Re: Strange Application popup

From: Karl Levinson [x y] mvp (levinson_k_at_despammed.com)
Date: 12/17/03 

Date: Wed, 17 Dec 2003 07:35:45 -0500

Well, in that case, something generated an application pop-up, and if it
wasn't messenger, I would have to next suspect it's a piece of software
installed on the computer. Try looking in task manager for any processes
you can't identify. Searching the hard drives for any files that have
changed in the past one to three days and looking for suspicious ones might
be helpful, as might using the free SIM from www.gfi.com, and possibly
filemon and process explorer free from www.sysinternals.com, fport or vision
from www.foundstone.com/knowledge, etc. There might be some more details
and other ideas here:

http://securityadmin.info/faq.asp#hacked

"ja" <nobody@nobody.com> wrote in message
news:#DAlRIGxDHA.1680@TK2MSFTNGP12.phx.gbl...
> Messenger is disabled and port blocked
>
> "Bill Sanderson" <Bill_Sanderson@msn.com.plugh.org> skrev i en meddelelse
> news:e7AvojDxDHA.556@TK2MSFTNGP11.phx.gbl...
> > Haven't read the rest of the thread yet, but here's my take:
> >
> > Look here:
> >
> > http://www.eventid.net/display.asp?eventid=26&source=
> >
> > This states that Messenger Service Net Send messages are recorded with
> this
> > eventid in the logs.
> >
> > So--I think this is Messenger spam. Messenger spam is an indicator that
a
> > machine isn't properly firewalled from the Internet. Fix this, and
these
> > messages will go away. They appear on the screen as a popup grey
> > rectangular window with "Messenger Service" at the top.
> >
> > They are generated by spammers for the usual reason--profit.
> >
> >
> > "ja" <nobody@nobody.com> wrote in message
> > news:OBkKU5AxDHA.2712@TK2MSFTNGP11.phx.gbl...
> > > There is no spyware on the computer in question
> > >
> > > "Dirk" <dirk@nomail.no> skrev i en meddelelse
> > > news:NLIDb.3513$7U1.26903@amstwist00...
> > > >
> > > > "ja" <nobody@nobody.com> schreef in bericht
> > > > news:%23YgRCNAxDHA.2116@TK2MSFTNGP11.phx.gbl...
> > > > > I have the following Application Pop Up in an event log on one of
> our
> > > > > computers:
> > > > > Event ID: 26
> > > > > "Application popup: Government Computer : Your ISP will be
> notified"
> > > > >
> > > > > Is this something that has popped up on the computer in question
or
> is
> > > it
> > > > > something that has popped up on a computer trying to log on to the
> > > > computer?
> > > > >
> > > > > What could trigger an event like that?
> > > >
> > > > No idea, read this:
> > > > http://mvps.org/winhelp2002/unwanted.htm
> > > >
> > > >
> > >
> > >
> >
> >
>
>