# Does my girlfriend have PC spyware or virus? **URL:** \ **Category:** Factual Questions\ **Created:** [September 28, 2003, 6:43pm UTC](https://boards.straightdope.com/t/does-my-girlfriend-have-pc-spyware-or-virus/204336 "2003-09-28T18:43:12Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![AHunter3](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ahunter3/32/368_2.png) [@AHunter3](https://boards.straightdope.com/u/AHunter3)\ **Post date:** [September 28, 2003, 6:43pm UTC](https://boards.straightdope.com/t/does-my-girlfriend-have-pc-spyware-or-virus/204336/1 "2003-09-28T18:43:12Z")
Of the two of us I’m the designated geek, but I’m pretty Mac-centric. I know enough to be concerned but not enough to know how to rule out malware on her system. **The Presenting Symptom** : She’s working in a browser (IE) which happens to have the Google toolbar thingie installed with popup blocker enabled. Also running: FileMaker, Eudora, Word, Excel, Lotus 123. All us a sudden the Microsoft Security alert thingie flashes to the front asking her permission to download some samples of the “best games on the internet” from [NetPalOffers.com](http://NetPalOffers.com) - ?? You know, the kind of alert you usually see only if you click a link to download an executable installer or something. She hadn’t clicked any such thing. The site she was browsing was an [About.com](http://About.com) message board, and [About.com](http://About.com) is heavily stuffed with popup ads and etc but not (to my knowledge) known for trying to INSTALL stuff. The security alert said the Certificate passes muster. This has happened several times in the last few days. **The Environment** : XP Pro, DSL connection to internet (non-static IP), one Microsoft security patch behind at this point (::sigh::), no Kazaa (ever), no instant messaging (ever), no Outlook usage (ever), she doesn’t open attachments from unknown people, file extensions are set to be displayed at all times. Suspicious processes running (things I don’t recognize): CDAC11BA.exe; NIlaunch.exe; lsass.exe; csrss.exe; smss.exe; nvsvc32.exe (don’t laugh at me if some of these are normal or essential XP services or processes) ---
**Author:** ![Kinthalis](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/kinthalis/32/16084_2.png) [@Kinthalis](https://boards.straightdope.com/u/Kinthalis)\ **Post date:** [September 28, 2003, 6:47pm UTC](https://boards.straightdope.com/t/does-my-girlfriend-have-pc-spyware-or-virus/204336/2 "2003-09-28T18:47:44Z")
Hmmm, doesn’t appear to be anything out of the ordinary. Those darn pop ups to install a web service are annoying. Does this happen on her machine ONLY? Or would anyone going to that site have the same problem? (Can you provide a link to test?). You may want to install adware (google it) and see if it finds anything. I sometimes get the gator install BS on certain sites I try to avoid thereafter. ---
**Author:** ![Crusoe](https://avatars.discourse-cdn.com/v4/letter/c/49beb7/32.png) [@Crusoe](https://boards.straightdope.com/u/Crusoe)\ **Post date:** [September 28, 2003, 6:54pm UTC](https://boards.straightdope.com/t/does-my-girlfriend-have-pc-spyware-or-virus/204336/3 "2003-09-28T18:54:06Z")
It does sounds like spyware. I can only recommend downloading Ad-Aware and Spybot S&D (both available from [download.com](http://download.com)) and running them. Of those processes running, CDAC11BA.exe may be unnecessary but doesn’t seem to be spyware (related to a company Macromedia acquired some years ago), NIlaunch.exe may be dubious, but may be perfectly valid (“Net-It” web publishing software), and the others listed are completely valid. ---
**Author:** ![Phage](https://avatars.discourse-cdn.com/v4/letter/p/a4c791/32.png) [@Phage](https://boards.straightdope.com/u/Phage)\ **Post date:** [September 28, 2003, 9:31pm UTC](https://boards.straightdope.com/t/does-my-girlfriend-have-pc-spyware-or-virus/204336/4 "2003-09-28T21:31:19Z")
I second the suggestion of running Ad-Aware. You can get it here: [http://www.lavasoftusa.com/software/adaware/](http://www.lavasoftusa.com/software/adaware/) If you are concerned about a virus, you should download Mc-Afee’s free virus scanner. It might not be the best out there, but it is the best for the money. You can get that here: [http://us.mcafee.com/](http://us.mcafee.com/) I wonder if these two programs could be added to the FAQ or as a sticky post. Many people ask about this, and the answer is always the same. ---
**Author:** ![engineer\_comp\_geek](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/engineer_comp_geek/32/504_2.png) [@engineer\_comp\_geek](https://boards.straightdope.com/u/engineer_comp_geek)\ **Post date:** [September 28, 2003, 9:43pm UTC](https://boards.straightdope.com/t/does-my-girlfriend-have-pc-spyware-or-virus/204336/5 "2003-09-28T21:43:28Z")
CDAC11BA.exe: Background task which is an integral part of MacroVision’s SafeCast copy protection software (software which enables other software manufacturers to protect their products from illegal copying). SafeCast is used in many products such as Intuit’s TurboTax (from version 2002 onward) and quite a few games. NIlaunch.exe: ? lsass.exe: Windows NT4/2000/XP only. LSASS is the Local Security Authentication Server. It verifies the validity of user logons to your PC/Server (in technical jargon : it generates the process that is responsible for authenticating users for the Winlogon service). csrss.exe: Windows NT4//2000/XP only. CSRSS is the Client Server Runtime SubSystem. CSRSS is started by SMSS. When the user application makes a Win32 API call, it is usually CSRSS which communicates with the operating system’s Kernel to execute the API call. CSRSS is also known as the Win32 Subsystem. smss.exe: Windows NT4/2000/XP only. SMSS is the Session Manager SubSystem. SMSS’s purpose is to start, manage, and delete user sessions (or client sessions under Terminal Server). Under Terminal Server the management part includes dealing with the different subsystems (OS/2, Win32, POSIX) which a client session may wish to run. nvsvc32.exe: NVIDIA Driver Helper Service which gets installed under Windows NT4/2000/XP by the NVIDIA drivers for some of their graphics cards (or graphics cards based on an NVIDIA chipset). We do not at this stage know what this process does except consume memory ! And we also have no idea as to what a “Driver Helper Service” is supposed to do !! from: [http://www.answersthatwork.com/Tasklist\_pages/tasklist.htm](http://www.answersthatwork.com/Tasklist_pages/tasklist.htm) ---
**Author:** ![London\_Calling](https://avatars.discourse-cdn.com/v4/letter/l/49beb7/32.png) [@London\_Calling](https://boards.straightdope.com/u/London_Calling)\ **Post date:** [September 28, 2003, 10:26pm UTC](https://boards.straightdope.com/t/does-my-girlfriend-have-pc-spyware-or-virus/204336/6 "2003-09-28T22:26:33Z")
Yes, sounds like she’s picked up something, probably a trojan/spyware of some kind. Find it with Ad-Aware and/or Spyboy (as above), take it out and install Zone Alarm pronto – she really can’t wander around the Internet without at least a Firewall. ---
**Author:** ![AHunter3](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ahunter3/32/368_2.png) [@AHunter3](https://boards.straightdope.com/u/AHunter3)\ **Post date:** [October 31, 2003, 5:05am UTC](https://boards.straightdope.com/t/does-my-girlfriend-have-pc-spyware-or-virus/204336/7 "2003-10-31T05:05:37Z")
Sorry for the delay – we installed as recommended and she hasn’t had an incident since, and she says to tell you folks “thanks” ---
**Author:** ![ftg](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ftg/32/2801_2.png) [@ftg](https://boards.straightdope.com/u/ftg)\ **Post date:** [November 1, 2003, 3:00am UTC](https://boards.straightdope.com/t/does-my-girlfriend-have-pc-spyware-or-virus/204336/8 "2003-11-01T03:00:10Z")
It sure sounds like the MS Messenger service hole being exploited to me. Just turn it off. (And install all the anti-spyware, anti-virus programs anyway.) ---
**Author:** ![sailor](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@sailor](https://boards.straightdope.com/u/sailor)\ **Post date:** [November 8, 2003, 4:19am UTC](https://boards.straightdope.com/t/does-my-girlfriend-have-pc-spyware-or-virus/204336/9 "2003-11-08T04:19:05Z")
> [@](#): > > [http://www.cnn.com/2003/TECH/internet/11/07/microsoft.popup.reut/index.html](http://www.cnn.com/2003/TECH/internet/11/07/microsoft.popup.reut/index.html) > > U.S. regulators said this week that Microsoft Corp. Windows users should turn off a little-used feature that allows unscrupulous marketers to bombard them with unwanted “pop-up” ads. > > Windows users should disable a back-door communications channel called Windows Messenger Service to prevent unscrupulous marketers from filling their screens with unwanted ads, the Federal Trade Commission said Thursday. ---
**Author:** ![elfkin477](https://avatars.discourse-cdn.com/v4/letter/e/a9a28c/32.png) [@elfkin477](https://boards.straightdope.com/u/elfkin477)\ **Post date:** [December 30, 2003, 1:56pm UTC](https://boards.straightdope.com/t/does-my-girlfriend-have-pc-spyware-or-virus/204336/10 "2003-12-30T13:56:46Z")
> [@](#): > > \*Originally posted by ftg \* > \*\*It sure sounds like the MS Messenger service hole being exploited to me. Just turn it off. (And install all the anti-spyware, anti-virus programs anyway.) \*\* Sorry for the bump, but… how does one go about turning this off? ---
**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\ **Post date:** [December 30, 2003, 2:40pm UTC](https://boards.straightdope.com/t/does-my-girlfriend-have-pc-spyware-or-virus/204336/11 "2003-12-30T14:40:18Z")
Here is the easy way: [Shoot the Messenger](http://grc.com/stm/ShootTheMessenger.htm) Or, if you want to do it manually: [Disabling the Messenger Service](http://www.itc.virginia.edu/desktop/docs/messagepopup/)