Old W2K trouble

[whitecree]

Go ahead, laugh. Who the heck bothers with Win2000 any more, right?

(shrug) Ya work with what ya got.

Two older Dell systems, one of'em an optplex gx100 running a P3 @ 455 MHZ with built in pretty much everything. The 2nd culprit is another Dell, Optiplex gx150 running @ 1 Ghz, pretty much everything built in except the ATI 128 pro video.

Both running Windows 2000 with SP4, AVG antivirus. The Gx100, although pokey, is running fairly smoothly, no real trouble.

The Gx150, though, when on the 'net, keeps getting these pesky (and phoney) "Alert! Your system is about to self destruct unless you go to this site and download the tools to blah blah blah"

Said the spider to the fly. Pfui!

Before the Gx100 had SP4 installed, it used to get these same garbagey messages. With SP4 in place, it doesn't. But the Gx150, even with SP4 in place, keeps getting this crap.

What did I miss? Or is there some way to shut these asshats out for good?

[pc_guy]

It's likely Windows Messenger that's causing the trouble, don't you just love MS?,

Go to the Control Panel => Administrative Tools => Services
Find "Messenger" in the list, right-click and stop the service, also right-click again and go to Properties, select the start up type to "Disabled" from the drop-down to stop it from loading next time.

Problem solved.

[Panda Man]

ohnoes! teh spywarez have invaded!

No more pr0n downloadz for you!

Ok, in all seriousness, give it a good scrub down. Grab AVG anti-spyware free

AVG Free Advisor: Free anti-virus, anti-spyware and anti-malware tools

to combat the malware. If this doesn't help, hit it with ad-aware

Ad-Aware SE Personal - Lavasoft

and spybot S&D

The home of Spybot-S&D!

Still appearing? The malware may be loaded in memory, and it might be hard to remove it. Post the logfile of a hijackthis scan and we'll see if we can find anything that shuldn't be there.

|MG| Free Download - HijackThis 1.99.1

EDIT - I don't think its messenger. That's a pretty suspicious error message. In fact I don't recall seeing the service in win2K, but I'll have to check.

Oh and one last thing, on old systems, win2K isn't bad, just buggy.

[pc_guy]

Originally Posted by Panda Man

ohnoes! teh spywarez have invaded!

No more pr0n downloadz for you!

Ok, in all seriousness, give it a good scrub down. Grab AVG antivirus and anti-spyware free editions

AVG Free Advisor: Free anti-virus, anti-spyware and anti-malware tools

to combat the malware. If this doesn't help, hit it with ad-aware

Ad-Aware SE Personal - Lavasoft

and spybot S&D

The home of Spybot-S&D!

Still appearing? The malware may be loaded in memory, and it might be hard to remove it. Post the logfile of a hijackthis scan and we'll see if we can find anything that shuldn't be there.

|MG| Free Download - HijackThis 1.99.1

You are a bit paranoid.
It's only the MS Messenger, I hope...unless...
...they are out to get him!

[Panda Man]

Originally Posted by pc_guy

You are a bit paranoid.
It's only the MS Messenger.

See the edit. I don't think its messenger, that's a very odd error message, and I never got it in windows 2K. Malware caused the message, and its probably an infection mixed in using the messenger service. You can disable the service, but the infection is still there. I recall the service now, I always ad it disabled though, no point in letting it run.

[whitecree]

It says it is MS messenger when it pops up. The site that it claims to have the solutions are all crapware sites, just looking for someone gullible enough to go "oh no! Woe is me! I'd better download from these helpful people right away!"

I've done a complete system scrub. Deleted the partition, reset a partition, formatted as FAT, deleted the partition, reset, formatted as NTFS, installed the OS, then SP4, various drivers (chipset/video/etc). After each portion of the operation, I'd do a full power down, no warm restarts. Setup for internet with medium security levels, don't even get a chance to open Firefox and WHAP! Along comes the first huckster.

I know Win2K had some serious holes in it, but this is just plain silly!

BTW, I forgot to mention I did a pre-scrub run of ad-aware, spy sweeper, av scans from AVG, Norton AND Panda. You would not believe the crap I found, which is what led me to do the scrub.

I'll see about disabling the messenger. Who wants that crap, anyway?

[pc_guy]

I can bet 120% it will stop as soon as you disable the service.

[Panda Man]

Originally Posted by whitecree

It says it is MS messenger when it pops up. The site that it claims to have the solutions are all crapware sites, just looking for someone gullible enough to go "oh no! Woe is me! I'd better download from these helpful people right away!"

I've done a complete system scrub. Deleted the partition, reset a partition, formatted as FAT, deleted the partition, reset, formatted as NTFS, installed the OS, then SP4, various drivers (chipset/video/etc). After each portion of the operation, I'd do a full power down, no warm restarts. Setup for internet with medium security levels, don't even get a chance to open Firefox and WHAP! Along comes the first huckster.

I know Win2K had some serious holes in it, but this is just plain silly!

BTW, I forgot to mention I did a pre-scrub run of ad-aware, spy sweeper, av scans from AVG, Norton AND Panda. You would not believe the crap I found, which is what led me to do the scrub.

I'll see about disabling the messenger. Who wants that crap, anyway?

Here is a list of bugs fixed in SP4 to scare the hell out of you

List of bugs that are fixed in Windows 2000 Service Pack 4

Did you have a data backup? After formatting and reinstalling, its possible that you loaded the malware in with your backup and and unloaded it after restoring. But if disabling the messenger service helps, go for it!

btw, I still don't see how I'm paranoid.

[pc_guy]

Originally Posted by Panda Man

btw, I still don't see how I'm paranoid.

Maybe you're just careful,
I on the other hand only run AV and a basic firewall which keeps me safe, no need for any fancy spyware removers, firewall is set to block everything except firefox, email and ftp. Nothing is going in or going out.

[Panda Man]

Originally Posted by pc_guy

Maybe you're just careful,
I on the other hand only run AV and a basic firewall which keeps me safe, no need for any fancy spyware removers, firewall is set to block everything except firefox, email and ftp. Nothing is going in or going out.

Are you entirely sure? Software firewalls can be easily beaten, particularly since port 21 is open, and you never know what you pick up when surfing. I'd rather have the anti-spyware over a virus also. Just run spybot and see what you get.