windows "Registry" problem

I formated my harddrive yesterday and did a dual boot with windowsXP and PCBSD. While using XP I kept getting this popup that looks like an XP message box that says "There is errors in your registry got fix this problem go to www.whateversite.com. So I went to the site and it wants me to pay for some program. It gives me a different website eachtime and in the message it says if you buy this program you will not receive this message anymore. The message says it from System Alert and it gives the date and time. I ran Spybot S&D and it didnt help. Ill post a screenshot of the message when i get home. Any suggestions?

sorry about the dual post can a mod please delete one?

1st thing I would do is run this . Spybot is ok but nowhere near as thorough as panda. Only problem is panda doesn't remove spyware, just viruses, but 1st things 1st. Let's 1st find out for certain if there IS any spyware, then we can worry about removing.

Running a firewall (either at your network boundary) or on your local system that doesn't allow external connections? Seen this before with people that were still running the messenger service (not msn messenger, but the netbios messenger service) that didn't filter the incoming traffic...So its not necessarily 'spyware' on your system that could be the source of the messages...Most of the times I saw this kind of spam, the spammer would connect directly to the program's port (most microsoft ephemerals start at 1025 and go to around 1034, depending on how much crap you are running) instead of first querying the RPC (135) to find the right port...Assuming XP SP2, try from the command prompt running: netstat -nab, it should show you every port open on your system and what program is listening to it (and any external addresses connected to those services)...



/neb

By formatting and setting up dual boot I'm assuming you reinstalled XP? Did you install the latest servicepack and patches after that?

Yes i reinstalled XP it was SP2. I haven't pached the system yet (that will come later tonight).

I am going with my gut here..I run spyware doctor zonealarm and avg antivirus and have been pretty lucky so far..Do not forget the all important windows firewall if you do not have any other..I know zonealarm is annoying at first because it will ask you permissions for just about everything going in and out but you should know by now what is permitted and what not..there after it runs qiute nicely i think..just my 2 cents..

Ive got the windows firewall enabled. Ill check out zonealarm when I get home though. Im just trying to get rid of those annoying messages.

Wait, I re-read it and I think I know what it is. This explains how to turn off the internal server messaging in win2k and XP (also in NT). It's often used to spam, I had to turn it off for the same reason. I didn't catch the description you gave the 1st time through.

Thanks JP ill try it when I get home and let you know if it worked :)

I bet my left kidney that's what it is. This "looks like an XP message box" is the part I glossed over the 1st time. Now I realize what you meant, and I've had it happen to me on win2k.

It worked....Thanks JP.

Another left kidney saved!

Quote:

---

Wait, I re-read it and I think I know what it is.

---

JPnyc:
was it your re-reading the original post, or reading nebulus200's post?

Quote:

---

Originally Posted by nebulus200

Seen this before with people that were still running the messenger service ...

---

Krypt - the popup you're seeing is from windows messenger. Go into Control Panel > administrative tools > services and disable 'messenger service' - no more bs popups from companies trying to spam you.

I'd also scan for spyware like is suggested earlier in the thread since most of the companies that spam with this technique usually are unscrupulous enough to stick some into their sites.

Hope that helped!
|ce

[edit] MEH! teach me not to read the whole thread before offering solutions! JPNyc had it right with his link. [/edit]

Glad you guys figured it out, I'm also wondering if I was trying to speak in a vacuum :)

Anyway, the reason I didn't suggest disabling the service, but rather filtering incoming traffic, is that if those messages are making it your system, then you've got bigger problems because god only knows what else is making it through your firewalls and what other risks you are under because of it...

With that being said, one of the first things I do when I build a Windows system is go through and disable a large portion of the 'default' running services, messenger included...under the principle that if a daemon isn't listening, it for the most part doesn't matter if its patched or not (not always true, but in general its sound advice, not to mention beneficial in that you are no longer wasting system resources on something that isn't being used). I'd strongly encourage you to research why that traffic was making it through to your system in the first place...

/neb

Quote:

---

Originally Posted by mjk

Another left kidney saved!

---

:D

Sorry Neb, I did skip over the other posts.

Nebulus: Could you put together a quick list of the services I should disable?

*snicker* a quick search here and :
http://antionline.com/showthread.php...ndows+services

To save time, pasting the 2 of three sites HTRegZ mentioned:
http://www.codecavalier.com/blackvip...servicecfg.htm
http://www.theeldergeek.com/services_guide.htm

I also recall seeing this on digg not to terribly long ago and a search over there came up with:
http://www.techtree.com/techtree/jsp...112&cat_id=584