pesistant attack on my computer

T_G

T_G

The Consumate Dreamer
Staff member
Messages
6,651
Likes
215
My Satellite Setup
1 GigaBlue Quad plus, 1 Dreambox 5620, MOTECK SG2100A DISEqC Motor, 120 cm noname offset dish, Humax 95 cm offset dish and a few UK digiboxes.
My Location
Somewhere where the Sauer is Kraut and the Wurst is Brat
#1
Well, every time I go online I get a popup with a note that my computer needs to get security updates and anti virus software.
I got Norton internet security and also Zone alarm installed, set up on all the correct settings but still this f***er comes up. Any ideas?
 

Attachments

rolfw

rolfw

Believe it when I see it Admin.
Staff member
Messages
37,726
Likes
1,291
My Satellite Setup
Technomate 5402 HD M2 Ci, DM7000s, Transparent 80cm Dish, Moteck SG2100 DiseqC motor, lots of legacy gear. Meters: Satlook Digital NIT, Promax HD Ranger+ spectrum analyser.
My Location
Berkshire
#2
This isn't one of the popups from Windows messenger is it T_G? They also send one out which tells you that you need a popup stopper. :)
 
T_G

T_G

The Consumate Dreamer
Staff member
Messages
6,651
Likes
215
My Satellite Setup
1 GigaBlue Quad plus, 1 Dreambox 5620, MOTECK SG2100A DISEqC Motor, 120 cm noname offset dish, Humax 95 cm offset dish and a few UK digiboxes.
My Location
Somewhere where the Sauer is Kraut and the Wurst is Brat
#3
Well, if you look carefully at the screenshot, you can see on the taskbar the following programs open: ICQ, Network status, Modem, Zone Alarm, Volume control, Norton anti virus auto protect and finnaly norton internet security.
The messenger is only on when I switch it on. I don't think it is the ICQ as the pop up comes when it is off as well...
 
jimbo

jimbo

Retired Mod
Messages
3,482
Likes
1
My Satellite Setup
Sky HD, TM6800HD, Manhattan Plaza ST550 and TM1500 CI+. 1.0m dish and 36v motor, Panasonic DVD HDD recorder and Panasonic video/DVD recorder. Sony G800 HD TV stand/surround system + Sony KDL40W2000. Infinity USB, Elvis, CAS1, CAS2.
My Location
Greater London
#4
T_G

T_G

The Consumate Dreamer
Staff member
Messages
6,651
Likes
215
My Satellite Setup
1 GigaBlue Quad plus, 1 Dreambox 5620, MOTECK SG2100A DISEqC Motor, 120 cm noname offset dish, Humax 95 cm offset dish and a few UK digiboxes.
My Location
Somewhere where the Sauer is Kraut and the Wurst is Brat
#5
I got Norton to make a full check every night, and I also got the latest virus updates automatically, so I don't think it is a virus. it seems to be some sort of open port. According to a security check I made my computer is save, I got the Norton internet security which is some sort of firewall...
 
jimbo

jimbo

Retired Mod
Messages
3,482
Likes
1
My Satellite Setup
Sky HD, TM6800HD, Manhattan Plaza ST550 and TM1500 CI+. 1.0m dish and 36v motor, Panasonic DVD HDD recorder and Panasonic video/DVD recorder. Sony G800 HD TV stand/surround system + Sony KDL40W2000. Infinity USB, Elvis, CAS1, CAS2.
My Location
Greater London
#6
Ok, so if it's just a pop up it will be triggered by a some small exe file or registry call on your computer. A neighbour had something like that and I first of all used find/search for anything to do with it and deleted that. Then searched the registry and found the trigger in there. Once I'd removed the bits from the registry that was it, all clear.
 
O

oldgit

Guest
#7
Hi Guys, Another thought, it might be a spybot, antivirus progs won't find it. Try Spybot Search and Destroy, it's free.
Sincerely,
Richard.
 
Channel Hopper

Channel Hopper

Suffering fools, so you don't have to.
Staff member
Messages
25,968
Likes
5,880
My Satellite Setup
A little less analogue, and a lot more crap.
My Location
UK South
#9
It could be that T_G might be hallucinating as well

He may not even have a PC, but is posting through some other means
 
D

drag0nfly_69uk

Regular Member
Messages
160
Likes
0
My Location
essex boy
#10
it is definitely a worm virus, even norton saying the pc is cleaned but the worm is loaded everytime the pc is switched on, refer to jimbo's link, do a manual removal.
 
T_G

T_G

The Consumate Dreamer
Staff member
Messages
6,651
Likes
215
My Satellite Setup
1 GigaBlue Quad plus, 1 Dreambox 5620, MOTECK SG2100A DISEqC Motor, 120 cm noname offset dish, Humax 95 cm offset dish and a few UK digiboxes.
My Location
Somewhere where the Sauer is Kraut and the Wurst is Brat
#11
OK, I am going to do the system cleaner, why not. The thing is: That thing has nothing to do with the opaservA virus. What the text is saying that my computer is suspected of having this virus. They recommendI go to the update2000.dr.ag (funny URL...) website to get help. What happens then is that once you are on this site and download whatever is on for "Free", you are also downloading a 0190 dialer, I.E. it changes settings on your modem. The moderm then shuts down and then reconnects, but this time you are paying 10 Euro a minut. The thing sometimes changes the text, so it would be all sorts of "Alarming" messages, and sometimes the webaddress changes. This is because I think the webaddresses are being shut down. It seems to be a German thing, I never had a message in English.

P.S just as I was writing this I got another one, see picture
 

Attachments

T_G

T_G

The Consumate Dreamer
Staff member
Messages
6,651
Likes
215
My Satellite Setup
1 GigaBlue Quad plus, 1 Dreambox 5620, MOTECK SG2100A DISEqC Motor, 120 cm noname offset dish, Humax 95 cm offset dish and a few UK digiboxes.
My Location
Somewhere where the Sauer is Kraut and the Wurst is Brat
#12
Channel Hopper said:
It could be that T_G might be hallucinating as well

He may not even have a PC, but is posting through some other means

I can take the hallucinations and posting through other means, BUT NOT HAVE A COMPUTER?? This is personal!!
 
jimbo

jimbo

Retired Mod
Messages
3,482
Likes
1
My Satellite Setup
Sky HD, TM6800HD, Manhattan Plaza ST550 and TM1500 CI+. 1.0m dish and 36v motor, Panasonic DVD HDD recorder and Panasonic video/DVD recorder. Sony G800 HD TV stand/surround system + Sony KDL40W2000. Infinity USB, Elvis, CAS1, CAS2.
My Location
Greater London
#13
The IP address on that last pop up is in Dusseldorf. You can report abuse to the following: abuse@pppool.de
 
rolfw

rolfw

Believe it when I see it Admin.
Staff member
Messages
37,726
Likes
1,291
My Satellite Setup
Technomate 5402 HD M2 Ci, DM7000s, Transparent 80cm Dish, Moteck SG2100 DiseqC motor, lots of legacy gear. Meters: Satlook Digital NIT, Promax HD Ranger+ spectrum analyser.
My Location
Berkshire
#14
Try this T_G, the messenger doesn't have to be switched on to provide you with an interesting selection of popups.

Goto start then click on run

type msconfig and press enter

Click on the services tab

Scroll down to messenger and un-tick

press ok and reboot your PC as prompted

When windows has reloaded click the tick box on the pop-up and press ok

This may stop your messages.
 
T_G

T_G

The Consumate Dreamer
Staff member
Messages
6,651
Likes
215
My Satellite Setup
1 GigaBlue Quad plus, 1 Dreambox 5620, MOTECK SG2100A DISEqC Motor, 120 cm noname offset dish, Humax 95 cm offset dish and a few UK digiboxes.
My Location
Somewhere where the Sauer is Kraut and the Wurst is Brat
#15
rolfw said:
Try this T_G, the messenger doesn't have to be switched on to provide you with an interesting selection of popups.

I tried to, but I did not see the messenger there. I think that when I installed it first I did use the option that it won't load automatically with windows...
 
rolfw

rolfw

Believe it when I see it Admin.
Staff member
Messages
37,726
Likes
1,291
My Satellite Setup
Technomate 5402 HD M2 Ci, DM7000s, Transparent 80cm Dish, Moteck SG2100 DiseqC motor, lots of legacy gear. Meters: Satlook Digital NIT, Promax HD Ranger+ spectrum analyser.
My Location
Berkshire
#16
Oh well, worth a try, are you still getting the messages?
 
T_G

T_G

The Consumate Dreamer
Staff member
Messages
6,651
Likes
215
My Satellite Setup
1 GigaBlue Quad plus, 1 Dreambox 5620, MOTECK SG2100A DISEqC Motor, 120 cm noname offset dish, Humax 95 cm offset dish and a few UK digiboxes.
My Location
Somewhere where the Sauer is Kraut and the Wurst is Brat
#17
Yes, I got them all the time... not that they are doing anything, it is just anoying knowing I have been violated....
 
Top