Am i being Ad-hacked?

[rky60]

At least twice a day, when i step away from my puter i'll come back to find this on my screen.

Pic

The colored out section is my IP. What's happening here?

Thanks for any info...

 

[LiLithTecH]

You may have to live with it the attacks for a while once they have your IP.
It can be stopped by Disabling Windows Messenger Service.

Read more here.

Spam Masquerades as Admin Alerts

 

[Slogun]

Also, run AdAware to make sure you don't have spyware in residence on your computer.

 

[rky60]

Thanks for the info Those things seem to know when i'm not around, only pop up when i walk away from the puter.

Ran Ad-Aware, was clean

 

[aircooled]

Are you using a firewall? You should be able to block this with ZoneAlarm or any other firewall software.

As stated previously, run ad-aware just to rule out any spyware....


You may want to change your IP address also.....

 

[MaestroQuark]

I thought Messaging Service could only run over a local network? Are you on a local network?

Okay, did a search, and it's just hacking at another MS Windows vulnerability:

http://www.itsecure.com.au/news/story.htm?StoryID=254

And another:

http://online.securityfocus.com/columnists/117

So if you block port 135 it looks like this thing might be stopped. Of course, if you don't use Windows Messenger anyway (we do here at school just as a fun little prank), keep it disabled.

 

[Slogun]

I just noticed that you blanked out your IP address.

That's kinda funny because your IP address is no more private than the license number on the plate of your car.

And the zonealarm's a good idea, I shoulda mentioned that. I use it religiously.

 

[Slogun]

Here is one way to uninstall windows messenger:

How can I remove Windows Messenger?

Open C:\WINDOWS\inf\sysoc.inf
(start, run, notepad c:\windows\inf\sysoc.inf)


and change
msmsgs=msgrocm.dll,OcEntry,msmsgs.inf,hide,7

to

msmsgs=msgrocm.dll,OcEntry,msmsgs.inf,7

Then use Add/Remove Windows Components to remove messenger.

 

[Miramonti]

cool. I knew people were doing this but its the first time I've seen it.

I'm surprised your firewall isn't blocking them tho.

 

[Smilin]

It's nothing to do with MSN messenger. It's a new spamming technique that takes advantage of the messenger service on your computer (no relation).

For an example of what's happening do this:

Start | run, then type:
NET SEND <YOUR PC NAME HERE> "Test message"

DO use the quotes, DONT use the <>

To quickly shut down the messenger service (this will have NO side effects btw): do start | run and type NET STOP MESSENGER

It will start again next reboot, to turn it off for good go to computer management then 'services', find the messenger service and change it's startup type from automatic to manual.

 

[bsobel]

Originally posted by: Slogun
I just noticed that you blanked out your IP address.
That's kinda funny because your IP address is no more private than the license number on the plate of your car.
And the zonealarm's a good idea, I shoulda mentioned that. I use it religiously.

Really, then what is the posters IP address?

Bill

 

[bsobel]

Originally posted by: RKYeager
At least twice a day, when i step away from my puter i'll come back to find this on my screen.
Pic
The colored out section is my IP. What's happening here?
Thanks for any info...

Known issue, it's not adware or anything local. A couple spam companies are now walking subnets hitting anyone with messenger service open. That, btw, means your not firewalled and could easily have drive or registry sharing enabled. Definately consider a hardware or software firewall (I use Norton Internet Security, but I work for Symantec).

Bill

 

[Slogun]

Originally posted by: bsobel

Originally posted by: Slogun
I just noticed that you blanked out your IP address.
That's kinda funny because your IP address is no more private than the license number on the plate of your car.
And the zonealarm's a good idea, I shoulda mentioned that. I use it religiously.

Really, then what is the posters IP address? Yea, thats what I thought....

Bill

Point is Billy, every website he visits has access to his IP addy.

 

[bsobel]

Point is Billy, every website he visits has access to his IP addy.

The point is that since he has the messenger service running and (I wouldn't be suprised to find) file sharing enabled, it would be horribly stupid to tell the 100k members here is current IP. Yes, every server he hits has access to his ip (DUH), but that is a rather small sample and the vast majority of the time those servers are completely legit. Displaying it here would cause at least some percentage of the 100k users to 'take a look' at his system, the risk/reward ratio is completely reversed in that scenario.

It's one thing to provide your ip to a server or be subject to to randomly scans/probes by automated tools, it's quite another to be specifically targeted by someone (or 99,999 someones) who knows what they are doing (don't worry, I'm not including you in that category.)

Since you you don't understand the security differences of those two scenarios, your not really in a position to comment on his obscuring his IP.

Here is one way to uninstall windows messenger:

The issue we are discussing has nothing *at all* to do with Windows Messenger. I suggest you learn something about internet security before you pipe back up.

Bill

 

[Slogun]

Your snobbery, Billy is a real boon to this forum.

I can see you really like to hear yourself talk.

You piped up with info on this thread that was already stated.

Too bad noone cares to listen.

 

[bsobel]

Originally posted by: Slogun
Your snobbery is a real boon to this forum.

Yep, when your out of facts, nothing is better than a personal attack. You forgot to misspell my name this time tho. Btw, why did you take your profile offline, it was there 2 minutes ago, but now it's gone?

Bill

edit:

Your snobbery, Billy is a real boon to this forum

Oh, you edited your post to include it, well done, that should prove your point nicely.

 

[Slogun]

You, BILLY, my friend are the one who started a tone here.

What started as a discussion thread, was commandeered by a guy who just likes to hear himself spout off and belittle others.

As I said before BILLY, you're a real boon to AT.

 

[bsobel]

Originally posted by: Slogun
You, BILLY, my friend are the one who started a tone here.
What started as a discussion thread, was commandeered by a guy who just likes to hear himself spout off and belittle others.
As I said before BILLY, you're a real boon to AT.

You really really hate to be wrong don't you? You posted something incorrect and where called on it, you'll get over it. It (honestly) wasn't meant as a personal attack. Now, since we *both* are now adding little of value to the thread, how about we call a truce or take this to private messages (presuming you have something else to add?)

Bill

 

[Slogun]

 

[Slogun]

 

[Slogun]

 

[Slogun]

 

[Slogun]

 

[Slogun]

Originally posted by: bsobel

Originally posted by: Slogun
You, BILLY, my friend are the one who started a tone here.
What started as a discussion thread, was commandeered by a guy who just likes to hear himself spout off and belittle others.
As I said before BILLY, you're a real boon to AT.

You really really hate to be wrong don't you? You posted something incorrect and where called on it, you'll get over it. It (honestly) wasn't meant as a personal attack. Now, since we *both* are now adding little of value to the thread, how about we call a truce or take this to private messages (presuming you have something else to add?)

Bill

Wow, you do love to quote me , don't you.

Hah, no you're wrong if you think I feel that you corrected me. I do view IP addresses as a rather public item.

I just take exception to your snobbish attitude on what should be a friendly forum.

 

[Slogun]

Wow, you do love to quote me , don't you.

Hah, you called me on something incorrect I posted did you. No, I merely stated my opinion that IP adresses are not particularly private.

You obviously are the one who takes himself much too seriously and hence can't stand to be contradicted and must always get the last word.

Billy, you're just projecting, and being from California I will assume you know what that means.

I just take exception to your snobbish attitude on what should be a friendly forum.

You "didn't intend a personal attack?" You're just an abrasive, obnoxious flamer and it's sad that you don't even know you are doing it. Keep it up and let the AT community see you for what you are.

Maybe you'll win yourself an AT vacation and you can just go back to your Symantec cubucle where you don't have to interact with people.

The rest of the AT community will be much better off not being subjected to your thoroughly condescending attitude.

BTW, this will the last time I look here and my last post on this, unless you pull this crap with me in another thread.