removing startup program

  • Thread starter Thread starter DebR
  • Start date Start date
D

DebR

While working on my computer, a friend turned off my
firewall (ugh)...During that time a program was put
on/entered my computer- causing a Pop-up saying "to remove
this go to Messengerkiller.com (and buy their product).
Since there's no "msconfig" on Win2000 (I'm brand new to
this OS) I don't know how to find and remove this program
and others that pop up...unwanted on my computer. Can
someone PLEASE help. An answer directly to my e-mail
would be greatly appreciated: (e-mail address removed)

Thanks
 
Start\Settings\Control Panel\Administrative Tools\Computer
Management(Local)\System Information\Software Environment\Startup
Programs|View|Advanced, then in the "Location" column, you'll find the path
to the "Startup" location either in the "Startup" directories or from the
registry's "Run" keys.

%ALLUSERSPROFILE%\Start Menu\Programs\Startup
%USERPROFILE%\Start Menu\Programs\Startup

You can delete the shortcuts that you no longer want to run.


HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

You can delete the string value for the program you no longer want to run.

You might give this a try. Also update your AV definitions.
http://www.lavasoftusa.com/software/adaware/
 
I did just what you said...found the startup info but
don't see anything that would cause this popup to occur.
I don't know anywhere else to look. I've run Live-Update
on my Norton Anti-Virus and Firewall and scanned the
computer for viruses...it comes up clean. I've done a
search on files added within the last couple of days and
also searched for words that might point me to this
program. I'm not finding anything that looks like it.
Do you have any other suggestions how to track down this
file?
-----Original Message-----
Start\Settings\Control Panel\Administrative Tools\Computer
Management(Local)\System Information\Software Environment\Startup
Programs|View|Advanced, then in the "Location" column, you'll find the path
to the "Startup" location either in the "Startup" directories or from the
registry's "Run" keys.

%ALLUSERSPROFILE%\Start Menu\Programs\Startup
%USERPROFILE%\Start Menu\Programs\Startup

You can delete the shortcuts that you no longer want to run.


HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

You can delete the string value for the program you no longer want to run.

You might give this a try. Also update your AV definitions.
http://www.lavasoftusa.com/software/adaware/


--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft MVP [Windows NT/2000 Operating Systems]

DebR said:
While working on my computer, a friend turned off my
firewall (ugh)...During that time a program was put
on/entered my computer- causing a Pop-up saying "to remove
this go to Messengerkiller.com (and buy their product).
Since there's no "msconfig" on Win2000 (I'm brand new to
this OS) I don't know how to find and remove this program
and others that pop up...unwanted on my computer. Can
someone PLEASE help. An answer directly to my e-mail
would be greatly appreciated: (e-mail address removed)

Thanks


.
 
I got an answer that appears to have worked great...I hope
it helps some others: here's what I was
told..............>>The popup sounds like it came from the
messenger service. Not Microsoft
Instant Messenger, but the messenger service. The
messenger service was
originally intended for system administrators to send
popup windows to
users telling them about important stuff like system
reboots and such.
Recently it's been hijacked by spammers to tell you about
Viagra, fake
college degrees, etc.

It probably didn't install a file anywhere - the messenger
service isn't
capable of doing that. You're probably just on a list of
IPs that get a
spam message every x hours.

To shut it down, go to Control Panel > Administrative
Tools > Services.
Double-click "messenger" and set the startup type
to "disabled". No need
to reboot or anything. The effect is immediate.

Don't worry about losing functionality. We disable it as
a rule where I
work and we've not seen any software cease to function.
The only thing I
can think of is that old Windows NT4 print servers send
their "print job
is done" messages via messenger.
 
Greetings --

Does the title bar of these pop-ups read "Messenger Service?"

This particular "sales method" is strikingly similar to the
"protection" rackets offered to small businesses by organized
criminals. Yes, it's a scam; no reputable business would need to
resort to extortion. Particularly since they're trying to sell you a
type of protection that is already available to you free of charge.

This type of spam has become quite common over the past few
months, and unintentionally serves as a valid security "alert." It
demonstrates that you haven't been taking sufficient precautions while
connected to the Internet. Your data probably hasn't been compromised
by these specific advertisements, but if you're open to this exploit,
you may well be open to other threats. Install and use a decent,
properly configured firewall. (Disabling the messenger service, as
some people recommend, only hides the symptom, and does nothing to
secure your machine.) And ignoring or just "putting up with" these
messages and the problem they represent is particularly foolish.

Messenger Service of Windows
http://support.microsoft.com/default.aspx?scid=KB;en-us;168893

Messenger Service Window That Contains an Internet Advertisement
Appears
http://support.microsoft.com/?id=330904

Stopping Advertisements with Messenger Service Titles
http://www.microsoft.com/windowsxp/pro/using/howto/communicate/stopspam.asp

Blocking Ads, Parasites, and Hijackers with a Hosts File
http://www.mvps.org/winhelp2002/hosts.htm

Oh, and be especially wary of people who advise you to do nothing
more than disable the messenger service. Disabling the messenger
service is a "head in the sand" approach to computer security.

The real problem is _not_ the messenger service pop-ups; they're
actually providing a useful service by acting as a security alert. The
true problem is the unsecured computer, and you've been
advised to merely turn off the warnings. How is this helpful?

Equivalent Scenario 1: Somewhere in a house, a small fire starts,
and sets off the smoke alarm. You, not immediately seeing any
fire/smoke, complain about the noise of the smoke detector, and are
advised to remove the smoke detector's battery and go back to sleep.

Equivalent Scenario 2: You over-exert your shoulder at work or
play, causing bursitis. After weeks of annoying and sometimes
excruciating pain whenever you try to reach over your head, you go to
a doctor and say, while demonstrating the motion, "Doc, it hurts when
I do this." The doctor, being as helpful as some of your respondents,
replies, "Well, don't do that."

I'm beginning to think that the people deliberately posting such
bad advice are hacker-wannabes who have no true interest in helping
you secure your system, but would rather give you a false sense of
security while ensuring that your computer is still open to
exploitation.


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH
 
Back
Top