systemsoap advertisement

A friend who is running windows 2000pro has been getting a popup advertisement for system soap it is a popup. He has run spybot and adaware but the ad comes back at random intervals. When the ad appears it is always on top of everything else and the only way he has been able to get rid of it has been to reboot.
Please any advice would be greatly appreciated.

 

Disabling Windows Messaging Service, not MSN messenger

 

Have run norton, spybot and adaware with no find on any. Did find a cookie for system soap and a sub directory in the program dirctory. The log file in the directory does not indicate anything bad but????. No one is awaree of who installed this. My thought is to rmove everything wit any refereence to system soap. Any thoughts?

 

robwhite, this pop up is probably using Windows Messaging, it is installed by default on W2K, W2K Pro, and XP. It was originally meant to be used to send messages from one computer user to another across a network. Such as the Admin telling the user to reboot the computer before going off to lunch as some update could have been done.
You are seeing the result of someone abusing this, and this service will accept SPAM messages from the internet.
From a different webpage.
Over the past year or two, Windows users have been plagued increasingly by gray pop-up boxes, sometimes quite large, bearing advertisements from spammers and ending with an "Okay" button. The spammers are able to send messages this way by abusing the Windows Messenger service. There is no patch that will prevent users from receiving such spam, although most firewall software will prevent it. The vast majority of users never use the Messenger service, and simply disabling it entirely will prevent it from being abused.

 

I think this is the popnav.com hijack
where iefeatures show's up.. probaly niether SpyBot nor adaware target it yet.. I know SpyBot does not as yet

You could post a hijackthis log,, heres how
Post a log from HijackThis so one of the Helpers/experts can see
what's going on.The current version is 1.97.7 [created by merijn bellekom]

Get it here http://radiosplace.com/
choose save, NOT OPEN
Save it to a PERMANANT folder,(for example C:\hijackthis) double-click HijackThis.exe,
and hit "Scan ". When the scan is finished, the "Scan" button will change into a "Save Log" button. Press that, save the log, load it in Notepad, and copy its contents here.
Most of what it lists will be harmless, even essential,DON'T fix anything yet please. Also If you've used it before please dont have anything excluded

 

Thanks very much for the recommendations and I appologize to Markp62 but must plead that I did not recognize the recommendation made, you got to be real specific for us intermediates. At least for this one. I will try that if the problem recurs. So far deleting all reference to system soap has seemed to stop the problem if it trecurs will do the first recommendation then if that does not fix will try the hijacvk rout. Will advise after a few days if the problem recurs. Again thanks so very much for the advice.

 

This is all you needed to read.

Under Control Panel, select Administrative Tools.
Select Services.
Double-click on Messenger.
In the Messenger Properties window, select Stop, then choose Disable as the Startup Type.
Click OK.

OR

Go to this link and get Shoot The Messenger, free.
http://grc.com/stm/shootthemessenger.htm

 

Just to close this one out. I re,mmoved all reference to soap and all folders associated. The problem has not reoccurred. Apparently someone had installed the thing on the computer and not told anyone. Thanks for all the recommendations and advice. It is always sincerely appreciated.