Messenger Service

[Guest]

For the last month or two I've been having pop-ups from the messenger service come up at random. Most of them are advertisements for one thing or another. Today in particular it has been especially bad. I've been contiuously getting this one pop-up about some Windows patch, which seems very much illegitamate. My computer isn't hooked up to any other computers or a network, so I find it kind of strange. Is there any way to go about fixing this?

(Example of problem)

Application popup: Messenger Service : Message from MICROSOFT NETWORKS to WINDOWS USER on 12/17/2003 10:26:37 PM

Microsoft Security Bulletin MS03-043

Buffer Overrun in Messenger Service Could Allow Code Execution (828035)

Affected Software:

Microsoft Windows NT Workstation
Microsoft Windows NT Server 4.0
Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Win98
Microsoft Windows Server 2003

Non Affected Software:

Microsoft Windows Millennium Edition

Your system is affected, download the patch from the address below !
FIRST TYPE THE URL BELOW INTO YOUR INTERNET BROWSER, THEN CLICK 'OK'

www.windowspatch.net

 

[Gary Tsang]

For more information about the Messenger Service Spam and how to stop them
from your computer visit this link:
http://www.microsoft.com/windowsxp/pro/using/howto/communicate/stopspam.asp

These windows are sent to your system using the Messenger service. You
should either use a firewall to block your file/printer sharing ports
(TCP/UDP ports 135, 137, 138, 139, and 445) from the Internet.

First thing you'll want to do is to install or enable a firewall:
http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q330904

Disabling Messenger Service can be a good idea, but it does not solve the
real problem.

The ads are not the real problem, the ads are only a symptom of a larger
issue. The real problem is open ports that allow unwanted traffic into the
computer.

Disabling Messenger does nothing for the open ports. You would need a
firewall that controls the traffic.

The above solution will not work if you have AOL as is not compatible with
Windows XP Internet Connection Firewall (ICF). If you have AOL, you should
contact AOL and/or get a 3rd party firewall.

Disable Messenger Service:
Start/Control Panel, click Administrative Tools, click Services.
Go down to "Messenger".
Right click "Messenger" and select Properties.
Hit the Stop Button under Service Status section
Then under Start-up select DISABLE
Click OK and follow prompts

Check this link:
http://www.aumha.org/a/noads.php
Run Ad-Aware (free version) or Spybot to check for spyware:
http://www.lavasoft.de/
Or
http://spybot.eon.net.au/

For internet pop-ups, try one of these:
http://www.panicware.com/
http://www.bysoft.se/sureshot/stopthepop/index.html
http://www.popupbuster.com/PopUpBuster/
http://www.kolumbus.fi/eero.muhonen/FS/
http://www.endpopups.com/
http://www.adshield.org/


--
Gary Tsang
Microsoft MVP - Windows XP Shell/User
http://www.microsoft.com/mvp

For the last month or two I've been having pop-ups from the messenger

service come up at random. Most of them are advertisements for one thing or
another. Today in particular it has been especially bad. I've been
contiuously getting this one pop-up about some Windows patch, which seems
very much illegitamate. My computer isn't hooked up to any other computers
or a network, so I find it kind of strange. Is there any way to go about
fixing this?

(Example of problem)

Application popup: Messenger Service : Message from MICROSOFT NETWORKS to

WINDOWS USER on 12/17/2003 10:26:37 PM

 

[Clint Eastwood]

For the last month or two I've been having pop-ups from the messenger

service come up at random. Most of them are advertisements for one thing or
another. Today in particular it has been especially bad. I've been
contiuously getting this one pop-up about some Windows patch, which seems
very much illegitamate. My computer isn't hooked up to any other computers
or a network, so I find it kind of strange. Is there any way to go about
fixing this?

(Example of problem)

Application popup: Messenger Service : Message from MICROSOFT NETWORKS to

WINDOWS USER on 12/17/2003 10:26:37 PM

Microsoft Security Bulletin MS03-043

Buffer Overrun in Messenger Service Could Allow Code Execution (828035)

Affected Software:

Microsoft Windows NT Workstation
Microsoft Windows NT Server 4.0
Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Win98
Microsoft Windows Server 2003

Non Affected Software:

Microsoft Windows Millennium Edition

Your system is affected, download the patch from the address below !
FIRST TYPE THE URL BELOW INTO YOUR INTERNET BROWSER, THEN CLICK 'OK'

www.windowspatch.net

You should find out who hosts there site and report them as spammers. I hope
you didn't install anything off that site because it is most likely some
nasty software to turn your computer into some spam zombie.

windowspatch.net resolves to 66.223.104.49

Here is the people you need to email a compalint to: (e-mail address removed)

OrgName: Interland
OrgID: INTD
Address: 34 Peachtree St., NW
City: Atlanta
StateProv: GA
PostalCode: 30303
Country: US

NetRange: 66.223.0.0 - 66.223.127.255
CIDR: 66.223.0.0/17
NetName: INTERLAND-7
NetHandle: NET-66-223-0-0-1
Parent: NET-66-0-0-0-0
NetType: Direct Allocation
NameServer: A.NS.INTERLAND.NET
NameServer: B.NS.INTERLAND.NET
NameServer: C.NS.INTERLAND.NET
Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
RegDate: 2002-01-25
Updated: 2003-09-05

TechHandle: BW995-ARIN
TechName: Wright, Barry
TechPhone: +1-404-720-8301
TechEmail: (e-mail address removed)

 

[Bruce Chambers]

Greetings --

This type of spam has become quite common over the past year, and
unintentionally serves as a valid security "alert." It demonstrates
that you haven't been taking sufficient precautions while connected to
the Internet. Your data probably hasn't been compromised by these
specific advertisements, but if you're open to this exploit, you may
well be open to other threats, such as the Blaster Worm that recently
swept cross the Internet. Install and use a decent, properly
configured firewall. (Merely disabling the messenger service, as some
people recommend, only hides the symptom, and does almost nothing to
truly secure your machine.) And ignoring or just "putting up with"
the security gap represented by these messages is particularly
foolish.

Messenger Service of Windows
http://support.microsoft.com/default.aspx?scid=KB;en-us;168893

Messenger Service Window That Contains an Internet Advertisement
Appears
http://support.microsoft.com/?id=330904

Blocking Ads, Parasites, and Hijackers with a Hosts File
http://www.mvps.org/winhelp2002/hosts.htm

Oh, and be especially wary of people who advise you to do nothing
more than disable the messenger service. Disabling the messenger
service, by itself, is a "head in the sand" approach to computer
security. The real problem is _not_ the messenger service pop-ups;
they're actually providing a useful, if annoying, service by acting as
a security alert. The true problem is the unsecured computer, and
you've been advised to merely turn off the warnings. How is this
helpful?


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

For the last month or two I've been having pop-ups from the

messenger service come up at random. Most of them are advertisements
for one thing or another. Today in particular it has been especially
bad. I've been contiuously getting this one pop-up about some Windows
patch, which seems very much illegitamate. My computer isn't hooked up
to any other computers or a network, so I find it kind of strange. Is
there any way to go about fixing this?

(Example of problem)

Application popup: Messenger Service : Message from MICROSOFT

NETWORKS to WINDOWS USER on 12/17/2003 10:26:37 PM