Spyware

[Taishi]

I just got home and found the following pop-up on my screen. I printscreen
it and placed it into word. If any of want to see it, I can e-mail it to
you. It says that it has detected spyware, and to click on the link to
receive free scanner that will locate and remove the program.

I am already paranoid. And I am working on my firewall and my
host(software) firewall. I have 1-2 posting receiving help, and I am
following their suggestions. I welcome all suggestions.

Have any of you seen this before?

Warm Regards and as always Thanks,
T

 

[jo]

do not go by the popup
go here to remove spyware
http://www.lavasoft.de/support/download/
and for a popup blocker try here
http://www.panicware.com/product_psfree.html

 

[taff]

I just got home and found the following pop-up on my screen. I printscreen
it and placed it into word. If any of want to see it, I can e-mail it to
you. It says that it has detected spyware, and to click on the link to
receive free scanner that will locate and remove the program.

I am already paranoid. And I am working on my firewall and my
host(software) firewall. I have 1-2 posting receiving help, and I am
following their suggestions. I welcome all suggestions.

Have any of you seen this before?

Warm Regards and as always Thanks,
T

These messages are not harmful in themselves so do not panic. However
it shows that there is a security hole in IE that is allowing them to
be put onto your computer screen.

There is a patch available on the microsoft website. I am sorry that I
do not know the number as I am only repeating what has been posted
here before. Check the earlier messages for a fuller answer.

Taff...........



www.sounds-pa.com | www.thecomputerworkshop.com

 

[YoKenny]

I just got home and found the following pop-up on my screen. I
printscreen it and placed it into word. If any of want to see it, I
can e-mail it to you. It says that it has detected spyware, and to
click on the link to receive free scanner that will locate and remove
the program.

I am already paranoid. And I am working on my firewall and my
host(software) firewall. I have 1-2 posting receiving help, and I am
following their suggestions. I welcome all suggestions.

Have any of you seen this before?

Warm Regards and as always Thanks,
T

Have you heard of an organized crime protection racket? This is similar.

Dealing with Unwanted Pop-ups
http://www.mvps.org/winhelp2002/nopopups.htm

In your other post you mention:

Save.exe:1620 UDP my200srv:1046 *:*

See:
http://www.winpatrol.com/db/freesample/save.html

WinPatrol is a great utility to use to detect things being installed on your
system. There is a free and a payware version.

 

[YoKenny]

Hi Taishi........This sounds like my son's experience. He clicked on
the link to download the free scanner, and it found spyware, alright.
It also wanted him to send money to remove it. Spyware Nuker, I
think it was. I told him to uninstall it, and get Spybot Search and
Destroy. It identified the Spyware Nuker as Malware, and got rid of
it, plus Gator and Gain which it also installed. Spybot S & D is
free. charlie R

Charlie, you have your Outlook Express set up strange.
Go to Tools >> Options >> Send >> Plain Text Settings >> and insure that
Indent the original with > is checked.

Spyware Nuker is not a good app to have.
http://camtech2000.net/Newsletters/a_new_spyware_tactic.htm
http://www.safer-networking.org/index.php?lang=en&page=news/news20030212

 

[charlie R]

Hi Taishi........This sounds like my son's experience. He clicked on the
link to download the free scanner, and it found spyware, alright. It also
wanted him to send money to remove it. Spyware Nuker, I think it was. I
told him to uninstall it, and get Spybot Search and Destroy. It identified
the Spyware Nuker as Malware, and got rid of it, plus Gator and Gain which
it also installed. Spybot S & D is free. charlie R
I just got home and found the following pop-up on my screen. I printscreen
it and placed it into word. If any of want to see it, I can e-mail it to
you. It says that it has detected spyware, and to click on the link to
receive free scanner that will locate and remove the program.

I am already paranoid. And I am working on my firewall and my
host(software) firewall. I have 1-2 posting receiving help, and I am
following their suggestions. I welcome all suggestions.

Have any of you seen this before?

Warm Regards and as always Thanks,
T

 

[Bill Sanderson]

Excellent advice, from practical experience--thanks!

 

[Vanguard]

You did NOT say that you had left your browser loaded. Sounds like you
are running an NT-based Windows (NT4, 2000, or XP) and have the NT
service "Messenger" running ... and that your firewall is not properly
configured.

http://support.microsoft.com/default.aspx?scid=kb;en-us;330904&Product=w
in2000

This tells how to disable the NT service. That only takes care of the
effect and not the cause. See the More Information section on what
ports to block for inbound connections (but your firewall should have
already stealthed these ports). Then head to http://grc.com and run his
Shield's Up test to see what other ports you have open.

 

[Bruce Chambers]

Greetings --

There are at least three varieties of pop-ups, and the solutions
vary accordingly. Which specific type(s) is troubling you?

1) Does the title bar of these pop-ups read "Messenger Service?"

This type of spam has become quite common over the past several
months, and unintentionally serves as a valid security "alert." It
demonstrates that you haven't been taking sufficient precautions while
connected to the Internet. Your data probably hasn't been compromised
by these specific advertisements, but if you're open to this exploit,
you may well be open to other threats, such as the Blaster Worm that
recently swept cross the Internet. Install and use a decent,
properly configured firewall. (Merely disabling the messenger
service, as some people recommend, only hides the symptom, and does
little or nothing to truly secure your machine.) And ignoring or just
"putting up with" the security gap represented by these messages is
particularly foolish.

Messenger Service of Windows
http://support.microsoft.com/default.aspx?scid=KB;en-us;168893

Messenger Service Window That Contains an Internet Advertisement
Appears
http://support.microsoft.com/?id=330904

Stopping Advertisements with Messenger Service Titles
http://www.microsoft.com/windowsxp/pro/using/howto/communicate/stopspam.asp

Blocking Ads, Parasites, and Hijackers with a Hosts File
http://www.mvps.org/winhelp2002/hosts.htm

Oh, and be especially wary of people who advise you to do nothing
more than disable the messenger service. Disabling the messenger
service, by itself, is a "head in the sand" approach to computer
security. The real problem is _not_ the messenger service pop-ups;
they're actually providing a useful, if annoying, service by acting as
a security alert. The true problem is the unsecured computer, and
you've been advised to merely turn off the warnings. How is this
helpful?

2) For regular Internet pop-ups, you might try the free 12Ghosts
Popup-killer from http://12ghosts.com/ghosts/popup.htm, Pop-Up Stopper
from http://www.panicware.com/, or the Google Toolbar from
http://toolbar.google.com/. Myself, I use Norton Internet Security,
which, in addition to containing Norton Anti-Virus and Personal
Firewall, also blocks many of the pop-up adds on the Internet.

3) To deal with pop-ups caused by any sort of "adware" and/or
"spyware,"such as Gator, Comet Cursors, Xupiter, Bonzai Buddy, or
KaZaA, and their remnants, that you've deliberately (but without
understanding the consequences) installed, two products that are
quite effective (at finding and removing this type of scumware) are
Ad-Aware from www.lavasoft.de and SpyBot Search & Destroy from
http://security.kolla.de/. Both have free versions. It's even
possible to use SpyBot Search & Destroy to "immunize" your system
against most future intrusions. I use both and generally perform
manual scans every week or so to clean out cookies, etc.


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH