MSIExec.exe???

[Chilly McFreeze]

Do you guys know if this file is modified by SP2? I got a warning from Zone Alarm yesterday that this file has been modified since it last run, and the only thing I can think of is that I recently installed SP2. If it's not that, it's probably been replaced by something malicious.

[Amnesia620]

Msiexec.exe is an "executable" that is used by Windows to install software, therefore, it changes for every installation. The only control provided is MSIServer which is the Windows installer service.
In essence, yes, SP2 has a different or altered (can change) MSIExec.exe, but then again, (most if not all) any other application on earth does or can do this, as well.
SP2 has it's benefits and it's drawbacks - I had my laptop and OS settings, after I installed SP2, optimized by my best friend who's also a (freelance Network technician), in order for me to have great download speeds, efficient memory use/processor time as well as the security that SP2 is said to provide. I hope this helps you, even if only a little.

Only as a caution to you, from experience: As a forewarning, be watchful of Zone Alarm and all of it's bells and whistles. If something happens (your computer tries to do something ZoneAlarm doesn't like) it can block your Internet Explorer, Messengers (yahoo, aol, msn, trillian, etc.) and cause complications when it does this (as it will remove itself from your desktop, program files, etc. except for your registry) to where you will have to go through a semi-troublesome process of removing ZA from your registry in Safe Mode in order to be able to use anything that relies or accesses the internet...this after you have to access the internet on a separate computer in order to read, write down or print the instructions as to how to repair your internet connection. I had ZA for only a few months - it was a headache and a half; a friend of mine and an associate of hers both have had similar issues - one had to reinstall her Operating Sys. due to ZA deleting her NTLDR file (which helps Windows start-up/load). If you are happy with it, then I wish you the best with it. Take care.

[arch13]

Originally Posted by Chilly McFreeze

Do you guys know if this file is modified by SP2? I got a warning from Zone Alarm yesterday that this file has been modified since it last run, and the only thing I can think of is that I recently installed SP2. If it's not that, it's probably been replaced by something malicious.

As much as it pains me to say this, just use the firewall that comes with SP2 instead of ZoneAlarm.
The honest truth is that products like ZonAlarm are good in high risk situations with stable environment, a fileserver for instance.
Your personal computer however, is a low risk target. The reality is that no one is trying to activley enter your system. SP2's firewall is enough to rebuff the attempts of port scanners and bots.