How'd they do this??? It's freakin' me out!

[Binky]

This just popped up on my screen.
http://vancouverjazz.com/tmp/popup.jpg
I wasn't even looking at a web site. IE was open but to my own site, and in the background.

[JWM]

Two things come to mind:

1.) Delayed popup. I particularly hate these. If you're going to subject me to a popup, have the decency to do it while I'm on your site, and not 60 seconds from now when I'm on someone else's site and blaming them.

2.) Spy Ware. I'd download and run Ad-Aware if you don't already have it, just to be sure.

Oh, and I suppose it could always be your run of the mill virus, but I'd bet on one of the above.

jim

[TVB]

Here's an article from the NYTimes about them that ran a few days ago.


NEW YORK (AP) -- As if junk e-mail and pop-up ads weren't annoying enough on their own, now there's pop-up junk e-mail.

A developer of bulk-mail software has figured out how to blast computers with pop-up spam over the Internet through a messaging function on many Windows operating systems. The function was designed for use by computer network technicians to, for instance, warn people on their systems of a planned shutdown.

The pop-up messages appear on recipients' computers in separate windows, similar to pop-up ads that appear when a user goes to a Web site.

But there's a difference: Anyone can send the messages, and there's no need for the user to have an Internet browser open.

Gary Flynn, a security engineer at James Madison University, where several messages were received, calls the technique worse than e-mail spam.

``This pops up on the screen,'' he said. ``It's almost like somebody barging in your office and interrupting you.''

Zoltan Kovacs, founder of the company that makes the new software, officially condemns spamming but acknowledges some customers buy it for that.

``If some people use it for bad things, they should take their own responsibility, but it's their own problem,'' Kovacs said.

He said his tool can help system administrators send alert notices to network users more efficiently.

However, his Web site touts the software's advertising and marketing potential. He said he has sold more than 200 copies since his $699.99 product was released two months ago.

The new spam technique, first reported by Wired.com, represents the latest attempt to bypass the increasingly sophisticated e-mail spam filters employed by leading Internet service providers and individual users.

It also circumvents state and other laws designed to curb junk e-mail, Kovacs said.

Kovacs said his company is based in Romania. A demo copy of the software contains a Plantation, Fla., address, but he said that was old. Kovacs refused to discuss his location, other than saying he is in the United States.

In recent weeks, Internet users have reported receiving pop-up messages such as one touting university degrees without classes or books.

Security firm myNetWatchman.com, which monitors some 1,400 computer networks worldwide, also detected unsolicited connection attempts of the pattern used by Kovacs' software, DirectAdvertiser.

Unlike e-mail, recipients can only receive messages if their computers are on while the messages are being sent. And the software can only send text -- not images or clickable links as are found in pop-up ads and e-mail.

The software itself does not hack into computers. Rather, it uses the Messenger service that comes turned on by default with many Windows systems, including 2000 and XP, said Philip Sloss, an independent security consultant in San Diego.

Messenger, not to be confused with the MSN Messenger instant-messaging program, is meant for system administrators to broadcast service notices.

But if a system administrator can use Messenger, so can someone connecting through the Internet from the outside, said Lawrence Baldwin, president of myNetWatchman.com.

Flynn worries that hackers might one day use the technique to persuade users to change their passwords or otherwise compromise security.

Users can disable Messenger through their operating system's control panel, although doing so could interfere with some anti-virus and other applications that send such messages. Kovacs even provides instructions on his Web site.

^------

On the Net:

DirectAdvertiser, for opting out: http://www.directadvertiser.com/optout.html

http://mynetwatchman.com

[JWM]

Great, something new and annoying for the X-10 people to try out eventually, no doubt.

jim

[Monty]

http://www.directadvertiser.com/optout.html

redirects to

http://www.directadvertiser.com

talk about lowlifes on the internet, geeze.

Mont

[kitchin]

It's really just a "domain for sale" page now. I can't understand the thinking at Microsoft, or "at Redmond" as people say when avoiding the term. Bill Gates seems like a decent guy, what with his charity and all. And Seattle's a good place. Arrrgghhhh.

[TVB]

I saw that redirect also. I was kind of surprised the NYTimes included it. But I didn't want to change what they had included when I cut and paste.

[Dunx]

I should imagine that using a firewall would block this (configured to only let through specific ports), which you should be doing anyway really what with Windows having so many holes for exploitation (read about the bots used for DDoS attacks (https://grc.com/dos/grcdos.htm) this morning - v. scary).

Still sucks, though.

[Andilinks]

I had another catastrophic (XP home ed) system failure last night, I was wondering if something got past ZoneAlarm.

The system would spontaneously log-off and shut down if ANY application were opened, including system restore and task manager. Had to do another system recover with all the settings changes and tool-bar defaults returning. Even had to re-install Office with CD keys... This is getting tiresome, Apple and Linux are looking better every day.

Andi

[manish]

Whenever I see bizarre things like this, I do the following (under windows):

1. Check the Startup Folder for weird stuff.
2. Check the Windows Registry Startup for weird stuff (HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run)
3. If nothing weird can be seen, I run AdAware:
http://www.lavasoftusa.com/

I use Mozilla so that I can disable popups. The only problem with my setup is that I use Outlook. If there is an annoying popup due to an email, I cannot disable it....

Manish

[Brian]

Hello,

This is actually using windows administrative messenger service. You will want to turn this service OFF in your services menu on windows.

I found a link (below) that discusses this in more detailed. You might check this out.

http://www.mynetwatchman.com/kb/security/articles/popupspam/

-Brian

[kitchin]

In WindowsXP, etc., you disable the "Messenger" service in Control Panel / Administative.

In Win98, there is something similar to Messenger called WinPopup. Either rename winpopup.exe, or use Add/Remove Programs.

http://www.lavasoftsupport.com/index.php?act=ST&f=8&t=726&hl
http://www.wown.com/j_helmig/winpopup.htm

[ryount]

I thought messenger service was limited to 255 chars or so. But that shot seems to say otherwise. Pretty easy to close that hole though.

[Paul Hicks]

I use Mozilla so that I can disable popups.

I'm also using Mozilla. How do you disabole popups within Mozilla?

[sheila]

Edit >> Preferences >> Advanced >> Scripts & Windows

uncheck the box that says: "Open unrequested windows"