Web ads in event viewer

Ok, let me see if I get this right.
You are checking through your Event Viewer logs (the System logs) and you are seeing something similar to the following:

Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 10/25/2002
Time: 8:52:04 AM
User: N/A
Computer: SENDINGMACHINE
Description:
Application popup: Messenger Service : Message from SENDINGMACHINE to 10.1.1.211 on 10/24/2002 2:36:35 PM

INTERNET ADD STATEMENT HERE!!!!

Something like that, right? Then what is happening is your Win2KServer is open to receive NET SEND popup messages.
If this is on a public web server or any other public server (i.e. a server that is connected directly to the Internet) then you need to block TCP port 139. That port is open, and someone has determined a valid username/password on your server. With that info, they are authenticating to your server, and sending the NET SEND message.

This is bad! This is a security breach, technically! In the Event Viewer log of the message, is there a machine name listed next to "Computer:"?? That could tell you the machine name of the sending computer; unfortunately, this field may be blank or it might have spoofed information. I know of 1 tool that will let you send NET SEND popup messages, and you can put in a fake machine name as your origination name! So, this might give you real info, or it might not.
Either way, you aren't gonna get the IP address of the sender. You need to check your firewall (if you have one) and/or router trace pathing for this info.

You need to lock down your server to stop this illegal intrusion.

hope this helps

A more accurate desciption.
When I access the event viewer there are text messages, Ads with chinese web site and other european links contained therein.Same solution?

Thank you for answering. No, the message is not like the one mentioned in your answer. This is a file server that is not directly connected to the internet. When I return monday i will close the port. I am open to any other suggestions.

Again Thanks

If this is an internal file server, then you can't shut down that port. If you did, then no one could get files from your file server! You don't want that.
Can you take an image snapshot of what you see when you open Event Viewer, put the image on a web server somewhere, and post a link to the image??? I have to see this! I have never heard of this one.
Images in the Event Viewer window??? Wow! I didn't think it would be possible.

Here is a copy of the event with server name and IP *ed out
http://www.slxtimes.com/re-chinese.htm, Email:sales@slxtimes.com
Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 9/16/2002
Time: 7:35:06 AM
User: N/A
Computer: ********
Description:
Application popup: Messenger Service : Message from ZMZ to ***.*.***.*** on 9/14/2002 9:22:02 PM

legitimacy of facts while creating a permanent record of a telephone conversation what was agreed on).
Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 9/16/2002
Time: 7:35:06 AM
User: N/A
Computer: *******
Description:
Application popup: Messenger Service : Message from ZMZ to ***.*.***.*** on 9/14/2002 9:22:02 PM

I have noticed the same thing from University Diplomas. For computer name, the name of my server appears - NOT where it is coming from.
The phone number for University Diplomas is
1-281-587-6101
The message comes from Webpopup07

What you're seeing is a new type of spam. Spammers can send these messages to a group of IP addresses and, if you dont' have a firewall blocking the requests, a message pops up with the advertisement.
Check out this article:
http://zdnet.com.com/2100-1105-962483.html

It is possible to disable the messenger service, but I'd recommend shutting down the port it uses on your firewall. As long as your file server sits behind your firewall, you won't prevent users from accessing files on the server.

Hope this helps,
Andy

well it surely is a new spam trend that`ll get common in a few days maybe. Then y not go for good firewalls. try the product below...

http://www.surfcontrol.com

well it surely is a new spam trend that`ll get common in a few days maybe. Then y not go for good firewalls. try the product in Network Management in the site link given below...

http://www.logix.com.sa