[There's a reason that Yoda is the unofficial mascot of SBS. Size indeed matters not.] Know thy system - THE OFFICIAL BLOG OF THE SBS DIVA
Wed, Jul 29 2009 19:18 bradley

Know thy system

So the other day I noted on a server I have that there was a service called Windows service pack installer service and it wasn't running.  Okay ... hummm I don't remember that service before so let's check my running service inventory.  Nope, last time it wasn't there.  So where did that come from.  The file is an official one from Microsoft , but the name is Windows 2000 service pack installer service so what the heck is it doing on a Server 2003 box?

http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/SBS_Small_Business_Server/Q_24295747.html

Others have seen it as well.

This where "know thy system" comes into play.  The ONLY thing I changed on that box was that I ran a special install of Malwarebytes.org a few days ago just to ensure that it was malware free.  Sometimes that cleans off more crud off a system that normal antivirus says is clean.  So being in a paranoid frame of mind (with Blackhat in the works) I ran it on the box. 

So let's uninstall that app and see if that goes away.  And sure enough... and as reported in the software monitoring alerts... Application Malwarebytes' Anti-Malware (C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent) was removed from the registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx and will no longer be run when a user logs into the system.  Once I removed that application, that particular service went away.

Filed under:

# re: Know thy system

Thursday, July 30, 2009 9:24 PM by Chris Knight

Which begs the question - why is an anti-malware package exhibiting malware-like behaviour?

I can understand that it's trying to avoid detection by malware, but the package would have to use a lot more malware techniques than obscuring a service name to prevent detection by active malware on a system.

It's either upfront, transparent and self-evident in it's install and operation footprint, or it uses contemporary malware techniques which are disclosed appropriately to allow sysadmins to remain confident in its integrity and behaviour.