Avoiding or removing messenger

[C. Holland]

I do not use Messenger. Is there anyway to delete it
from my computer (Windows XP) and/or stop the annoying
pop-ups?

Thanks for any help.

 

[Kay Hangman]

As the administrator, go to your Administrative Tools folder and select
"Services". Scroll down the list to "Messenger", right click it, select
Properties, then choose "Disabled" under Startup type. You can also "Stop"
the service if it's currently active.

 

[Bruce Chambers]

Greetings --

Does the title bar of these pop-ups read "Messenger Service?"

This particular "sales method" is strikingly similar to the
"protection" rackets offered to small businesses by organized
criminals. Yes, it's a scam; no reputable business would need to
resort to extortion. Particularly since they're trying to sell you a
type of protection that is already available to you free of charge.

This type of spam has become quite common over the past few
months, and unintentionally serves as a valid security "alert." It
demonstrates that you haven't been taking sufficient precautions while
connected to the Internet. Your data probably hasn't been compromised
by these specific advertisements, but if you're open to this exploit,
you may well be open to other threats. Install and use a decent,
properly configured firewall. (Merely disabling the messenger
service, as some people recommend, only hides the symptom, and does
little or nothing to truly secure your machine.) And ignoring or just
"putting up with" these messages and the problem they represent is
particularly foolish.

Messenger Service of Windows
http://support.microsoft.com/default.aspx?scid=KB;en-us;168893

Messenger Service Window That Contains an Internet Advertisement
Appears
http://support.microsoft.com/?id=330904

Stopping Advertisements with Messenger Service Titles
http://www.microsoft.com/windowsxp/pro/using/howto/communicate/stopspam.asp

Blocking Ads, Parasites, and Hijackers with a Hosts File
http://www.mvps.org/winhelp2002/hosts.htm

Oh, and be especially wary of people who advise you to do nothing
more than disable the messenger service. Disabling the messenger
service, by itself, is a "head in the sand" approach to computer
security. The real problem is _not_ the messenger service pop-ups;
they're actually providing a useful, if annoying, service by acting as
a security alert. The true problem is the unsecured computer, and
you've been advised to merely turn off the warnings. How is this
helpful?

Equivalent Scenario 1: Somewhere in a house, a small fire starts,
and sets off the smoke alarm. You, not immediately seeing any
fire/smoke, complain about the noise of the smoke detector, and are
advised to remove the smoke detector's battery and go back to sleep.

Equivalent Scenario 2: You over-exert your shoulder at work or
play, causing bursitis. After weeks of annoying and sometimes
excruciating pain whenever you try to reach over your head, you go to
a doctor and say, while demonstrating the motion, "Doc, it hurts when
I do this." The doctor, being as helpful as some of your respondents,
replies, "Well, don't do that."

I'm beginning to think that the people deliberately posting such
bad advice are hacker-wannabes who have no true interest in helping
you secure your system, but would rather give you a false sense of
security while ensuring that your computer is still open to
exploitation.


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Bruce Chambers]

Greetings --

Please stop posting potentially harmful advice.

Disabling the messenger service, by itself, is nothing more than a
"head in the sand" approach to computer security. The real problem is
_not_ the messenger service pop-ups; they're actually providing a
useful, if annoying, service by acting as a security alert. The true
problem is the unsecured computer, and you're only advise is to merely
turn off the warnings. How is this helpful?

Equivalent Scenario 1: Somewhere in a house, a small fire starts,
and sets off the smoke alarm. The home-owner, not immediately seeing
any fire/smoke, complains about the noise of the smoke detector, so
you tell him to remove the smoke detector's battery and go back to
sleep, or whatever else he was doing.

Equivalent Scenario 2: You over-exert your shoulder at work or
play, causing bursitis. After weeks of annoying and sometimes
excruciating pain whenever you try to reach over your head, you go to
a doctor and say, while demonstrating the motion, "Doc, it hurts when
I do this." The doctor, being as helpful as you are, replies, "Well,
don't do that."

An essential component of securing a PC against outside attacks,
short of disconnecting it from the Internet, is to install and
*properly* configure a firewall.


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Kay Hangman]

This advice is actually from MS-MVP Kelly at
http://www.kellys-korner-xp.com/xp_abc.htm

Under the Services - Disable section:

To disable unneeded startup services for a safer, faster XP, use the
"Services" Admin Tool (Control Panel/Administrative Tools/Services). If you
are a single user of a non-networked machine, you can disable the following
items, with no ill effect.

Alerter
Clipbook
Computer Browser
Fast User Switching
Human Interface Access Devices
Indexing Service (Slows the hard drive down)
Messenger
Net Logon (unnecessary unless networked on a Domain)
Netmeeting Remote Desktop Sharing (disabled for extra security)
Remote Desktop Help Session Manager (disabled for extra security)
Remote Procedure Call Locator
Remote Registry (disabled for extra security)
Routing & Remote Access (disabled for extra security)
Server
SSDP Discovery Service ("Universal P'n'P", & leaves TCP Port 5000 wide open)
TCP/IP NetBIOS Helper
Telnet (disabled for extra security)
Universal Plug and Play Device Host
Upload Manager
Windows Time
Wireless Zero Configuration (for wireless networks)
Workstation

endquote

Feel free to disagree with her (or her source) and ask her to remove it from
her site if you wish. However, I have had most/all these services disabled
since I had my current system and it has done nothing harmful, and I've had
a firewall installed as well. Of course one would have a firewall, but the
question was how one can go about avoiding/removing Messenger, not how one
can install a firewall.

 

[Bruce Chambers]

Greetings --

Kelly also advises people to use a firewall. If you're going to
cite a reference, use _all_ of it.

Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Kay Hangman]

Sorry, but that is the entire reference for that section (have you read
it?). It begins at "Services - Disable" and ends at "Services - Listed and
Explained". There is no mention of a firewall at that point. In fact, after
doing a "Find" for the word "firewall" on that entire "S" page, the word
"firewall" exists in only two unrelated instances, neither of which are
suggesting the use of a firewall and there's certainly nothing in relation
to turning off the Services.

I'm curious what reference you are suggesting I use. Regardless, that still
has nothing to do with telling me (or Kelly) that the advice is harmful and
asking me to stop posting it. Obviously your opinion differs from others,
and I can respect that. What you should have said, then, is that one should
also be sure to have a firewall installed and configured correctly. That has
no argument from me. Again, that wasn't the question of this thread, though,
regardless of whether the advice is good or not.

 

[Jack Seredyniecki]

Dude, no one gives a shit about your logorrhea!
This kid specifically asked how to remove/disable the service and his
question was properly answered.

 

[Alun Jones [MS MVP]]

This advice is actually from MS-MVP Kelly at
http://www.kellys-korner-xp.com/xp_abc.htm

Even MVPs can be wrong - in this case, though, you've misinterpreted, I
think. The official line, as well as the opinion of most of the MVPs with
whom I've discussed it, is that disabling Messenger Service is not as good a
solution as installing a firewall is.

Under the Services - Disable section:

To disable unneeded startup services for a safer, faster XP, use the
"Services" Admin Tool (Control Panel/Administrative Tools/Services). If you
are a single user of a non-networked machine, you can disable the following
items, with no ill effect.

It's a fairly commonly accepted principle that you don't run processes that
you don't need. However, when you remove something that is expected to be
there as part of the operating system's installation, you run into the
likelihood that another application may rely on them. For instance, I'm
told that some antivirus scanners use Messenger Service to tell you about
viruses that they have detected. If you have such an AV program, disabling
Messenger Service might actually reduce your security, because you won't
receive notifications that would help you keep from running a virus.

Feel free to disagree with her (or her source) and ask her to remove it from
her site if you wish. However, I have had most/all these services disabled
since I had my current system and it has done nothing harmful, and I've had
a firewall installed as well. Of course one would have a firewall, but the
question was how one can go about avoiding/removing Messenger, not how one
can install a firewall.

Actually... you quoted it yourself:

The telling phrase "and/or stop the annoying pop-ups" indicates that the
reason the OP wanted to kill Messenger Service is to stop the spam. The
spam is the problem, apparently, not the Messenger Service. Stopping the
spam can be done either by blocking the packets that trigger them, or by
ignoring those packets. Unfortunately, packets on that same set of ports
that the Messenger Service spam uses are also among the most frequently used
by hackers. Any time you see a security alert that mentions "NetBIOS",
"RPC" or "DCOM", you could think to yourself "ah-ha - these are the same
sort of packets that I have already blocked", or you could think to yourself
"oh - that's why my machine keeps crashing".

A firewall doesn't prevent all methods of intrusion by nefarious and odious
individuals, but it is a basic requirement of any Internet connection these
days - and firewalls saved a bunch of people from the recent Blaster worm.
A firewall has the advantage of shutting out these Messenger Service
pop-ups, too, without requiring that you guess that Messenger Service isn't
going to be used. Oh, and because of the way Messenger Service does its
messaging, sadly, if you disable it, anyone who sends to it is not going to
notice and try another method.

Finally, Messenger Service does the great service of letting you know if the
firewall fails, because it'll start popping up ads the moment it does.

Alun.
~~~~

[Please don't email posters, if a Usenet response is appropriate.]

 

[Alun Jones [MS MVP]]

Sorry, but that is the entire reference for that section (have you read
it?). It begins at "Services - Disable" and ends at "Services - Listed and
Explained". There is no mention of a firewall at that point. In fact, after
doing a "Find" for the word "firewall" on that entire "S" page, the word
"firewall" exists in only two unrelated instances, neither of which are
suggesting the use of a firewall and there's certainly nothing in relation
to turning off the Services.

You know what else it doesn't mention? It doesn't mention Messenger Service
spam, or pop-ups. If Kelly's as 'on-the-ball' as I think, this is _only_
her list of unnecessary (for many people) services, that she thinks most
people can safely disable. In fact, since the quote starts with "If you are
a single user of a non-networked machine", it obviously _cannot_ apply to
anyone that gets Messenger Service spam, because the only way to get it is
through a network link. You're barking up the wrong tree.

I'm curious what reference you are suggesting I use. Regardless, that still
has nothing to do with telling me (or Kelly) that the advice is harmful and
asking me to stop posting it. Obviously your opinion differs from others,
and I can respect that. What you should have said, then, is that one should
also be sure to have a firewall installed and configured correctly. That has
no argument from me. Again, that wasn't the question of this thread, though,
regardless of whether the advice is good or not.

I've addressed this elsewhere - the poster was asking "how can I shoot my
neighbour's dog, or stop it barking" - you'd have to be crazy to offer
instructions on starting a cross-fence war, but you'd be answering the guy's
question to suggest that you cross the front yard to ask your neighbour if
he can train his dog to stop barking at night.

In this case, you've got two situations:

1. Kill the Messenger Service - as mentioned before, the fact that you're
getting Messenger Service spam indicates that your NetBIOS and RPC ports are
wide open to all comers. NetBIOS is what your system uses to do Windows
file sharing. This means that it would be a really bad idea to let it be
open to any and all. The only people who would think it a good idea are
hackers who are interested in exploiting your machine or reading your file
shares.

2. Protect the NetBIOS and RPC ports (and goodness knows what other ports) -
wow, what harm does this have? It might be claimed that this stops you from
sharing files across the Internet, but that's rather like saying you'd
really far prefer shouting your secrets from roof-top to roof-top than using
the telephone. There are far better ways of sharing files over the
untrusted space of the Internet.

The only reason I can think of for suggesting the disabling of the Messenger
Service, rather than the installing of a firewall, is if you'd really rather
still be able to hack into other people's machines.

Alun.
~~~~

[Please don't email posters, if a Usenet response is appropriate.]

 

[Alun Jones [MS MVP]]

Dude, no one gives a shit about your logorrhea!

Magniloquence is only of use when you're able to read.

This kid specifically asked how to remove/disable the service and his
question was properly answered.

I quote the question:

Is there any way to ... stop the annoying pop-ups?

The form of the question indicates that the poster will be happy if you can
tell him how to stop the pop-ups. That has been done, and overdone.
Killing the Messenger Service may stop the pop-ups, but it's a stupid idea.
If you're getting pop-ups, it indicates that your firewall is crappy, or
non-existent. Having a firewall is a requirement of being on the Internet
for these last few years. Not having a firewall is a basic problem that
needs to be fixed. And it just so happens that installing one fixes the
problems.

Alun.
~~~~

[Please don't email posters, if a Usenet response is appropriate.]