Solved

mnsvc.exe??

Posted on 2002-04-15
19
195 Views
Last Modified: 2013-12-28
Hello,

has anyone ever heard of the filename mnsvc.exe?? This has been causing dr watson errors my windows nt4.0 box when running applications.

Dave
0
Comment
Question by:Archangel_dm
  • 4
  • 4
  • 4
  • +4
19 Comments
 
LVL 63

Expert Comment

by:SysExpert
Comment Utility
http://forums.anandtech.com/messageview.cfm?catid=32&threadid=763618&highlight_key=y&keyword1=mnsvc

It may be a cause for concern.
Disable it in the startup ad run some adware/spyware program in addition to the newest Anti-virus.

I hope this helps !
0
 

Author Comment

by:Archangel_dm
Comment Utility
How do you disable it in the startup exactly??
0
 

Expert Comment

by:JVanLear
Comment Utility
mnsvc.exe

check Symantec for backdoor.trojan

some other infected files :

absr.exe
ausvc.exe
0
 
LVL 63

Expert Comment

by:SysExpert
Comment Utility
Cleanup the startup stuff. In win98/Win ME/Win XP -  Do a Start - Run - msconfig, startup Tab , or for win95 , NT or win2k,
Download the Startup COP a free pcmag utility from
http://www.zdnet.com/downloads/stories/info/0,,77594,.html
 Run it and it will show you everything that is listed in all the possible startup
                        places, and allow you to disable things one at a time until the problem is eliminated.
 A lot of probelms are caused by excess old baggage - programs that have not been properly  un-installed. Startup Cop will eliminate leftovers and un-wanted programs that you no longer want.

I hope this helps !

0
 

Expert Comment

by:Death-Speak
Comment Utility
I found c:\winnt\mnsvc.exe was causing an App Error on a 2000 box I had recently setup. Everything was exactly the same as when I origionally configured the machine. It was created 4/4/02. I didn't find anything else as far as possible spyware or anything refered to above, or that the executable was accessing the internet. I simply deleted it and the problem went away.
0
 

Accepted Solution

by:
taxmanic earned 200 total points
Comment Utility
Just had the same problem

I ran antivirus to clean a download worm virus
0
 

Expert Comment

by:rmoberly
Comment Utility
Try this. Go to http://www.majorgeek.com/index2.html and download Adaware, install it and run it on your system. It should find and on your approval will remove any adware or spyware that is installed on your system.

Your questions was the only hit i found on mnsvc.exe while I was trying to resolve the same problem. So thanks.

Rich Moberly
Bartlesville Oklahoma
0
 

Author Comment

by:Archangel_dm
Comment Utility
taxmaniac, do you run mcaffee or norton???

rmoberly, you are very welcome. I couldn't find any infor on it using search engines such as google or dogpile until recently. As far as spyware, there are 4 machines in my company that have this file. What i can't figure out is what site they were on to get this downloaded to the pc??
I did download and run adware with success!!!!!
Because i work on a helpdesk, i want to find out where they were!!!!!!
0
 

Expert Comment

by:rmoberly
Comment Utility
ARchangel dm
When you find the answer, please post it so we will know too. I am part of a network support team for a 3 state area and it would be helpful to know the answer to this for our internal help desk software knowledge base.

Best of luck to you.
Rich Moberly
0
Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

 

Author Comment

by:Archangel_dm
Comment Utility
sure, I will. Actually, i sent the exe, zipped, to mcafee and they will do some research on it. As soon as i hear something, i will post it.
0
 

Expert Comment

by:JVanLear
Comment Utility
An interesting note

Running current NAV, it quarantined the files

mnsvc.exe
ausvc.exe
absr.exe

I restored the files to their original exe's (saved as *.vpn by NAV) to their original location and then moved them to a floppy

Ran NAV McAfee & IPE on those files on other computers and none showed up as viruses

So far 4 instances of this virus? have occurred
0
 

Expert Comment

by:waynele
Comment Utility
There is one more files running with this.

It's vbt.exe

Up to now still don't know which program or site that installed this on the workstation.

Adaware didn't detect it.
0
 

Expert Comment

by:waynele
Comment Utility
There is one more files running with this.

It's vbt.exe

Up to now still don't know which program or site that installed this on the workstation.

Adaware didn't detect it.
0
 

Expert Comment

by:waynele
Comment Utility
There is one more files running with this.

It's vbt.exe

Up to now still don't know which program or site that installed this on the workstation.

Adaware didn't detect it.
0
 

Expert Comment

by:waynele
Comment Utility
Sorry its BVT.EXE
0
 

Expert Comment

by:JVanLear
Comment Utility
As a first time user of this site

I guess I'm missing the point here

Even the first comment by SysExpert gave a general answer as run a virus scan.

And then I said which one it was - download.trojan

If none of the comments are going to be evaluated or put into use, does this just go on as an infinite chat session?
0
 

Expert Comment

by:JVanLear
Comment Utility
BACKDOOR.AUTOUPDER FOUND ON 3 COMPUTERS

See www.symantec.com for Backdoor.Autoupder

NAV QUARANTINED COOLSTUFF.INI BUT DID NOT QUARANTINE COOLSTUFF.OCX
COOLSTUFF.CAB WAS NOT FOUND

THIS IS PART OF THE BACKDOOR THAT WAS FOUND LAST WEEK
WITH THE FOLLOWING FILES

AUSVC.EXE
BVT.EXE
MNSVC.EXE
ABSR.EXE

These are the new files for Backdoor.Autoupder

COOLSTUFF.INI
COOLSTUFF.OCX
COOLSTUFF.CAB


There are entries to the registry, too.


THIS IS STILL JUST PART OF THE TROJAN.
@ HOME BEWARE IF YOU ARE NOT RUNNING A FIREWALL (LIKE BLACKICE OR ZONEALARM)
(IF YOU ARE RUNNING THESE THIS VIRUS WILL TERMINATE)

JVanLear
0
 
LVL 63

Expert Comment

by:SysExpert
Comment Utility
Archangel_dm : I am a little disappointed to see that I received no credit at all , even though I mentioned the virus aspect first.

If you would like to change or split points,

You can put in a request to                    
http://www.experts-exchange.com/jsp/qList.jsp?ta=commspt
to distribute the points in any manner you think is proper.
This is especially true when you think you have received good information from more than one person.

Also see  http://www.experts-exchange.com/jsp/cmtyQuestAnswer.jsp

     I hope this helps !
0
 

Author Comment

by:Archangel_dm
Comment Utility
Sure, sorry about that. I did find out that it was a trojan virus. It's called downloader-w.
0

Featured Post

Why spend so long doing email signature updates?

Do you spend loads of your time carrying out email signature updates? Not very interesting are they? Don’t let signature updates get you down. Let Exclaimer Cloud - Signatures for Office 365 make managing email signatures a breeze.

Join & Write a Comment

If you get continual lockouts after changing your Active Directory password, there are several possible reasons.  Two of the most common are using other devices to access your email and stored passwords in the credential manager of windows.
If you need to start windows update installation remotely or as a scheduled task you will find this very helpful.
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now