Tech Support banner

Status
Not open for further replies.
1 - 7 of 7 Posts

·
Registered
Joined
·
1 Posts
Discussion Starter #1
Hi,

I have a virus on this computer which randomly pops-up advertisements.

The pop-ups aren't in Internet explorer, they are "Application popups" and appear in the System "Event Viewer". Here is a clip:

"Application popup: Messenger Service : Message from ADVERTISING to 24.103.79.30 on 1/17/2003 7:16:16 PM

INTEREST RATES AT 40 YR LOW... FREE QUOTE/ANALYSIS.

LAST CHANCE TO REFINANCE BEFORE RATES GO UP.

IF YOU ARE OVER 7% ODDS ARE YOU CAN BENEFIT GREATLY!

WE HAVE THE BEST MORTGAGE SELECTION IN THE NATION.

Please e-mail one of our experienced loan officer's direct at:
[email protected]
And please leave your name and phone number. "

That's copied from the Event Viewer.

This message changes each time.

I've run Trend online virus scanner, McAfee, etc.. nothing will find a virus. But it's quite obvious that one exists.

Is there any way to detect what program is causing this message to appear? Nothing in the Running Tasks section of the task manager appears abnormal, in fact I think this program may be hidden under a Window's "Service", but again nothing there appears weird. There's nothing unusual in any windows startup registry entries I've looked at. I'm out of ideas and want this removed.

Any ideas from anyone?

- Narf Bro
 

·
Citizen of the world
Joined
·
51,041 Posts
You don't have a virus, you have discovered that your firewall protection is substandard. :) The ads are generated through Windows Messenger Service, which is normally used for services like UPS and NET SEND messages.

Here's one of the many threads discussing this issue on another discussion board. PopUp Ads
 

·
Premium Member
Joined
·
1,611 Posts
narf_bro, welcome to TSF...
I would definitely check settings on your firewall or get a new one...(zoneAlarm ? )

and just FYI.... please try to stick to the forum topic when posting...for ex. you've posted your question about virus in win2k/NT forum. You can post virus/security related questions in the Anti-virus or Security section...


Thanks and G/L !!! :D
 

·
Citizen of the world
Joined
·
51,041 Posts
NetEngineer said:
For now.....you can disable the messenger service to not get the pop ups..............
I don't give instructions for disabling messenger for a specific reason in these cases. The problem is not Windows Messenger, it's just the service that is used by these spammers to access your desktop. Since firewall protection is the real issue, the smart money is on addressing the problem that way. If you just disable Messenger, what other nasties are you ignoring that didn't have an obvious symptom? :rolleyes:
 

·
Registered
Joined
·
1,691 Posts
..and a moving we will go. :bandit:

This is defiantly a Security or at this point maybe also an AV issue depending on what else has gotten in your open ports, but not really a Win2000/NT issue, like merlin said.

----

I agree with johnwill on this one, stopping just this particular issue doesn't really help you in the long run, kinda like putting a band-aid over a cut on your arm and leaving 10 others exposed ... :no:

You need to look into a firewall of some sort(I recommend zone-alarm), and at this point also do a Trojan and virus sweep as well to make sure your open ports haven't led to a compromised system. A quick "netstat -a" from the command line could give you a basic picture of your port connections as well, and finally welcome to the board. :) Goodluck.
 
1 - 7 of 7 Posts
Status
Not open for further replies.
Top