Re: Web Popups
From: Skillman Hunter (acrobyte@cox.net)
Date: 11/12/02
- Next message: Chris Gilbert: "Re: certificate revocation doesn't work"
- Previous message: emy: "Cisco attribute"
- In reply to: WB IT: "Re: Web Popups"
- Next in thread: Skillman Hunter: "Re: Web Popups"
- Reply: Skillman Hunter: "Re: Web Popups"
- Reply: Joe Richards [MVP]: "Re: Web Popups"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: "Skillman Hunter" <acrobyte@cox.net> Date: Tue, 12 Nov 2002 01:32:38 -0800
Sorry to tell this thread that turning off Messenger did not stop an annoying Ad window that pops up on my computer every day about
5 pm - but not exactly at the same time.
I use ZoneAlarm Pro and have all the 135/137/139 ports blocked and others as well and
have the web site that issues the popup blocked. That doesn't stop it.
Trend-Micro PC-cillin will block this web site's windows.
But I stopped using PC-cillin for other reasons - it hangs up email.
Reactivated Norton's antivirus but soon deactivated it for reason I now forget.
I now use AVG (www.grisoft.com) now but that has no site blocking.
The annoying window creates a record in the History folder, so I know the web site URL.
(Sending them emails asking to desist has had no effect.
Since the site is in Germany, I even translated the messages to German - to no avail.)
The History URL is named "Windows Channels".
I am running Windows 2000 Pro SP-2.
At http://www.microsoft.com/windows/default.mspx I searched for "channels" and got 100 replies.
The first one is "Disable Adding Channels". The key statement is:
"If you disable this policy or DO NOT CONFIGURE IT, users can add channels to the Channel bar or to their desktop." (Caps are my
emphasis.)
This implies that the "user" is a local person, but apparently the feature can be accessed from outside because the MS Help notes
says:
"Channels are Web sites that are updated automatically on your computer according to a schedule specified by the CHANNEL PROVIDER."
At 5pm in my case.
So this "Channels" feature allows outside folk to muck around with my system.
There are literally hundreds of settings buried in Windows that can only be accessed via the MMC.
Apparently many of these are activated by default and require MMC action to deactivate.
One can speculate on the reasons Microsoft would leave these options "Active".
To modify "Disable Adding Channels", I had to get to
"User Configuration\Administrative Templates\Windows Components\Internet Explorer\Offline Pages
I had to open MMC and add the "Local Computer Policy" snap-in.
This is done by selecting the Console menu and choosing "Add/Remove Snap-in".
In the Add/Remove Snap-In" dialog, I clicked "Add..." to get a list of the snap-ins (about 30).
I chose "Group Policy". This added an item named "Local Computer Policy" to the Console Root list.
I clicked the +'s to get to the following item:
Local Computer Policy\User Configuration\Administrative Templates\Windows Components\Internet Explorer\Offline Pages.
This is the path as noted in the MS Help note about "Disable Adding Channels".
I selected the "Disable adding channels" and opened its Properties.
The "Explain" tab describes what Channels do.
At the Policy Tab, I changed "Not Configured" to "Disabled".
I then had to save this console as Console1.
It is not clear if I have to reactivate this console on each reboot or if the deactivation will automatically take effect on reboot.
At 5 pm tomorrow, I will await the arrival of the usual Ad popup.
I will report the result of my venture into the MMC Group Policy snap-in.
It is not clear if one has to reboot to get this MMC change to take effect.
It never hurts to reboot Windows at least twice.
Based on what I have read, the schedule for this popup is stored somewhere on my computer so my computer must be requesting update
of the channel. I have not found that schedule yet.
If anyone knows of a simpler way to disable Adding Channels or to alter the schedule, please let me know.
Skillman Hunter
"WB IT" <abuse@127.0.0.1> wrote in message news:3dc7e4a7_2@lon-news.intensive.net...
> "Dean Hansen" <dhansen@cogsdale.com> wrote in message
> news:cdfc01c284df$16c94da0$3bef2ecf@TKMSFTNGXA10...
> > I'm not sure if this behavior is geographically isolated
> > to Canada but we have been receiving many popup messages
> > on machines not protected by corporate firewalls, like the
> <snip>
>
> You don't need any rights to use net send, if you have messenger service
> enabled on your machine, I could send you one right now.
>
> Just disable messenger or block the relevant ports 135/137/139.
>
> The only way to trace them is have a firewall that logs these attempts..
>
> Read the news this is not a new phenomnen, it's going on all around the
> world and has been for a considerable amount of time.
>
> http://www.security-forums.com/forum/viewtopic.php?t=1594
>
> http://www.techtv.com/screensavers/answerstips/story/0,24330,3374542,00.htm
>
> http://www.wired.com/news/technology/0,1282,55795,00.html
>
> --
>
> Shaolin - IT Systems
> WB Ltd.
> .: http://www.security-forums.com :.
>
>
--- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.410 / Virus Database: 231 - Release Date: 11/1/2002
- Next message: Chris Gilbert: "Re: certificate revocation doesn't work"
- Previous message: emy: "Cisco attribute"
- In reply to: WB IT: "Re: Web Popups"
- Next in thread: Skillman Hunter: "Re: Web Popups"
- Reply: Skillman Hunter: "Re: Web Popups"
- Reply: Joe Richards [MVP]: "Re: Web Popups"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
