Re: Mysterious "Pop-up Spam" Window

From: Thierry F. (thierry.frache@systemexpert.com)
Date: 10/17/02 

From: "Thierry F." <thierry.frache@systemexpert.com>
Date: Thu, 17 Oct 2002 22:20:31 +0200

Your problem is related to NetBIOS (and especially ports 137 and 139).
Someone sends a command like net send <IP> <message> to you. Please disable
NetBIOS on your public interface or install a personnal firewall!

"David Dickerson" <ddickerson@igc.org> a écrit dans le message de news:
5e9d01c275fb$1f77c820$35ef2ecf@TKMSFTNGXA11...
> Hello, everyone.
>
> A few minutes ago, I experience a security violation --
> or I just found out that Pegasus Mail, which I installed
> last night, is actually "ad-ware." I attach an image of
> the Window, for your convenience.
>
> I am very concerned about this message of unknown origin,
> and I consider it a security violation, or the result
> of "spyware" at the least. (I DO have LavaSoft's Ad-aware
> installed, and it runs whenever I boot into XP Pro. It
> did not detect any "ad-ware" this morning, and I
> installed Pegasus Mail last night.)
>
> When the window appeared, I had Internet Explorer and
> Pegasus Mail (which I am testing) open on my Windows XP
> Professional system. I was running no other applications.
>
> I do not think that the attached "pop-up spam" window was
> generated by Internet Explorer, because it does not have
> the XP-style of title bar. Pegasus Mail, therefore,
> becomes my primary "suspect," unless I have a compromised
> system -- which is a greater concern, because I can
> always delete Pegasus Mail.
>
> The message is from "DEGREES" and directed to my IP
> address (which is dynamic and which I share in good
> faith, perhaps naively, here). You can view an image of
> the window, which I have attached.
>
> Has anyone seen anything like this type of advertisement
> before?
>
> I have contacted Pegasus Mail about this intrusive
> advertising, because I will not use their e-mail software
> if it has such a hidden "feature." I do not expect a
> reply from them, however.
>
> If the message did not come from Pegasus Mail, then I
> have a security violation -- and I do have XP's firewall
> active.
>
> Is this matter one of serious concern, or a problem that
> I can remedy by deleting Pegasus Mail? (I am looking for
> a non-Microsoft e-mail program that supports Cyrillic e-
> mail AND the sending and receiving of HTML e-mail,
> although most of my e-mail is plain text. I may end up
> using Outlook 2002, which I have, but have not installed,
> but I worry about security, even with anti-virual
> software installed. Outlook, however, does "fit the bill"
> and may be the best option, in terms of the functions I
> want.)
>
> Thank you for your time and attention! (I hope that I am
> worrying over nothing, or that I can isolate the source
> and remove it from my PC.)
>
> Cordially,
>
> David M. Dickerson
> --
> http://www.igc.org/
> http://www.iearn.org/
>
> P.S. -- I have instructions to edit some files to get
> Pegasus Mail to send and receive Cyrillic, but that pop-
> up window could mean that Pegasus Mail is off my PC. (I
> do plan to register the product, if my efforts succeed to
> implement Cyrillic, and Pegasus Mail is NOT the source of
> the "instrusion.")