Spyware Attack ???

Mike · 05-09-2005, 13:58

Hi all

My friend has a PC which seems under constant attack from Spyware and Adware. When the PC is switched on he gets all sorts of messages poping up .....more than he has ever had before. His machine has just been rebuilt so he is really concermed. He had run adware and has a fire wall but it keeps coming through. NTL CS suggested he changes he IP address which seems a bit strange.

Any ideas or suggestion grarefully recieved.

Many thanks for your time.

Mike

Paul K · 05-09-2005, 14:02

Software like adaware and spybot s&d have real time protection tools that will run in the background and help to stem the flow of rubbish. They must be kept up to date, also up to date anti-virus scans will help keep things under control. Running Firefox instead of Internet Explorer will also help.

Mike · 05-09-2005, 15:33

Quote:

Originally Posted by Paul

Software like adaware and spybot s&d have real time protection tools that will run in the background and help to stem the flow of rubbish. They must be kept up to date, also up to date anti-virus scans will help keep things under control. Running Firefox instead of Internet Explorer will also help.

Is it possible that an IP address is attacked

Raistlin · 05-09-2005, 15:46

Quote:

Originally Posted by Mike

Hi all

My friend has a PC which seems under constant attack from Spyware and Adware. When the PC is switched on he gets all sorts of messages poping up .....more than he has ever had before. His machine has just been rebuilt so he is really concermed. He had run adware and has a fire wall but it keeps coming through. NTL CS suggested he changes he IP address which seems a bit strange.

Any ideas or suggestion grarefully recieved.

Many thanks for your time.

Mike

Assuming Windows XP:

Start > Control Panel > Administrative Tools > Services

Scroll down the list to "Messenger"

Check what it says in the "Status" column

If the Status is "Started" or "Automatic" right click on the line, select "Properties" and then change the Startup Type (drop down box on the general tab) to "Disabled".

Reboot machine

Mike · 05-09-2005, 15:50

Quote:

Originally Posted by Raistlin

Assuming Windows XP:

Start > Control Panel > Administrative Tools > Services

Scroll down the list to "Messenger"

Check what it says in the "Status" column

If the Status is "Started" or "Automatic" right click on the line, select "Properties" and then change the Startup Type (drop down box on the general tab) to "Disabled".

Reboot machine

Thanks for this .....what will this do/stop

Regards Mike

Raistlin · 05-09-2005, 15:55

Sounds to me like the firewall either:

a) isn't running, or
b) hasn't been configured properly.

What firewall is he running?

zovat · 05-09-2005, 15:55

Quote:

Originally Posted by Jon M

- hyperactive, ignorant, aggressive trolls are the best sort

especially when they can't even get the terminology right

But in seriousness, you may find that a change of IP will help, as a number of automated scripts use an IP range, and then log those that are not protected adequately for later attacks, changing the IP would help you, but mean the ext person to get that IP would get the hits instead (unless they had better security).

Other than that, as already stated, make sure the AV software, firewall, and adaware etc are up to date, and run a full scan whilst not connected to the net.

HTH

Mike · 05-09-2005, 15:56

Quote:

Originally Posted by Raistlin

Sounds to me like the firewall either:

a) isn't running, or
b) hasn't been configured properly.

What firewall is he running?

Zonealarm

Raistlin · 05-09-2005, 15:57

Do the messages look a bit like this:

Mike · 05-09-2005, 15:59

Quote:

Originally Posted by Raistlin

Do the messages look a bit like this:

Not sure but I guess if not something similar !

Raistlin · 05-09-2005, 16:01

Ok, he can still disable the Messenger Service in Win2K.

The instructions are pretty much the same, they're here:

http://www.microsoft.com/windows2000...s/msgrspam.asp

There's some nice screen shots there as well.

He needs to check his firewall though if they do look like that (ie. if they say "Messenger Service" at the top), it's not configured properly because it really shouldn't be letting those through.

The other possibility (if he gets it mainly when surfing) is that his browser is allowing popups to be opened - he could try downloading the Google toolbar and setting that to kill popups, that should help a bit.

Alternatively he could try a different browser, something like Firefox for example.

patrickp · 06-09-2005, 00:37

Quote:

Originally Posted by Nikko

Its happened! I cannot view the forum, navigate the site or post in threads. Obviously this threat should have been taken seriously.

I'll take you through this in stages, Nikko.

Examine the front of your computer carefully. You may notice that there are some buttons there you can press. No, don't press them yet.

You may be able to see one marked On, or it may have a circle with a vertical line through the top half of it.

Once you have identified this button, press it.

Now relax and wait a little. Your computer may make funny noises.

Once it's all settled down, you may find it easier to access the Cable Forum.

I discovered this purely by accident, but it really works! Well, sometimes... ;-(

**Mick** · 06-09-2005, 10:33

Thread clean up due shortly.

In the meantime - To help the original OP, can we ignore the issue of the idiot yesterday.

Jon M · 06-09-2005, 11:18

<Mod Edit: Jon M - Off topic posts removed>