Ok I am new to forum and was just reading this and I have a simular experience.
OK I have the Kaspersky Internet Security 6 Software version 6.0.0.300 installed
on my system. I have a Acer Aspire 3100 Notebook. I have reformed the hard drive
(lost all those partions Acer puts on there computers BTW). Anyway I have one partition now
thats like 50gb. I have legal Windows XP Pro installed that I own and is legit. I have no
Illegal software on my computer. But getting back to the story.
I was getting these win. messenger.exploit attacks every once in while.
So I download a KL Dump program from Kaspersky FTP Site and did a Dump on
UDP Port 1026. I ran the test for 1 Hour and received the exploit attack about 58 minutes
into the dump. Anyway I was Shocked when I opened the DMP file with Notepad.
There were these messages from www.regdocrepair.com which buy the way is Registry Sweeper and had the messages " your Windows XP registry needs to repaired" anyway I am using a Dial up connection and my Anti-Hacker (Firewall) in KIS 6 is set to High Security and my Settings are Stleathed also. I ran a check on www.grc.com with the Shields Up tool, anyway all my ports are Stleathed and I also checked Port 1026 and Port 1434. Anyway I was trying to make a point here does it really matter if you a legal copy of Windows XP. Also I have Messenger diabled in the Services Tab.
I think this is more like in catagory of Spyware or Advertising I would say than conterfeiting.

How do we Stop this?
Or can we?

Good questions I would think based on this information I have presented that it would suggest everybody that has an Internet Connection or at least a Dial Up Connection is vuneralable to these meesages even when you have your connection firewall on High and stleathed. I just formated my hard drive and installed Windows XP Pro I know there is nothing wrong with my registry and I darn well know that I will never buy Registry Sweeper even if was free I would never install it my computer.

Thank you for your time.

Rick

If you continue to receive such pop-ups etc:

As a first response you might want to post a HijackThis log for review by our Pros in that section:

Please follow the instructions HERE & then post your log in a new thread in the Spyware, Adware, Viruses and HijackThis Logs section.
(Not in this section please).

Please specify what issues you appear to be experiencing along with your log.

Originally Posted by jephree

If you continue to receive such pop-ups etc:

As a first response you might want to post a HijackThis log for review by our Pros in that section:

Please follow the instructions HERE & then post your log in a new thread in the Spyware, Adware, Viruses and HijackThis Logs section.
(Not in this section please).

Please specify what issues you appear to be experiencing along with your log.

Hello
I do NOT receive pop up's. from Windows only from my AV that it's blocked attack.
I have Messenger Service in Services disabled.
This is from a dump from report that I did on port 1026 with the Kaspersky KL Dump tool.
I will post my finding in Spyware forum. Is there a way to attach a file to my post that someone can look at? It is a .dmp file, but I opened it in notepad, to see the contents.
Can I copy contents and post in my thread in spyware forum?
BTW I used the tools L2M and BFU that I saw in spyware forum also used ewido malware
4.0 (it has alot more tools than the 3.5 btw, but is still in beta) ewido did find anything.
I am using Acronis True Image so I can restore image if something is not working correctly.

Sorry. I see link for attachments in Additional Options.

Rick

downloads.com
Zone