Pop Up Ads.

[dfgu]

Hi All,
I'm not sure why, but recently, a lot of pop up ads have been showing up on my server out of nowhere. I do not know how to stop this. Apparently, its a pop up not from the web, but just like a normal window, and I just click on "ok" to get rid of them. It is also only appearing on my Windows 2000 servers, not on my NT servers. Any suggestions on how to get rid of this?

Thanks.

 

[dankelt]

These programs usually install themselves when you install other shareware/freeware programs. For example Kazaa or BearShare. There are a few things you can do. First off, you can download Lavasoft ad-aware, this will find most ad/spyware running your your PC. Also, you hinted that the add wasn't an Internet Explorer window, in that case, when the window pops up, bring up the task manager and look to see what the process name is. (go to the application tab, right click on the app for the popup, and click "Go To Process&quot. This will give you a big clue into what it is. You can then search for this executable on your HD, Registry, and Startup folder. Also, it may have an uninstall, so also check Add/Remove programs for anything unusual.

 

[ashpp]

Disable the messenger service

http://www.its.caltech.edu/its/security/users/windows_messenger.shtml

or better still configure the firewall to block incoming ports 135, 139, 137.

HTH

Ash.

 

[LarryTheCucumber]

Look at this article. The product will will pop messages onto NT and 2000 servers.

http://www.mynetwatchman.com/kb/security/articles/popupspam/

 

[dankelt]

Messenger Service Popups, I never even thought of that. I couldn't imagine letting a windows server sit on the inetnet without any kind of firewall, or without disabling a bunch of services. There is just no reason for everyone to have that kind of access to a server.

By default I block the first 1024 tcp/udp ports, and only open ones I need.

 

[Lizardkng]

Incidentally, these Messenger Service popups can also come up on domain clients connected to a 2k server connected to the internet, theyre not only limited to the server.

 

[battmain]

"These programs usually install themselves when you install other shareware/freeware programs. For example Kazaa or BearShare."

I haven't installed any of those programs and it still shows up. Using Norton firewall and there isn't anything that I can find in the options to stop it unless I block specific ports.

 

[dankelt]

battmain, what shows up?

 

[serecyn]

I had the same problem.
Here's how to get rid of those popups:

http://8help.ohio-state.edu/913.html

 

[serecyn]

Of course, this solution is for XP, but you get the idea.

 

[battmain]

battmain, what shows up?

The popup window. I'm going to try the solution listed by serecyn. Not sure why I didn't think of that. I've gotten three popups already this morning.

 

[dankelt]

If your are getting popup messages that means netbios and/or RCP are not blocked to the internet. Am I the only one that see's this as a security problem? If you are getting these messages, don't just stop the messenger service, get a firewall to protect your server or start filtering ports. Just my opinion though...

 

[Ovatvvon]

Is there a way to track the source IP of anyone that sends these over the internet once it hits the local server? -Ovatvvon :-Q

 

[ashpp]

A firewall would probably be able to log the source IP.

Ash.

 

[dankelt]

This taken from your previous posting

You could do a netstat right after you see the message and try to find it that way. Depending on how they are sending the message you would see connections on UDP ports 137, 138, or TCP ports 135, 139, 445

Only other way I can think of is with some kind of firewall. I use RedHat linux with iptables myself. With that, I can log access to certain ports. You could probably use something as simple as ZoneAlarm to find the source IP address. Either way, you should have some kind of firewall.

 

[Ovatvvon]

I tried installing the trial version of zone alarm. However it blocked my web sites from being available on the internet. Even while making all settings to the lowest available setting (including opening ALL ports) or shutting them off...or closing the program altogether, it still blocked the web sites from being accessable on the internet.

Is there something I did wrong? (I find it hard to believe since I exited the program and it still did it) Or is it not intended for web servers? -Ovatvvon :-Q

 

[dankelt]

I'm not sure about how to configure ZoneAlarm. I myself have never used it. But I believe you have to tell zonealarm wich executables will be allowed to use the internet. If I get a chance I'll install it and play around.

Later,
Dan

 

[battmain]

Seems the fix posted by serecyn worked for me...I had tried to block the ports using Norton Firewall, but it didn't help. It's been a while since a popup has shown up.