So I've got a popup problem on my work computer...

[Jugernot]

Seems that I have gotten some virus/script installed on my computer that pops up porn ads throughout the day, even no active windows open. It'll be idling on the desktop and all the sudden a porn ad will popup.

Now normally I could deal with this on my computer, but this is my work computer. If someone were to walk by, they could get the wrong idea.

I ran Ad Aware and it found nothing... So now I'm stuck with an install of Win2k server that has porn builtin. (again, normally that could be a good thing... )

Any ideas of how I can find out how this script is working?

 

[amnesiac]

stop downloading pr0n and visiting warez sites at work.

 

[mrCide]

norton antivirus?

 

[BatmanNate]

That sick woman is getting back at you for exposing her ploys.

 

[Night201]

Do you have a virus scanner loaded? Sounds like it is spyware. What programs have you loaded on your computer. I'd make sure you have the latest build and definition file for AdAware and run it again.

 

[Jugernot]

Yep, Norton Corporate with the newest virus defs auto loaded.

Truthfully, I probably did get this from a crack site that I went to a few days ago... now I'm just trying to get rid of the damn thing.

 

[OutHouse]

Time to dig through the registry....

 

[Jugernot]

Originally posted by: Citrix
Time to dig through the registry....

I'd do that, but I'm not sure where to start looking...

 

[BmXStuD]

show us a screenshot with the bad parts edited so we call tell if its the "windows messager" which can be turned off by admin services.

 

[Greyd]

Try using spybot too - that usually digs some stuff up including registry items. Also, i'm wondering if this could be from netsend?

 

[Jugernot]

Originally posted by: BmXStuD
show us a screenshot with the bad parts edited so we call tell if its the "windows messager" which can be turned off by admin services.

It's definitely not the Messenger services. I disabled that long ago.... and btw, I am the network admin.

I"ve run several spyware detection programs so far nothing found! I've deleted all my cookies and temp internet files and I'll see what that does.

EDIT: These are just IE popups. Javascript being set off by something...

 

[DrPizza]

Try running msconfig and seeing if there's anything in the startup that might do it...

 

[Jugernot]

Originally posted by: DrPizza
Try running msconfig and seeing if there's anything in the startup that might do it...

Unfortunately that is a command only included with Win9x and XP... but I'll go download the version XP that can be used with Win2k.

 

[edmicman]

what processes are running? i've run across something called rapid blaster or something blaster that did the same sort of thing - stupid moron kids at a library i do support for were doing things they shouldn't have, and these IE windows would jsut pop up out of nowhere...never seen anything like it, but there was a process running in the background hidden that was doing it all.

 

[Jugernot]

BING BING BING, we have a winner... it was a file named rb32.exe that I found with msconfig. It was located in the c:\Program Files\rb32\rb32.exe... it was the only file in the folder. Did a quick search on google and found lots of places that said it was used for pr0n popups.

Thanks guys! I'm gonna have to put the XP version of msconfig on my driver CD for offsite calls.

 

[Ness]

I believe that is something that is installed when you install Kazaa. Or maybe that was another program... :-\