pesistant attack on my computer

T_G

The Consumate Dreamer
Staff member
Joined
Jan 1, 2000
Messages
6,693
Reaction score
241
Points
63
Age
58
My Satellite Setup
1 GigaBlue Quad plus, 1 Dreambox 5620, MOTECK SG2100A DISEqC Motor, 120 cm noname offset dish, Humax 95 cm offset dish and a few UK digiboxes.
My Location
Somewhere where the Sauer is Kraut and the Wurst is Brat
Well, every time I go online I get a popup with a note that my computer needs to get security updates and anti virus software.
I got Norton internet security and also Zone alarm installed, set up on all the correct settings but still this f***er comes up. Any ideas?
 

rolfw

Believe it when I see it Admin.
Staff member
Joined
May 1, 1999
Messages
38,292
Reaction score
1,615
Points
113
My Satellite Setup
Technomate 5402 HD M2 Ci, DM7000s, Transparent 80cm Dish, Moteck SG2100 DiseqC motor, lots of legacy gear. Meters: Satlook Digital NIT, Promax HD Ranger+ spectrum analyser.
My Location
Berkshire
This isn't one of the popups from Windows messenger is it T_G? They also send one out which tells you that you need a popup stopper. :)
 

T_G

The Consumate Dreamer
Staff member
Joined
Jan 1, 2000
Messages
6,693
Reaction score
241
Points
63
Age
58
My Satellite Setup
1 GigaBlue Quad plus, 1 Dreambox 5620, MOTECK SG2100A DISEqC Motor, 120 cm noname offset dish, Humax 95 cm offset dish and a few UK digiboxes.
My Location
Somewhere where the Sauer is Kraut and the Wurst is Brat
Well, if you look carefully at the screenshot, you can see on the taskbar the following programs open: ICQ, Network status, Modem, Zone Alarm, Volume control, Norton anti virus auto protect and finnaly norton internet security.
The messenger is only on when I switch it on. I don't think it is the ICQ as the pop up comes when it is off as well...
 

jimbo

Retired Mod
Joined
Jan 1, 2000
Messages
3,482
Reaction score
1
Points
0
Age
74
My Satellite Setup
Sky HD, TM6800HD, Manhattan Plaza ST550 and TM1500 CI+. 1.0m dish and 36v motor, Panasonic DVD HDD recorder and Panasonic video/DVD recorder. Sony G800 HD TV stand/surround system + Sony KDL40W2000. Infinity USB, Elvis, CAS1, CAS2.
My Location
Greater London

T_G

The Consumate Dreamer
Staff member
Joined
Jan 1, 2000
Messages
6,693
Reaction score
241
Points
63
Age
58
My Satellite Setup
1 GigaBlue Quad plus, 1 Dreambox 5620, MOTECK SG2100A DISEqC Motor, 120 cm noname offset dish, Humax 95 cm offset dish and a few UK digiboxes.
My Location
Somewhere where the Sauer is Kraut and the Wurst is Brat
I got Norton to make a full check every night, and I also got the latest virus updates automatically, so I don't think it is a virus. it seems to be some sort of open port. According to a security check I made my computer is save, I got the Norton internet security which is some sort of firewall...
 

jimbo

Retired Mod
Joined
Jan 1, 2000
Messages
3,482
Reaction score
1
Points
0
Age
74
My Satellite Setup
Sky HD, TM6800HD, Manhattan Plaza ST550 and TM1500 CI+. 1.0m dish and 36v motor, Panasonic DVD HDD recorder and Panasonic video/DVD recorder. Sony G800 HD TV stand/surround system + Sony KDL40W2000. Infinity USB, Elvis, CAS1, CAS2.
My Location
Greater London
Ok, so if it's just a pop up it will be triggered by a some small exe file or registry call on your computer. A neighbour had something like that and I first of all used find/search for anything to do with it and deleted that. Then searched the registry and found the trigger in there. Once I'd removed the bits from the registry that was it, all clear.
 
O

oldgit

Guest
Hi Guys, Another thought, it might be a spybot, antivirus progs won't find it. Try Spybot Search and Destroy, it's free.
Sincerely,
Richard.
 

rolfw

Believe it when I see it Admin.
Staff member
Joined
May 1, 1999
Messages
38,292
Reaction score
1,615
Points
113
My Satellite Setup
Technomate 5402 HD M2 Ci, DM7000s, Transparent 80cm Dish, Moteck SG2100 DiseqC motor, lots of legacy gear. Meters: Satlook Digital NIT, Promax HD Ranger+ spectrum analyser.
My Location
Berkshire

Channel Hopper

Suffering fools, so you don't have to.
Staff member
Joined
Jan 1, 2000
Messages
35,533
Reaction score
8,554
Points
113
Age
59
Website
www.sat-elite.uk
My Satellite Setup
A little less analogue, and a lot more crap.
My Location
UK
It could be that T_G might be hallucinating as well

He may not even have a PC, but is posting through some other means
 

drag0nfly_69uk

Regular Member
Joined
Jan 1, 2000
Messages
160
Reaction score
0
Points
0
My Location
essex boy
it is definitely a worm virus, even norton saying the pc is cleaned but the worm is loaded everytime the pc is switched on, refer to jimbo's link, do a manual removal.
 

T_G

The Consumate Dreamer
Staff member
Joined
Jan 1, 2000
Messages
6,693
Reaction score
241
Points
63
Age
58
My Satellite Setup
1 GigaBlue Quad plus, 1 Dreambox 5620, MOTECK SG2100A DISEqC Motor, 120 cm noname offset dish, Humax 95 cm offset dish and a few UK digiboxes.
My Location
Somewhere where the Sauer is Kraut and the Wurst is Brat
OK, I am going to do the system cleaner, why not. The thing is: That thing has nothing to do with the opaservA virus. What the text is saying that my computer is suspected of having this virus. They recommendI go to the update2000.dr.ag (funny URL...) website to get help. What happens then is that once you are on this site and download whatever is on for "Free", you are also downloading a 0190 dialer, I.E. it changes settings on your modem. The moderm then shuts down and then reconnects, but this time you are paying 10 Euro a minut. The thing sometimes changes the text, so it would be all sorts of "Alarming" messages, and sometimes the webaddress changes. This is because I think the webaddresses are being shut down. It seems to be a German thing, I never had a message in English.

P.S just as I was writing this I got another one, see picture
 

T_G

The Consumate Dreamer
Staff member
Joined
Jan 1, 2000
Messages
6,693
Reaction score
241
Points
63
Age
58
My Satellite Setup
1 GigaBlue Quad plus, 1 Dreambox 5620, MOTECK SG2100A DISEqC Motor, 120 cm noname offset dish, Humax 95 cm offset dish and a few UK digiboxes.
My Location
Somewhere where the Sauer is Kraut and the Wurst is Brat
Channel Hopper said:
It could be that T_G might be hallucinating as well

He may not even have a PC, but is posting through some other means


I can take the hallucinations and posting through other means, BUT NOT HAVE A COMPUTER?? This is personal!!
 

jimbo

Retired Mod
Joined
Jan 1, 2000
Messages
3,482
Reaction score
1
Points
0
Age
74
My Satellite Setup
Sky HD, TM6800HD, Manhattan Plaza ST550 and TM1500 CI+. 1.0m dish and 36v motor, Panasonic DVD HDD recorder and Panasonic video/DVD recorder. Sony G800 HD TV stand/surround system + Sony KDL40W2000. Infinity USB, Elvis, CAS1, CAS2.
My Location
Greater London
The IP address on that last pop up is in Dusseldorf. You can report abuse to the following: abuse@pppool.de
 

rolfw

Believe it when I see it Admin.
Staff member
Joined
May 1, 1999
Messages
38,292
Reaction score
1,615
Points
113
My Satellite Setup
Technomate 5402 HD M2 Ci, DM7000s, Transparent 80cm Dish, Moteck SG2100 DiseqC motor, lots of legacy gear. Meters: Satlook Digital NIT, Promax HD Ranger+ spectrum analyser.
My Location
Berkshire
Try this T_G, the messenger doesn't have to be switched on to provide you with an interesting selection of popups.

Goto start then click on run

type msconfig and press enter

Click on the services tab

Scroll down to messenger and un-tick

press ok and reboot your PC as prompted

When windows has reloaded click the tick box on the pop-up and press ok

This may stop your messages.
 

T_G

The Consumate Dreamer
Staff member
Joined
Jan 1, 2000
Messages
6,693
Reaction score
241
Points
63
Age
58
My Satellite Setup
1 GigaBlue Quad plus, 1 Dreambox 5620, MOTECK SG2100A DISEqC Motor, 120 cm noname offset dish, Humax 95 cm offset dish and a few UK digiboxes.
My Location
Somewhere where the Sauer is Kraut and the Wurst is Brat
rolfw said:
Try this T_G, the messenger doesn't have to be switched on to provide you with an interesting selection of popups.


I tried to, but I did not see the messenger there. I think that when I installed it first I did use the option that it won't load automatically with windows...
 

rolfw

Believe it when I see it Admin.
Staff member
Joined
May 1, 1999
Messages
38,292
Reaction score
1,615
Points
113
My Satellite Setup
Technomate 5402 HD M2 Ci, DM7000s, Transparent 80cm Dish, Moteck SG2100 DiseqC motor, lots of legacy gear. Meters: Satlook Digital NIT, Promax HD Ranger+ spectrum analyser.
My Location
Berkshire
Oh well, worth a try, are you still getting the messages?
 

T_G

The Consumate Dreamer
Staff member
Joined
Jan 1, 2000
Messages
6,693
Reaction score
241
Points
63
Age
58
My Satellite Setup
1 GigaBlue Quad plus, 1 Dreambox 5620, MOTECK SG2100A DISEqC Motor, 120 cm noname offset dish, Humax 95 cm offset dish and a few UK digiboxes.
My Location
Somewhere where the Sauer is Kraut and the Wurst is Brat
Yes, I got them all the time... not that they are doing anything, it is just anoying knowing I have been violated....
 
Top