Read this.

I first thought something was wrong because my software firewall asked me if it was OK for "msiexec .exe" to connect to the Internet because it had "changed since I last opened it." I was suspicious, so I said NO.

I then ran a backtrack from my firewall's security log and found that it was really trying to connect to "whois.uwhois.com" (which turns out to be one of those annoying "register a domain" sites we often get linked to).

I ran Spybot, and it detected two registry changes. One was a "FirewallOverride." The other was a "AntiVirusOverride." I deleted them and rebooted my computer.

Upon reboot, I got a warning that Windows did not detect any firewall or virus protection. I ran Spybot again and the two registry changes had re-installed themselves!
So, I wrote down the actual names of the registry changes, ran "Run" from Start Menu and ran "regedit." I then deleted the two offending registry values by hand.

Note: These two overrides were disabling the Windows firewall and anti-virus functions. Since I use my own firewall and anti-virus programs, I was never actually compromised :)

After reading the article I linked to above, I then ran "Search" from the Start Menu and searched for "msiexec .exe". I found several references to "msiexec .exe" (which is not surprising since the true msiexec .exe is a valid Windows process). However, one of the items I found looked real odd because it was a prefetch file. It's name was followed by some numbers (like "msiexec .exe -12345.pf") so I deleted it.

Rebooted again.
This time Spybot did not find the offending registry values. I did get the Windows warning that Windows did not detect any firewall or virus protection. So, I went back in and told Windows that I had my own firewall and anti-virus solutions that I was monitoring myself and it is happy again.

Again, I'm SURE that I encountered this while surfing through links and websites that all of us perverts travel through, so heads up!

FYI, I run Spybot, Ad-Aware, Crap Cleaner and my own firewall and anti-virus programs (which I keep all definitions up-to-date). In addition, I have a default hardware firewall as a result of my router.

Be careful. And, if you have the time, run a search to see if you picked-up any weird "msiexec .exe" references. Once it gets "approval" from your firewall, it will start dialing out without your knowledge and your computer will soon be infected.

And the world calls US the perverts.

Edited by - BigBobxxx on Jul 31 2005

Edited by - BigBobxxx on Aug 1 2005

[Link]