Re: Spyware Advice

From: Meghan (Meghan_at_discussions.microsoft.com)
Date: 06/18/04 

Date: Fri, 18 Jun 2004 08:26:01 -0700

Thank you Bruce and R for your suggestions but I am still in a pickle. I do not believe that what I have is a pop-up. I will try to explain what it is. My desktop backgroud picture is being cover up by a black screen (all of my icons are still showing). In the center of the black screen is an advertisment for a spyware. It says "Warning you are in danger" and then goes on to tell me why I am in danger. Also it is there every time I turn my comp. on and off.

I have tried changing my desktop settings but nothing happened because I think it is sitting on top of it. I checked the properties of this thing and it has 2 addresses:
file://C:\WINDOWS\Web\desktop.html
 file:///C:/WINDOWS/Web/i_02.gif
Which I belive is in the folder that contains crucial programs to run my computer so I am hesitant to just delet it without knowing for sure this is what I am looking for.

As for the Ad-aware and spybot software, I got the "trojan" virus six months ago and ever since I have been running both programs practically every other day. Neither of which has gotten rid of this thing.

Any other suggestions?
Thanks again for your help.

"Bruce Chambers" wrote:

> Greetings --
>
> There are at least three varieties of pop-ups, and the solutions
> vary accordingly. Which specific type(s) is troubling you?
>
> 1) Does the title bar of these pop-ups read "Messenger Service?"
>
> This type of spam has become quite common over the past year or
> so, and unintentionally serves as a valid security "alert." It
> demonstrates that you haven't been taking sufficient precautions while
> connected to the Internet. Your data probably hasn't been compromised
> by these specific advertisements, but if you're open to this exploit,
> you most definitely open to other threats, such as the Blaster,
> Welchia, and Sasser Worms that still haunt the Internet. Install and
> use a decent, properly configured firewall. (Merely disabling the
> messenger service, as some people recommend, only hides the symptom,
> and does little or nothing to truly secure your machine.) And
> ignoring or just "putting up with" the security gap represented by
> these messages is particularly foolish.
>
> Messenger Service of Windows
> http://support.microsoft.com/default.aspx?scid=KB;en-us;168893
>
> Messenger Service Window That Contains an Internet Advertisement
> Appears
> http://support.microsoft.com/?id=330904
>
> Stopping Advertisements with Messenger Service Titles
> http://www.microsoft.com/windowsxp/pro/using/howto/communicate/stopspam.asp
>
> Blocking Ads, Parasites, and Hijackers with a Hosts File
> http://www.mvps.org/winhelp2002/hosts.htm
>
> If you're using AOL, you'll either need to find a 3rd party
> firewall that is compatible with AOL, or switch to a real ISP that is
> compatible with the real Internet. This is because AOL is an on-line
> content provider that ignores international Internetworking standards
> in favor of its own proprietary products, and has deliberately made
> its connection software incompatible with both WinXP's built-in
> firewall and WinXP's Internet Connection Sharing feature. AOL's
> proprietary connection applet is deliberately designed to preclude
> your setting/adjusting any of its properties, to include
> enabling/disabling WinXP's ICF and ICS.
>
> Whichever firewall you decide upon, be sure to ensure UDP ports
> 135, 137, and 138 and TCP ports 135, 139, and 445 are _all_ blocked.
> You may also disable Inbound NetBIOS (NetBIOS over TCP/IP). You'll
> have to follow the instructions from firewall's manufacturer for the
> specific steps.
>
> You can test your firewall at:
>
> Symantec Security Check
> http://security.symantec.com/ssc/vr_main.asp?langid=ie&venid=sym&plfid=23&pkj=GPVHGBYNCJEIMXQKCDT
>
> Security Scan - Sygate Online Services
> http://www.sygatetech.com/
>
> Oh, and be especially wary of people who advise you to do nothing
> more than disable the messenger service. Disabling the messenger
> service, by itself, is a "head in the sand" approach to computer
> security. The real problem is _not_ the messenger service pop-ups;
> they're actually providing a useful, if annoying, service by acting as
> a security alert. The true problem is the unsecured computer, and
> you've been advised to merely turn off the warnings. How is this
> helpful?
>
> 2) For regular Internet pop-ups, you might try the free 12Ghosts
> Popup-killer from http://12ghosts.com/ghosts/popup.htm, Pop-Up Stopper
> from http://www.panicware.com/, or the free Google Toolbar from
> http://toolbar.google.com/, which is what I use.
>
> 3) To deal with pop-ups caused by any sort of "adware" and/or
> "spyware,"such as Gator, Comet Cursors, Xupiter, Bonzai Buddy, or
> KaZaA, and their remnants, that you've deliberately (but without
> understanding the consequences) installed, two products that are
> quite effective (at finding and removing this type of scumware) are
> Ad-Aware from www.lavasoft.de and SpyBot Search & Destroy from
> www.safer-networking.org/. Both have free versions. It's even
> possible to use SpyBot Search & Destroy to "immunize" your system
> against most future intrusions. I use both and generally perform
> manual scans every week or so to clean out cookies, etc.
>
>
> Bruce Chambers
> --
> Help us help you:
> http://dts-l.org/goodpost.htm
> http://www.catb.org/~esr/faqs/smart-questions.html
>
> You can have peace. Or you can have freedom. Don't ever count on
> having both at once. - RAH
>
>
> "Meghan" <Meghan@discussions.microsoft.com> wrote in message
> news:9B7E62AB-F0E2-4614-9AB7-B47B5D34C489@microsoft.com...
> > I have a spyware advertisment that has become my desktop background
> picture and I have no idea how to get rid of it. It's title is
> "Warning! You're in Danger!" and while it isn't affecting my internet
> speed it is affecting the speed of almost everything else. I have run
> Ad-aware 6.0 and Spybot Search and Destroy and they have not been able
> to find it. Does anyone have any idea of how to get rid of this
> thing?
>
>
>

Relevant Pages

  • Direct Ads Security Hole!!!!
    ... a software firewall or simply enabling ICF (Internet ... Connection Firewall) in XP is a definite must-do! ... >through a messaging function on many Windows operating ... >By tapping into Messenger Service, ...
    (microsoft.public.windowsxp.security_admin)
  • Re: windows xp
    ... and Sasser Worms that still haunt the Internet. ... > use a decent, properly configured firewall. ... > messenger service, as some people recommend, only hides the symptom, ... My problem is POPUPS. ...
    (microsoft.public.windowsxp.general)
  • Re: "Messenger Service" Pop Up
    ... Duncan McNutt ... but disabling the messenger service isn't the ... but you ALSO need a firewall - otherwise you've just bandaided ...
    (microsoft.public.security)
  • Re: Firewall
    ... Internet Security 2002, ... Norton AntiVirus, Norton Personal Firewall, parental controls, privacy ... Messenger Service Window That Contains an Internet Advertisement ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Spyware?
    ... and Sasser Worms that still haunt the Internet. ... > use a decent, properly configured firewall. ... > messenger service, as some people recommend, only hides the symptom, ... Disabling the messenger ...
    (microsoft.public.windowsxp.general)