Popups in XP?

[nags]

Ok, I know this is a common question and I've searched everywhere and done everything I can think of.

First off, I turned off the messenger thing in services. Ran Ad-Aware and Spybot. Both detect everything and get rid of it. But then randomly I'll get popups in windows without even having IE open. This is just as of recently. It's a pretty fresh install of XP with nothing out of the ordinary installed... As I said in one of my other posts, I'm new to XP and not really sure of what is supposed to be running in the background so looking at the task manager is not telling me much.. Nothing looks out of the ordinry though

Any help would be great

thanks.

 

[nags]

by the way. these are very random and not very frequent

 

[Saltin]

Go to start menu, then Run.

In the run line, enter "regedit" no quotes

Navigate to the key

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

Look In the right hand pane and copy down what you have there into your next post.

 

[nags]

Only thing there is AIM

 

[AFB]

Post a pic of the popups.

 

[nags]

Alright, I'll wait for them to come back and get a screenshot. They dont appear very often

 

[nags]

I just left my computer for about 2 hours and came back.. Only had one, but here it is

http://www.motoice.com/nags/ads.jpg

 

[mikeb333]

Goddamn SMILEYS!

 

[nags]

There are several other ads that come up occasionaly, but thats the most common

 

[dawks]

screenshot of your taskmanager?

Have Kazaa installed?

 

[AFB]

Run Spybot Search And Destroy and adaware

 

[nags]

I ran both Ad Aware and SpyBot and got rid of everything and to answer the other question, Kazaa is not and never has been installed on this computer

 

[Abzstrak]

you did run all updates on spybot and adaware before running them right?

 

[nags]

Yep, I update them and run them several times daily.

I've never had a problem like this before

 

[Abzstrak]

guess its something neither of them detect, you run msconfig and look for strange startup items?

 

[nags]

Yup

Even looked through the task manager for anything odd and found nothing

 

[nags]

I now just got another one for eBay :|

 

[thegorx]

try regmon

http://www.sysinternals.com/ntw2k/source/regmon.shtml

it should show you what's running at the current time

also try zonealarm
you can try the pro version for free for 14 day that should stop them and give you a heads up

http://www.zonelabs.com/store/content/catalog/products/sku_list_za.jsp?lid=pdb_za1

 

[nags]

I just ran that program but dont really know what to look for

 

[nags]

These things are so rare and random but its still pissing me the f*ck off.. Since I started this post I've only got 2 of them

 

[dawks]

taskmanager screenshot

 

[nags]

http://www.motoice.com/nags/taskman.jpg

 

[pdn]

Have you tried checking your system for trojans?
http://www.moosoft.com/products/cleaner/download/ Check for updates before scanning!

Try scanning windows under normal mode, then maybe try scanning while in safe mode.

 

[jamesL70]

There is a tool called Spy++ that comes with Microsofts Visual Studio that will, among other things, tell you the process ID that owns a window.

Then you can go to the task manager, enable the process identifier column, and see we owns it.

There may be other similar (and cheaper) programs out there.

JamesL

 

[Ogg]

Apparently none of you know that if youre on a network then you can NETSEND messages to other machines in your domain?

OK
Its fun you should learn about it.
I cant believe none of you know about this.

Anyway, this is the service that these popups are exploiting. This OS messaging service is built into Windows 2000/xp and its used by administrators alot. This is not the same as MSN Messenger or other IM clients. All you have to do is disable the service..........

If youre the administrator of your machine, no sweat.

Control Panel > Administrative Tools
>Services
You are looking for the Messenger service.
Read the Description......See Im right.
Now Rightclick>Properties and dont just stop the service in the startup type: box but disable it from restarting after reboot..........
Thats it........
:beer: