suggests if you should disable them or not.
>>
>> Microsoft AntiSpyware puts a program in the registry startup call
>> gcasServ.exe. In the past, Startup Inspector had no information on this
>> program. Now, Startup Inspector says in the comments for gcasServ.exe ;
>> "Added by a variant of the RBOT WORM! Do not confuse with the Microsoft
>> AntiSpyware executable of the same name."
>>
>> I uninstalled Microsoft AntiSpyware, rebooted, redownloaded it, then
>> reinstalled it. Then I ran Startup Inspector which still gives the same
>> warning.
>>
>> I wonder if there is a way if I can find out if I actually have the RBOT
>> worm of if Startup Inspector is full of beans.
>>
>> Thanks
>

Frank
Fri Aug 05 21:37:58 CDT 2005

"James R. Brown" <heavy-duty@earthlink.net> wrote in message
news:ZgUIe.3800$ns.1576@newsread1.news.atl.earthlink.net
> I will go to the correct newsgroup. Also, yes I have a virus checker
> installed, Yes, I did a full virus scan. Yes, I am fully up to date.
>
> Thank you for your answer

You can access the MSAS newsgroups from OE.
At this time, support for the beta version of Microsoft Windows AntiSpyware
is being provided through the following Microsoft newsgroups:

- microsoft.private.security.spyware.announcements
- microsoft.private.security.spyware.appcompat
- microsoft.private.security.spyware.general
- microsoft.private.security.spyware.install
- microsoft.private.security.spyware.networking
- microsoft.private.security.spyware.signatures
- microsoft.private.security.spyware.onlinecommunity

To access these newsgroups using NNTP, please use the following information
for your NNTP client (such as Microsoft Outlook Express):

- NNTP Server: privatenews.microsoft.com
- Account name: privatenews\spyware
- Password: spyware

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx
http://defendingyourmachine.blogspot.com/