What would cause spam to just pop up on the screen

[f/f george]

I am connected to a router but do not have IE open, or any other
program. Pop ups ads keep poppping up to the screen. I have XP Home
w/SP2 and windows messaging is disabled.
I run a spam removal program every other day and it always finds lots
of spam, I also run an antivirus program.
I can just turn on the computer and up pops the spam, sometimes not
even waiting for the computer to finish loading! I am going to rebuild
the computer in a few weeks but would like to know what is causing the
problem. I have 2 other computers on the same router but it does not
happen on them.

 

[Bruce Chambers]

I am connected to a router but do not have IE open, or any other
program. Pop ups ads keep poppping up to the screen. I have XP Home
w/SP2 and windows messaging is disabled.
I run a spam removal program every other day and it always finds
lots
of spam, I also run an antivirus program.
I can just turn on the computer and up pops the spam, sometimes not
even waiting for the computer to finish loading! I am going to
rebuild
the computer in a few weeks but would like to know what is causing
the
problem. I have 2 other computers on the same router but it does not
happen on them.

What specific kind of pop-ups are you seeing? There are at least
three varieties of pop-ups, and the solutions vary accordingly.

1) Does the title bar of these pop-ups read "Messenger Service?"

This type of spam has become quite common over the couple of
years, and unintentionally serves as a valid security "alert." It
demonstrates that you haven't been taking sufficient precautions while
connected to the Internet. Your data probably hasn't been compromised
by these specific advertisements, but if you're open to this exploit,
you may well be open to other threats, such as the Blaster Worm that
swept across the Internet last year and the currently active Sasser
Worm. Install and use a decent, properly configured firewall.
(Merely disabling the messenger service, as some people recommend,
only hides the symptom, and does little or nothing to truly secure
your machine.) And ignoring or just "putting up with" the security
gap represented by these messages is particularly foolish.

Messenger Service of Windows
http://support.microsoft.com/default.aspx?scid=KB;en-us;168893

Messenger Service Window That Contains an Internet Advertisement
Appears
http://support.microsoft.com/?id=330904

Stopping Advertisements with Messenger Service Titles
http://www.microsoft.com/windowsxp/pro/using/howto/communicate/stopspam.asp

Blocking Ads, Parasites, and Hijackers with a Hosts File
http://www.mvps.org/winhelp2002/hosts.htm

Oh, and be especially wary of people who advise you to do nothing
more than disable the messenger service. Disabling the messenger
service, by itself, is a "head in the sand" approach to computer
security. The real problem is not the messenger service pop-ups;
they're actually providing a useful, if annoying, service by acting as
a security alert. The true problem is the unsecured computer, and
you've been advised to merely turn off the warnings. How is this
helpful?

2) For regular Internet pop-ups, you might try the free 12Ghosts
Popup-killer from http://12ghosts.com/ghosts/popup.htm, Pop-Up Stopper
from http://www.panicware.com/, or the Google Toolbar from
http://toolbar.google.com/. Alternatively, you can upgrade your WinXP
to SP2, to install IE's pop-up blocker. Another alternative would be
to use another browser, such as Mozilla or Firefox, which has pop-up
blocking capabilities. (But I'd avoid Netscape; it carries too much
extraneous AOL garbage.)

3) To deal with pop-ups caused by any sort of "adware" and/or
"spyware,"such as Gator, Comet Cursors, Xupiter, Bonzai Buddy, or
KaZaA, and their remnants, that you've deliberately (but without
understanding the consequences) installed, two products that are
quite effective (at finding and removing this type of scumware) are
Ad-Aware from www.lavasoft.de and SpyBot Search & Destroy from
www.safer-networking.org/. Both have free versions. It's even
possible to use SpyBot Search & Destroy to "immunize" your system
against most future intrusions. I use both and generally perform
manual scans every week or so to clean out cookies, etc.

Additionally, manual removal instructions for the most common
varieties of scumware are available here:

PC Hell Spyware and Adware Removal Help
http://www.pchell.com/support/spyware.shtml

More information and assistance is available at these sites:

Blocking Ads, Parasites, and Hijackers with a Hosts File
http://www.mvps.org/winhelp2002/hosts.htm

The Parasite Fight
http://www.aumha.org/a/parasite.htm

--

Bruce Chambers

Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having
both at once. - RAH

 

[Rob Stow]

I am connected to a router but do not have IE open, or any other
program. Pop ups ads keep poppping up to the screen. I have XP Home
w/SP2 and windows messaging is disabled.
I run a spam removal program every other day and it always finds lots
of spam, I also run an antivirus program.
I can just turn on the computer and up pops the spam, sometimes not
even waiting for the computer to finish loading! I am going to rebuild
the computer in a few weeks but would like to know what is causing the
problem. I have 2 other computers on the same router but it does not
happen on them.

You've been infected by adware.

Download and run the latest versions of AdAware (by LavaSoft)
and SpyBot. There are a few adware and spyware apps they can't
remove, but between the two of them they take care of the
overwhelming majority of such apps.

 

[Dave Patrick]

Page not found!

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| BOYCOTT GOOGLE !
| Partners in crime with the scum that rules China.
| http://www.cnn.com/2004/TECH/internet/09/27/google.china.ap/

 

[Rob Stow]

Dave Patrick wrote:

Page not found!


CNN usually keeps articles available for years.
The fact that the article linked to by my sig file has been completely
removed after only a month makes me wonder if some coward
at CNN caved in to pressure from either Google or the Chinese
government.

As an alternative, using Yahoo to search for
    google china censor search
turns several relevant hits on the first page
of the search results:  Click here to do that search

Guess I'll have to modify the sig file.


-- BOYCOTT GOOGLE ! Partners in crime with the scum that rules China. http://www.cnn.com/2004/TECH/internet/09/27/google.china.ap/

 

[Guest]

It certainly sounds like adware of some sort. In addition to what everyone
else has said, do this

1. If running XP get SP2. It gives you a firewall which stops incoming
attacks. However it does not prevent any outgoing traffic.
OR
Get ZoneAlarm Pro. This stops traffic both ways and makes your computer
invisible to the outside world.
2. Use the policy editor to prevent MSN messenger running at startup.
3. Get Spysweeper or some other adware remover. Run it every week.
4. Get a good virus checker and keep the virus definitions up to date.
5. To see if you have Gator/Gain, look in the startup group for GMT. Remove
it. Reboot. Use add/remove programs to uninstall the various Gator
components. Use explorer to remove the remnants. You probably got it by
clicking on an ad saying "Is your computer clock running slow".

 

[Eugene Byelyakov]

As I found, there are several programs that won't be killed by
AdAware, SpyBot and so on. I don't know why but fact is fact.

Here is my method I use after my wife uses free mp3 search engines.

1. Run AdAware to clean-up known crap.
2. Check WINNT\Downloaded Program Files folder (see properties for
each suspicious element end remove)
3. Then check DLL injection hack as well as processes. To do this:
3.1. Go to www.sysinternals.com and download Process Explorer (it is
free)
3.2. Run it and check list of processes that are run. Sure, you should
have good knowledge of generic Windows and related processes. Do not
forget to turn view to display loaded DLLs. Check suspicious processes
(doubleclick and have a look on different tabs) properties. Sometime
you can find some crap like "admodule" blah..
3.2.1 As soon as you found some crap check registry to find where it
is being run from (as well as it can be started from Startup folder on
Start menu)
3.2.2 Remove references to that process, kill it from processes list
3.3. Check every DLL that is run by InternetExplorer, Explorer process
(these are two main targets, but onetime I found that Notepad was
injected).
This procedure is quite easy -- scroll down DLL list -- most of them
will have manufacturer name (Microsoft, Adobe and so on) -- give
special care for unbranded ones -- doubleclick and see where this file
resides. Then, again play with Regedit.

Having this practice I was able to catch and kill several pieces of
crap. I used before to send my reports to Lavasoft guys (AdAware) but
stopped because they do not seem to be able to say something in
response.

So, just as reminder - you should realise that operations provided
above require some level of technical knowledge and incorrect usage
can kill your PC. So if you decide to proceed with described, you
should do it on your own risk.

Good luck

 

[f/f george]

What specific kind of pop-ups are you seeing? There are at least
three varieties of pop-ups, and the solutions vary accordingly.

1) Does the title bar of these pop-ups read "Messenger Service?"

No it just has the title of whatever pop up it is.

This type of spam has become quite common over the couple of
years, and unintentionally serves as a valid security "alert." It
demonstrates that you haven't been taking sufficient precautions while
connected to the Internet. Your data probably hasn't been compromised
by these specific advertisements, but if you're open to this exploit,
you may well be open to other threats, such as the Blaster Worm that
swept across the Internet last year and the currently active Sasser
Worm. Install and use a decent, properly configured firewall.
(Merely disabling the messenger service, as some people recommend,
only hides the symptom, and does little or nothing to truly secure
your machine.) And ignoring or just "putting up with" the security
gap represented by these messages is particularly foolish.

Messenger Service of Windows
http://support.microsoft.com/default.aspx?scid=KB;en-us;168893

Messenger Service Window That Contains an Internet Advertisement
Appears
http://support.microsoft.com/?id=330904

Stopping Advertisements with Messenger Service Titles
http://www.microsoft.com/windowsxp/pro/using/howto/communicate/stopspam.asp

Blocking Ads, Parasites, and Hijackers with a Hosts File
http://www.mvps.org/winhelp2002/hosts.htm

Oh, and be especially wary of people who advise you to do nothing
more than disable the messenger service. Disabling the messenger
service, by itself, is a "head in the sand" approach to computer
security. The real problem is not the messenger service pop-ups;
they're actually providing a useful, if annoying, service by acting as
a security alert. The true problem is the unsecured computer, and
you've been advised to merely turn off the warnings. How is this
helpful?

2) For regular Internet pop-ups, you might try the free 12Ghosts
Popup-killer from http://12ghosts.com/ghosts/popup.htm, Pop-Up Stopper
from http://www.panicware.com/, or the Google Toolbar from
http://toolbar.google.com/. Alternatively, you can upgrade your WinXP
to SP2, to install IE's pop-up blocker. Another alternative would be
to use another browser, such as Mozilla or Firefox, which has pop-up
blocking capabilities. (But I'd avoid Netscape; it carries too much
extraneous AOL garbage.)

3) To deal with pop-ups caused by any sort of "adware" and/or
"spyware,"such as Gator, Comet Cursors, Xupiter, Bonzai Buddy, or
KaZaA, and their remnants, that you've deliberately (but without
understanding the consequences) installed, two products that are
quite effective (at finding and removing this type of scumware) are
Ad-Aware from www.lavasoft.de and SpyBot Search & Destroy from
www.safer-networking.org/. Both have free versions. It's even
possible to use SpyBot Search & Destroy to "immunize" your system
against most future intrusions. I use both and generally perform
manual scans every week or so to clean out cookies, etc.

Additionally, manual removal instructions for the most common
varieties of scumware are available here:

PC Hell Spyware and Adware Removal Help
http://www.pchell.com/support/spyware.shtml

More information and assistance is available at these sites:

Blocking Ads, Parasites, and Hijackers with a Hosts File
http://www.mvps.org/winhelp2002/hosts.htm

The Parasite Fight
http://www.aumha.org/a/parasite.htm

I will try some of the links and see what I can come up with. I am
also thinking of installing Zone Alarm and just stopping EVERYTHING,
and then adjust as necessary.