It sound like some kind of spyware that was inadvertently installed with or without your permission. Try this: Download a copy of ADAWARE (http://www.lavasoftusa.com/ make sure to get the latest definitions) and scan your machine for spy ware. It will give you a chance to delete all offending programs after scan. -Aaron ----------------------- Aaron Dokey - MIS Reid Tool Supply 2265 Black Creek Rd. Muskegon, MI 49444 (231) 777-3951 (231) 767-3772 (Direct) ----------------------- -----Original Message----- From: Sullivan, Glenn [mailto:GSullivan@xxxxxxxxxxxxxx] Sent: Friday, October 04, 2002 12:41 PM To: 'windows2000@xxxxxxxxxxxxx' Subject: [windows2000] Re: Virus/Worm via Messenger Service? Stop the messenger service. Glenn Sullivan, MCSE+I MCDBA David Clark Company Inc. -----Original Message----- From: Rayneman [mailto:reignofdeath@xxxxxxxxxxxxx] Sent: Friday, October 04, 2002 12:25 PM To: windows2000@xxxxxxxxxxxxx Subject: [windows2000] Re: Virus/Worm via Messenger Service? I periodically get popup messages that are similar to IM messages but claim to be a Windows Messenger Service or some such thing....I don't remember installing any such thing but evidently I have some type of messaging service on this W2K Server machine that can send/receive messages in the background and I wish to COMPLETELY DISABLE this function. Please advise me as to what to do and where to do it. I'd like to think that I am relatively proficient in this OS but this is an obvious indication that I am NOT. And for those that are curious...they are all spam messages and I'm scared of what access this IM gives itself in my server. Thank you in advance. Ray S. raynserv@xxxxxxxxx -----Original Message----- From: windows2000-bounce@xxxxxxxxxxxxx [mailto:windows2000-bounce@xxxxxxxxxxxxx]On Behalf Of Scott Ehrlich Sent: Friday, October 04, 2002 9:58 AM To: windows2000@xxxxxxxxxxxxx Subject: [windows2000] Virus/Worm via Messenger Service? Last night around 5pm EST we received a Messenger Service window from a host called WX2. Most people, across subnets, received a poem, credited to Henry Cuyler Bunner (1855-1896) will a hallmark of "Provided by http://www.ALLprice.info"; Of our two NT 4 domain controllers, one received the message intact, the other just received "Message from WX2 to <domain controller> on 10/3/2002 <timestamp>" but no body of the message. Anyone heard of anything like that? nbtstat shows no such host, as does nslookup. Thanks for any insight. Scott ================================== To Unsubscribe, set digest or vacation mode or view archives use the below link. http://thethin.net/win2000list.cfm ================================== To Unsubscribe, set digest or vacation mode or view archives use the below link. http://thethin.net/win2000list.cfm ================================== To Unsubscribe, set digest or vacation mode or view archives use the below link. http://thethin.net/win2000list.cfm ================================== To Unsubscribe, set digest or vacation mode or view archives use the below link. http://thethin.net/win2000list.cfm