Hi, PROs. I run Windows XP (genuine copy) and AVG-Free antivirus. Recently I am noticing that as soon I go into the net a pop-up window arrives saying: Message from WINDOWS to ERROR on 6/13/2006 2:11:35 AM WARNING! WINDOWS REQUIRES IMMEDIATE ATTENTION. Windows has found CRITICAL SYSTEM ERRORS To fix the errors please do the following: 1. Download Registry Repair from 2. Install Registry Repair 3. Run Registry Repair 4. Reboot your computer FAILURE TO ACT NOW MAY LEAD TO DATA LOSS AND CORRUPTION! OK Clicking OK will immediately close this one and produce another similar window and so on. The website in the message varies but none of them exist. I realize that this could be a virus. What do I do? Regards.

Get a firewall, block incoming port 139. Or disable the windows messaging service.

The fact that the "popup" links directly to a site other than Microsoft should clue you in that you're receiving an ad, not a warning message generated by Windows. You should probably get a spyware/adware cleaning and blocking program. Never click "Ok" or the linked site on any kind of pop-up if it looks at all like it may not be an actual Windows error.

Thanks, everybody. Following your clues, I searched in Windows Help, and I found this: Stop receiving pop-up ads that have the title Messenger Service If advertisements open on your computer in a window titled Messenger Service, your system might not be secure. Although the name is similar, these messages—which are sometimes called "messenger spam"—are not related to Windows Messenger, MSN Messenger, or other instant messaging programs. Disabling instant messaging programs is not necessary and will not prevent Messenger service spam. To help protect your computer, you should enable Windows Firewall (or a firewall of your choice) and also make sure that the Messenger service feature in Windows XP is disabled. And squid_80 advised to block incoming port 139. How does one do that and what are the other consequences? Regards.

My I ask why port 139? Thanks Mike

You should download spybot from safer-networking.org and the update, install both and run the spybot check. Its just a free tool that will check for any spyware on your computer, a very useful one too.

Ouch! If you're directly connected to the internet, you're probably owned by now and sending out spam without realizing it, and it might be a good idea to reinstall. But, on the chance that it's not (or removable), get (no free versions since bought by CA, but the last is still good), look up and get Windows Defender, spybot, and adaware, and make sure AVG is up-to-date. (I'd run them in that order.) Tiny will keep your system from being open to anyone, and the others can hopefully clean up anyone who already got on. If you are owned, a may be necessary.

Most commonly you'll find a poorly protected Windows file/print sharing service on ports 139 and 445. If you're on a Windows-based network that's running NetBios, it's pretty normal to have port 139 open in order to facilitate the NetBios protocol. If you're not on a network using NetBios, there's no reason to have that port open. Most networks that use NetBios and connect to the Internet also have a firewall that blocks incoming traffic on port 139, that way, you're sure that all NetBios traffic originates from within your own network. Blocking port 139 gets into denial of file sharing and remote procedure issues, but I doubt that either of these is important to you unless you're doing some heavy lifting. Other than digging into your event logs to see what's specifically happening on your system, you probably don't need to panic. Follow the guys' advice on spyware identifier/removers and make sure you're behind a software firewall, for sure. XP has an embedded firewall that's "off" by default (I know, it's not the best, but a quick fix for the short-term); if you don't have it enabled, find it and do so. Pull up your XP help files and key in "firewall", it'll tell you how to do this. Most spyware is merely inconvenient, some is malicious; you've got to constantly be on the lookout for this junk. ammck55

Oops, I meant port 135. But blocking both is recommended anyway (plus like foxyshadis said your box is probably 0wned by now if port 135 is open).

I think I believe the opposite to you Lenny, good antivirus/spybot software is far more important than a firewall. Every now and again I start up my copy of TPF, but usually I'm happy with my NOD32 + Spybot/Windows Defender setup.