Strange Packet RPC-SPYWARE

I get these all the time, even though my IP is dynamic and I'm
on and off the net all the time, for short periods.

63.187.192.128 was my address at the time.

I've included the packet identifier line and the strings each contained.



381 41.589995 219.150.118.21 -> 63.187.192.128 DCERPC Request

SPYWARE ADVISORY
USER
.................................................. ...............................
...........
Important Alert Message: Tuesday, June 15
YOUR COMPUTER MAY BE INFECTED WITH UNAUTHORIZED
SPYWARE PROGRAMS
.................................................. ...............................
...........
EASY INSTRUCTIONS To Learn How To Fix Your Computer:
1. Grab a pen and write down the web site address www.spw9c.com
on a piece of paper. Keep it in a safe place.
2. Open your Internet Explorer, Netscape, or AOL web browser.
3. Type the web site address www.spw9c.com into the "Address" box
at the top of your web browser and press the "Go" button.
TIP: DO NOT PRESS THE OK BUTTON BELOW UNTIL
YOU WRITE DOWN WWW.SPW9C.COM
OR YOU WILL LOSE THIS WINDOW


================================================== ==============================



382 41.590135 63.187.192.128 -> 219.150.118.21 ICMP Destination unreachable

SPYWARE ADVISORY
USER
.................................................. ...............................
...........
Important Alert Message: Tuesday, June 15
YOUR COMPUTER MAY BE INFECTED WITH UNAUTHORIZED
SPYWARE PROGRAMS
.................................................. ...............................
...........
EASY


I don't mind them sending me the packets, but I DO mind my computer respond-
ing with an ICMP packet.

No RPC server is running here.


What's going on?!


AC

On Tue, 15 Jun 2004 18:21:58 GMT, Alan Connor <(E-Mail Removed)> wrote:
>
>
>
> I get these all the time, even though my IP is dynamic and I'm
> on and off the net all the time, for short periods.
>
> 63.187.192.128 was my address at the time.
>
> I've included the packet identifier line and the strings each contained.
>
>
>
> 381 41.589995 219.150.118.21 -> 63.187.192.128 DCERPC Request
>
> SPYWARE ADVISORY
> USER
> .................................................. ..............................
> ..........
> Important Alert Message: Tuesday, June 15
> YOUR COMPUTER MAY BE INFECTED WITH UNAUTHORIZED
> SPYWARE PROGRAMS
> .................................................. ..............................
> ..........
> EASY INSTRUCTIONS To Learn How To Fix Your Computer:
> 1. Grab a pen and write down the web site address www.spw9c.com
> on a piece of paper. Keep it in a safe place.
> 2. Open your Internet Explorer, Netscape, or AOL web browser.
> 3. Type the web site address www.spw9c.com into the "Address" box
> at the top of your web browser and press the "Go" button.
> TIP: DO NOT PRESS THE OK BUTTON BELOW UNTIL
> YOU WRITE DOWN WWW.SPW9C.COM
> OR YOU WILL LOSE THIS WINDOW
>
>
>================================================= ===============================
>
>
>
> 382 41.590135 63.187.192.128 -> 219.150.118.21 ICMP Destination unreachable
>
> SPYWARE ADVISORY
> USER
> .................................................. ..............................
> ..........
> Important Alert Message: Tuesday, June 15
> YOUR COMPUTER MAY BE INFECTED WITH UNAUTHORIZED
> SPYWARE PROGRAMS
> .................................................. ..............................
> ..........
> EASY
>
>
> I don't mind them sending me the packets, but I DO mind my computer respond-
> ing with an ICMP packet.
>
> No RPC server is running here.
>
>
> What's going on?!
>
>
> AC
>

Problem solved, and I learned a lot more than I would have if
someone had just handed me the answer on a platter.

All's well that ends well.

I posted another question using an alias and a different ISP and
got an answer right away.

So the question is, though it hardly matters: Did this question stump
the experts or were they shunning me for having politically-incorrect
opinions?

Who cares? One can always find a way around fascist assholes, can't
one?

Been doing it all my life, and never failed yet.

AC