I keep getting these popups.  It started about an hour ago and it won't stop.  I've gotten about 30 of them.  I don't know what it means, or if I can trust it.  I just got my computer a few days ago.  I did have to install XP because it came without an operating system, if that means anything.

you have to turn off messing service...I can't remember how to do it

Quoted: you have to turn off messing service...I can't remember how to do it

It's a type spyware.  Haven't found much about it though.

control panel -> administrative tools -> services

Turn off the messenger service.  IN no case do what those popups tell you to do.

http://www.microsoft.com/windowsxp/using/security/learnmore/stopspam.mspx

Did you notice the misspelling in the warnings? I suspect you've been bit by spyware / malware / adware. WHatever you do, don't download anything from that site until you know whats going on.

Also found this thread.

www.annoyances.org/exec/forum/winxp/1134389135

I would also suggest going to microsoft.com and downloading the anit-spyware beta.

Quoted: Quoted: you have to turn off messing service...I can't remember how to do it It's a type spyware.  Haven't found much about it though.

It's actually a "feature" in XP/NT that allows admins to send you messages.

jkstexas2001 has the right fix.

Quoted: Quoted: Quoted: you have to turn off messing service...I can't remember how to do it It's a type spyware.  Haven't found much about it though. It's actually a "feature" in XP/NT that allows admins to send you messages. jkstexas2001 has the right fix.

I know the messaging is a feature in XP/2000 but, this is an exploit Spyware is using of that messaging service.

My view is to fix the problem, instead of just turning the service off - kinda like putting a bandaid on a serated artery, sure it'll stop the bleeding for a minute but doesn't solve the problem.  

Quoted: control panel -> administrative tools -> services Turn off the messenger service.  IN no case do what those popups tell you to do.

Oh, don't worry, I'm very wary of any kind of popups.  I noticed that there was no mention of Microsoft, and there were several different URLs mentioned, and that the look of it simply did not look professional.

But these popups were strange because they did not pop up when IE was open, which other popups do, there were very many of them, and they stayed on top of the desktop.  I also couldn't find any suspicious programs in the processes list.

It's an adware thing. Why would a popup be giving you a URL other than microsoft's?

Quoted: Quoted: Quoted: Quoted: you have to turn off messing service...I can't remember how to do it It's a type spyware.  Haven't found much about it though. It's actually a "feature" in XP/NT that allows admins to send you messages. jkstexas2001 has the right fix. I know the messaging is a feature in XP/2000 but, this is an exploit Spyware is using of that messaging service. My view is to fix the problem, instead of just turning the service off - kinda like putting a bandaid on a serated artery, sure it'll stop the bleeding for a minute but doesn't solve the problem.

You are 100 percent incorrect.  It is not spyware.  It is a computer taking advantage of the Messenger Service running on the man's machine, causing messages to pop up.  Once he disables messenger, the problem is solved.  Your advice is dangerous, and you clearly need to learn more about windows.

it tells you to vist there url to fix it dont do it, its not an important pop up they want you to down load there stuff and fix it, i imagine there is nothing wrong with your comp you just have ad ware stuff downloaded on your comp find it and delete it

Quoted: You are 100 percent incorrect.  It is not spyware.  It is a computer taking advantage of the Messenger Service running on the man's machine, causing messages to pop up.  Once he disables messenger, the problem is solved.  Your advice is dangerous, and you clearly need to learn more about windows.

Wait, it's not spyware, it's just a program that misuses the messaging system?  Doesn't that mean that it IS spyware or some kind of similar program?

Or is it someone actively hacking into my computer?

Quoted: it tells you to vist there url to fix it dont do it, its not an important pop up they want you to down load there stuff and fix it, i imagine there is nothing wrong with your comp you just have ad ware stuff downloaded on your comp find it and delete it

Again, he has NOT downloaded anything.  Anyone can make those messages pop up on a remote computer if the messenger service is running.

Quoted: Quoted: You are 100 percent incorrect.  It is not spyware.  It is a computer taking advantage of the Messenger Service running on the man's machine, causing messages to pop up.  Once he disables messenger, the problem is solved.  Your advice is dangerous, and you clearly need to learn more about windows. Wait, it's not spyware, it's just a program that misuses the messaging system?  Doesn't that mean that it IS spyware or some kind of similar program?

No.  It is a feature built into windows that is turned on by default.  It is so network administrators can send you a message such as "The main printer is now back up and running".  Unfortunately, spyware companies take advantage of this service being turned on to trick people into thinking that their systems have computer problems and into going to a site and downloading REAL spyware.  If you turn off the service, the problem is solved.  There is nothing wrong with your system, other than the service being turned on.

Quoted: Quoted: Quoted: You are 100 percent incorrect.  It is not spyware.  It is a computer taking advantage of the Messenger Service running on the man's machine, causing messages to pop up.  Once he disables messenger, the problem is solved.  Your advice is dangerous, and you clearly need to learn more about windows. Wait, it's not spyware, it's just a program that misuses the messaging system?  Doesn't that mean that it IS spyware or some kind of similar program? No.  It is a feature built into windows that is turned on by default.  It is so network administrators can send you a message such as "The main printer is now back up and running".  Unfortunately, spyware companies take advantage of this service being turned on to trick people into thinking that their systems have computer problems and into going to a site and downloading REAL spyware.  If you turn off the service, the problem is solved.  There is nothing wrong with your system, other than the service being turned on.

It's spyware. Look in the second message - "YOUR WINDOWS REGISTRY IS DAMANGED..."

Windows doesn't have any misspellings in their error messages IIRC.

if you want to see what this "exploit" is doing you can use your security software to see all of the port scans that you're getting. The ones that scan UDP ports 135, 137, and 138 and TCP ports 135, 139, and 445 are looking to see if you have the messenger service on.

it's not spyware b/c it's not installing anything on your machine. It's harmless but annoying.

Quoted: [ You are 100 percent incorrect.  It is not spyware.  It is a computer taking advantage of the Messenger Service running on the man's machine, causing messages to pop up.  Once he disables messenger, the problem is solved.  Your advice is dangerous, and you clearly need to learn more about windows.

That's funny. My advice is dangerous to SCAN a computer to make sure it doesn't have spyware/adware.

He needs a firewall for sure, but what's dangerous about microsoft's anti-spyware?

Quoted: Quoted: Quoted: Quoted: You are 100 percent incorrect.  It is not spyware.  It is a computer taking advantage of the Messenger Service running on the man's machine, causing messages to pop up.  Once he disables messenger, the problem is solved.  Your advice is dangerous, and you clearly need to learn more about windows. Wait, it's not spyware, it's just a program that misuses the messaging system?  Doesn't that mean that it IS spyware or some kind of similar program? No.  It is a feature built into windows that is turned on by default.  It is so network administrators can send you a message such as "The main printer is now back up and running".  Unfortunately, spyware companies take advantage of this service being turned on to trick people into thinking that their systems have computer problems and into going to a site and downloading REAL spyware.  If you turn off the service, the problem is solved.  There is nothing wrong with your system, other than the service being turned on. It's spyware. Look in the second message - "YOUR WINDOWS REGISTRY IS DAMANGED..." Windows doesn't have any misspellings in their error messages IIRC.

ITS NOT FUCKING SPYWARE!!
Its exactly as jkstexas is describing it.  Simply turn it off and you are good.

Quoted: Quoted: [ You are 100 percent incorrect.  It is not spyware.  It is a computer taking advantage of the Messenger Service running on the man's machine, causing messages to pop up.  Once he disables messenger, the problem is solved.  Your advice is dangerous, and you clearly need to learn more about windows. That's funny. My advice is dangerous to SCAN a computer to make sure it doesn't have spyware/adware. He needs a firewall for sure, but what's dangerous about microsoft's anti-spyware?

He is not saying that you shouldn't run anti-spyware programs on your computer, he is merely saying that this particular problem IS NOT SPYWARE...

Quoted: Quoted: Quoted: [ You are 100 percent incorrect.  It is not spyware.  It is a computer taking advantage of the Messenger Service running on the man's machine, causing messages to pop up.  Once he disables messenger, the problem is solved.  Your advice is dangerous, and you clearly need to learn more about windows. That's funny. My advice is dangerous to SCAN a computer to make sure it doesn't have spyware/adware. He needs a firewall for sure, but what's dangerous about microsoft's anti-spyware? He is not saying that you shouldn't run anti-spyware programs on your computer, he is merely saying that this particular problem IS NOT SPYWARE...

No, no... he clearly said my advice was dangerous.  No need to install anti-spyware programs since I don't know jack shit about Windows apparantely.

good lord people calm down, its just a pop up just close it out. is that ok to do?/ or will i get bitched at for being wrong??

Quoted: Quoted: Quoted: Quoted: [ You are 100 percent incorrect.  It is not spyware.  It is a computer taking advantage of the Messenger Service running on the man's machine, causing messages to pop up.  Once he disables messenger, the problem is solved.  Your advice is dangerous, and you clearly need to learn more about windows. That's funny. My advice is dangerous to SCAN a computer to make sure it doesn't have spyware/adware. He needs a firewall for sure, but what's dangerous about microsoft's anti-spyware? He is not saying that you shouldn't run anti-spyware programs on your computer, he is merely saying that this particular problem IS NOT SPYWARE... No, no... he clearly said my advice was dangerous.  No need to install anti-spyware programs since I don't know jack shit about Windows apparantely.

Your advice WAS wrong.  He never said anything against running anti-spyware programs on your computer.  You, however, claimed that this problem IS spyware, which it is not, and told the OP that he needed to do something other than just turning the service off, and compared it to putting a band-aid on a wound rather than treating the problem.  In this case, turning the service off does solve the problem.  The particular problems the OP is having have nothing to do with spyware on his computer.

Quoted: good lord people calm down, its just a pop up just close it out. is that ok to do?/ or will i get bitched at for being wrong??

GODDAMMIT OPEN YOUR EARS. IT"S NOT A POP UP.

Quoted: Your advice WAS wrong.  He never said anything against running anti-spyware programs on your computer.  You, however, claimed that this problem IS spyware, which it is not, and told the OP that he needed to do something other than just turning the service off, and compared it to putting a band-aid on a wound rather than treating the problem.  In this case, turning the service off does solve the problem.  The particular problems the OP is having have nothing to do with spyware on his computer.

My advice was to find the root of the problem.  Ok I admit I was wrong calling it spyware.  But the root of the problem needs to be found - why is the service being opened like that?  Well it uses the windows messaging service over the net it seems.  Well the fix would be to buy a firewall and shut the ports down to traffic like that... hmm... He may need that service  installed for some reason, I don't know what the setup is.

Quoted: Quoted: Quoted: Quoted: Quoted: [ You are 100 percent incorrect.  It is not spyware.  It is a computer taking advantage of the Messenger Service running on the man's machine, causing messages to pop up.  Once he disables messenger, the problem is solved.  Your advice is dangerous, and you clearly need to learn more about windows. That's funny. My advice is dangerous to SCAN a computer to make sure it doesn't have spyware/adware. He needs a firewall for sure, but what's dangerous about microsoft's anti-spyware? He is not saying that you shouldn't run anti-spyware programs on your computer, he is merely saying that this particular problem IS NOT SPYWARE... No, no... he clearly said my advice was dangerous.  No need to install anti-spyware programs since I don't know jack shit about Windows apparantely. Your advice WAS wrong.  He never said anything against running anti-spyware programs on your computer.  You, however, claimed that this problem IS spyware, which it is not, and told the OP that he needed to do something other than just turning the service off, and compared it to putting a band-aid on a wound rather than treating the problem.  In this case, turning the service off does solve the problem.  The particular problems the OP is having have nothing to do with spyware on his computer.

How do they find your pc to send the messages to your machine?

You can figure out how to post pictures here, but can't get rid of spyware? Fargin rookie.

port scan, I think.

You can have a spyware and virus-free machine and get these messages.

In fact, you can be disconnected from the internet and get these.

Quoted: Quoted: Your advice WAS wrong.  He never said anything against running anti-spyware programs on your computer.  You, however, claimed that this problem IS spyware, which it is not, and told the OP that he needed to do something other than just turning the service off, and compared it to putting a band-aid on a wound rather than treating the problem.  In this case, turning the service off does solve the problem.  The particular problems the OP is having have nothing to do with spyware on his computer. My advice was to find the root of the problem.  Ok I admit I was wrong calling it spyware.  But the root of the problem needs to be found - why is the service being opened like that?  Well it uses the windows messaging service over the net it seems.  Well the fix would be to buy a firewall and shut the ports down to traffic like that... hmm... He may need that service  installed for some reason, I don't know what the setup is.

Unfortunately, Bill Gates decided to have that service turned on by default.  I always turn it off when I get a new system.  Having a firewall is also a good idea.

Quoted: Quoted: Quoted: Quoted: Quoted: Quoted: [ You are 100 percent incorrect.  It is not spyware.  It is a computer taking advantage of the Messenger Service running on the man's machine, causing messages to pop up.  Once he disables messenger, the problem is solved.  Your advice is dangerous, and you clearly need to learn more about windows. That's funny. My advice is dangerous to SCAN a computer to make sure it doesn't have spyware/adware. He needs a firewall for sure, but what's dangerous about microsoft's anti-spyware? He is not saying that you shouldn't run anti-spyware programs on your computer, he is merely saying that this particular problem IS NOT SPYWARE... No, no... he clearly said my advice was dangerous.  No need to install anti-spyware programs since I don't know jack shit about Windows apparantely. Your advice WAS wrong.  He never said anything against running anti-spyware programs on your computer.  You, however, claimed that this problem IS spyware, which it is not, and told the OP that he needed to do something other than just turning the service off, and compared it to putting a band-aid on a wound rather than treating the problem.  In this case, turning the service off does solve the problem.  The particular problems the OP is having have nothing to do with spyware on his computer. How do they find your pc to send the messages to your machine?

They can obtain lists of IP addresses of systems running Windows with a number of tools,  then they feed the list into the system that sends messages.

Quoted: Quoted: ... He may need that service  installed for some reason. Only if he's on a LAN and that service is required to be enabled by his network administrator. But then he would be asking his network administrator and not ARFCOM now wouldn't he? There are no devices dependent on that service being on. It's a security hole enabled by default. Again, jkstexas2001 is right, just disable it.

There is no reason to have the service running.  Sys admins, at least where I work, send out emails about upcoming outages, etc.  It is a throwback to the early 90's computing.  I remember back then, wnen running a DOS based system on a Novell network, you would occasionally get a message on the bottom of your screen from the Admin, saying that they were taking down a server.  It really serves no purpose these days.

Quoted: I keep getting these popups.  It started about an hour ago and it won't stop.  I've gotten about 30 of them.  I don't know what it means, or if I can trust it.  I just got my computer a few days ago.  I did have to install XP because it came without an operating system, if that means anything. www.users.muohio.edu/cliftojd/pics/warning.jpg www.users.muohio.edu/cliftojd/pics/warning2.jpg www.users.muohio.edu/cliftojd/pics/warning3.jpg

You're in for a ride.  I had a similar situation with malware called "PSGuard" that disguised itself as McAffee software.  Finally got rid of it antiviris from SBC/Yahoo.

Quoted: Quoted: I keep getting these popups.  It started about an hour ago and it won't stop.  I've gotten about 30 of them.  I don't know what it means, or if I can trust it.  I just got my computer a few days ago.  I did have to install XP because it came without an operating system, if that means anything. www.users.muohio.edu/cliftojd/pics/warning.jpg www.users.muohio.edu/cliftojd/pics/warning2.jpg www.users.muohio.edu/cliftojd/pics/warning3.jpg You're in for a ride.  I had a similar situation with malware called "PSGuard" that disguised itself as McAffee software.  Finally got rid of it antiviris from SBC/Yahoo.

or, he could just disable the messenger service. I thought we resolved this.

Quoted: or, he could just disable the messenger service. I thought we resolved this.

What did he do and did it work? Or, is it because you said so?

Quoted: Quoted: I keep getting these popups.  It started about an hour ago and it won't stop.  I've gotten about 30 of them.  I don't know what it means, or if I can trust it.  I just got my computer a few days ago.  I did have to install XP because it came without an operating system, if that means anything. www.users.muohio.edu/cliftojd/pics/warning.jpg www.users.muohio.edu/cliftojd/pics/warning2.jpg www.users.muohio.edu/cliftojd/pics/warning3.jpg You're in for a ride.  I had a similar situation with malware called "PSGuard" that disguised itself as McAffee software.  Finally got rid of it antiviris from SBC/Yahoo.

That is not the case here.  Note the word Messenger Service on the top of each window, not McAfee.

Quoted: Quoted: or, he could just disable the messenger service. I thought we resolved this. What did he do and did it work? Or, is it because you said so?

Well, I have been working with Microsoft Operating Systems since 1981.  I am familiar with DOS 2.0 (the one with the beige manual, the version where subdirectories were introduced). I was a beta tester for Windows 3.1.  I have worked with OS/2 2.1 and OS/2 Warp.  I was a beta tester for Windows NT.  I could go on, but I won't.  What I told him is the right way to go here.

Quoted: Quoted: or, he could just disable the messenger service. I thought we resolved this. What did he do and did it work? Or, is it because you said so?

Based upon what he posted (new computer, just installed XP...plus the screenshots) I'm 100% certain that windows messenger service is the cause.

Have you not turned off messenger service on your machine?

Quoted: Have you not turned off messenger service on your machine?

Yep.  I even looked it up: it was a virus.  Pop-up from hell, and a resource hog.  

Aren't yall even remotely thinking its a virus and not something from MS?  look at where/what it wants you to go.

jkstexas2001  got this one  

from lavasofts web page :


Beginning with Windows NT, Microsoft included the Windows Messenger Service, and it's been built-in to each subsequent version and release of Windows over the past several years. It was originally designed to allow system administrators on client-server networks to send out brief system-wide messages to everyone connected to the network. For the most part, it's never gained much use since there are easier alternatives to sending such messages.

It is being put to use however, by those who know that this Service is turned on by default in all current versions of Windows. If you've been connected to the Internet and suddenly see a window pop-up filled with information about the latest "get-rich-scheme," a college diploma, or low-rate credit cards, you're being spammed courtesy of Windows Messenger Service! Note that these are not browser windows, but resemble Windows Dialog boxes (with "Messenger Service" in the title bar), with the exception that you're generally offered no "options" besides clicking an "OK" button.

Windows Messenger Service is an Internet server that's up and running on your machine, leaving it open to anyone who wants to connect to it when you're online. Unlike annoying browser pop-ups, which only show up if Internet Explorer or another browser is running, spam utilizing Windows Messenger Service can be received no matter what application you mightbe using, as long as you're connected to the Internet.

For the typical user, having Messenger Service running opens an unnecessary "back door" that can compromise system security and which can be shut and locked tight easily. On October 15th of this year, Microsoft released Security Bulletin MS03-043 which outlines potential ways malicious programmers can exploit a flaw in the Messenger Service using buffer overflows to take control of your system. According to Microsoft, "An attacker who successfully exploited this vulnerability could be able to run code with Local System privileges on an affected system, or could cause the Messenger Service to fail. The attacker could then take any action on the system, including installing programs, viewing, changing or deleting data, or creating new accounts with full privileges." At this point, there are no known examples of malware taking advantage of this loophole, but it's almost certain that as this problem becomes more well known, attacks on systems vulnerable to this threat will occur.

Turning off Windows Messenger Service also has the added benefit of freeing up a little extra RAM and CPU cycles. If for no other reason than to shut off spam it's worth the few seconds it takes to turn it off.

Unfortunately, just as there are people ready and willing to exploit system flaws with malevolent intent, there are also those geared-up to sell you a program to take care of the problem. A quick check of any search engine or shareware site will turn up dozens, ranging in price from a few dollars to nearly $30 US. One site that sells the software to generate Messenger spam even tells you how to keep it from affecting your computer!

Although you can do it yourself by wading through some menus and options turning off Windows Messenger Service, using Lavasoft's Messenger-Control add-on for Ad-Aware is a simpler option. All you need to do is download the add-on. Then extract and run the installation executable, which will put the add-on in the correct folder. After that you just run Ad-Aware, click the "Add-ons" button, and double click on Messenger-Control. Select "Disable Messenger," and the Service will be shut down. Should you ever need to restore it, follow the same directions and click "Enable Messenger".

If you're using a standalone machine not connected to a LAN, you can generally turn off Windows Messenger Service with no problems, although there are some programs that make legitimate use of the Service. Those connected to a local area network will want to contact their system administrator first just in case they make use of it.

Also, shutting off Windows Messenger Service will have no effect on any of the popular "instant messaging" systems you might be using; they don't rely on Windows Messenger Service (irrespective of its name) to function.

Search for help on "Messenger Service". From there you will get instructions on how to disable it. I don't know wich OS you have so I can't realy give more specific instructions.

actually if the original poster would go to www.windowsupdate.com and downloads all of MS Windows updates, this will generally fix the issue.  An update will fix it.  I would bet he is only at Windows SP 1 right now.

Quoted: actually if the original poster would go to www.windowsupdate.com and downloads all of MS Windows updates, this will generally fix the issue.  An update will fix it.  I would bet he is only at Windows SP 1 right now.

excellent point.    

Quoted: Quoted: Have you not turned off messenger service on your machine? Yep.  I even looked it up: it was a virus.  Pop-up from hell, and a resource hog.   Aren't yall even remotely thinking its a virus and not something from MS?  look at where/what it wants you to go.

i give up

Quoted: Quoted: Quoted: Have you not turned off messenger service on your machine? Yep.  I even looked it up: it was a virus.  Pop-up from hell, and a resource hog.   Aren't yall even remotely thinking its a virus and not something from MS?  look at where/what it wants you to go. i give up

lol,   sometimes you just have to turn the other way  

Quoted: Quoted: Quoted: Have you not turned off messenger service on your machine? Yep.  I even looked it up: it was a virus.  Pop-up from hell, and a resource hog.   Aren't yall even remotely thinking its a virus and not something from MS?  look at where/what it wants you to go. i give up

Download "Shoot the Messenger", run it and shut messenger off.

www.grc.com/stm/shootthemessenger.htm

Oh yea, stop surfing the Russian pron!!

Greenhorn, have you updated Windows XP fully?  

Quoted: Greenhorn, have you updated Windows XP fully?

I did a few hours ago, and I haven't had a problem since.