Strange Jscript Popups on my website

[sanuk]

Hi,

Something very strange is happening !!!!
I am getting reports from some users out of Australia that when they log on to my website, they are getting JavaScript "Russian Porno Popups". My website does not have any Popups at all !!!

I myself are located in Thailand and from here my website appears normal (meaning No Strange Popups), a friend of mine out of France also does not have these intruder-Popups.

Would it be possible to get some reports from some different locations in the world if you are getting these intruder-Popups on my website or not. (if possible also someone out of Australia).

The website = http://thaipro.com

Thanks alot,
Regards,
Sanuk

[cg9com]

Its fine here.
Is it possible this user has a case of spyware?

[sanuk]

Hi,
Thanks cg9com
where is here ??? I hope you are checking from Australia ??

Thanks alot and regards,
Sanuk

[arnyinc]

There are no popups for me either. I looked through the three .js files I saw included on the first page and nothing looked suspicious.

cg9com and I are both from the USA. I'm not a stalker, I just noticed his location in his profile :)

[sanuk]

Thanks for the answers.

On another forum, I received a sort of solution for the problem for my user who is getting these popups. . . . . hope it is only this.
here under is the solution I received
========
I suspect your users are using windows XP and their connection is not firewalled.
If so then an abuse of the Microsoft message function is causing this. This problem with popups is very common on XP for the moment.

Enabling XP's firewall will stop all of this.
To firewall your computer from the Internet, do the following:
Select properties for the dial-up connection you are using
(or from the dial up or Network card if you are using this)
Go to the advanced tab and enable the firewall.
Normally this should stop the unwanted popups
========
Regards,
Sanuk

[Roy Sinclair]

It is highly unlikely that the problem is the messaging component in XP. That particular problem causes a different type of popup to occur and doesn't require surfing to a web page or even having IE open.

What's much more likely in this case is that the users who are affected have loaded some software on their system which is adding popup ads to the web site they are visiting. It's most likely to be some sort of spyware/adware like Gator (to use a well known example of the genre).

[arnyinc]

I agree with Roy, it sounds like a different problem. Assuming you have your messenger service running type this into a DOS window:

net send 127.0.0.1 Here's an annoying message

Wait a little bit (10 seconds) and you'll get a popup message. That is the type of message that the person on the other board was talking about.

Do you have any partners/advertisers that might include some code like this in some code that you put on your page? It's hard to tell since you don't even see this popup ad.

[sanuk]

hi guys,
No, I do not have any partner sites to who I am connected. I also DO NOT work with Banner sites.
My website stands completely alone.

I am now completely sure that these banners do not come from my website, we have run some tests and the server has also been checked. Nothing is hacked.

No one, that has checked my site gets those banners.
The idea of spyware on the users computer seems now the most likely.

I know thatt there is somewhere a cleaning software for this, named "adaware" or something. to clean hidden spyware on a computer. Will inform myself further abour this.
Regards,
Sanuk