Pop up ads

[CHARLIE]

How do I stop these Microsoft Internet Explorer popup ads?
I have Earthlink Explorer popup blocker. It blocks all
the other ads but not M I E ads.
Thank you!

 

[Kelly]

Not enough info given. Start here, Charlie and run each of them. It takes
the combo.
Cleaning Up XP: http://www.kellys-korner-xp.com/xp_c.htm#cleanup

 

[Guest]

Download Sp2 which blocks pop ups

Go here:
http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/sp2wuins.mspx

 

[Kelly]

The final of SP2 isn't out yet for download.

 

[Guest]

Go into control pannel
Click on systems
Click on services
Scroll down until you get to messenger
double click on messenger and click on disable and stop
and then you should not get any more annoying pop usp

Steve

 

[Jim Byrd]

Hi Steve -
There are currently two classes of things going on that are causing people
popup difficulties. If you get popups even when your browser is not
connected to the Internet with a title bar reading "Messenger Service", then
these are most likely due to open NetBios TCP ports 135, 139 and 445 and UDP
ports 135, 137-138 and a UDP port in the range of 1026-1029.. You really
need to block these with a firewall as a general protection measure. You can
stop the popups by turning off Messenger Service; however, this still leaves
you vulnerable. If you have an NT-based OS such as XP or Win2k, you should
probably also specifically block TCP 593, 4444 and UDP 69, 139, 445, and
install the very important 824146 patch from MS03-039, here:
http://support.microsoft.com/default.aspx?kbid=824146 to block the Blaster
worm as well as several other parasites.



See: Messenger Service Window That Contains an Internet Advertisement
Appears http://support.microsoft.com/?id=330904 which identifies reasons to
keep this service and steps to take if you do.

You can test your system and follow the 'Prevention' link to get additional
information here:

http://www.mynetwatchman.com/winpopuptester.asp Unless you have very good
reasons to keep this active, it should be turned off in Win2k and XP. Go
here and do what it says:
http://www.itc.virginia.edu/desktop/docs/messagepopup/ or, even better, get
MessageSubtract, free, here, which will give you flexible control of the
service and viewing of these messages:

http://www.intermute.com/messagesubtract/help.html Recommended.

(FWIW, ZoneAlarm's default Internet Zone firewall configuration blocks the
necessary ports to prevent this use of Messenger Service. I don't know the
situation with regard to other firewalls.)

Messenger Service is not per se Spyware or something that MS did wrong - It
provides a messaging capability which is useful for local intranets and is
also sometimes (albeit nowdays infrequently) used by some applications to
provide popup messages to users. However, it can also be (and now frequently
is) used to introduce spam via this open NetBios channel. For a single user
home computer, it normally isn't needed and can be turned off which will
eliminate the spam popups. This DOESN'T, however, remove the vulnerability
of having these ports open, when in fact they aren't needed, since they can
be perverted in other ways as well, some of which can be much more damaging
than just a spam popup.





If you're getting a lot of popups while surfing, then the following may be
useful:

Before you try to remove spyware using any of the programs below, download a
copy of LSPFIX from any of the following sites:

http://www.cexx.org/lspfix.htm

http://www.spychecker.com/program/winsockxpfix.html (if your OS is Win2k or
XP) The process of removing certain malware may kill your internet
connection. If this should occur, this program, LSPFIX, will enable you to
regain your connection.


In the following, all of these removal tools should be run from Safe mode
when possible



Popups - The best way to start is to get Ad-Aware 6.0, Build 181 or later,
here: http://www.lavasoftusa.com/support/download/. Update and run this
regularly to get rid of most "spyware/hijackware" on your machine. If it has
to fix things, be sure to re-boot and rerun AdAware again and repeat this
cycle until you get a clean scan. The reason is that it may have to remove
things which are currently "in use" before it can then clean up others.

Another excellent program for this purpose is SpyBot Search and Destroy
available here: http://security.kolla.de/ SpyBot Support Forum here:
http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi. I recommend
using both normally. Update before starting, then after fixing things with
SpyBot S&D, be sure to re-boot and rerun SpyBot again and repeat this cycle
until you get a clean "no red" scan. The reason is that SpyBot sometimes has
to remove things which are currently "in use" before it can then clean up
others.

Then, there are a variety of third party "Popup Killers" available. I
normally use AdShield, which, if you maintain its Block List every now and
then, almost totally stops this. In addition, it stops a variety of
ads/banners/etc. (particularly spyware like doubleclick) on pages I access.
This is probably all you'll need; however, I've also investigated a program
called webwasher which appears to be very good, but decided that AdShield
was sufficient. At the bottom of this post, you'll find a list provided
courtesy of bc_acadia of a number of free popup blockers with links.

****** NOTE: As of 28 Apr 03 AdShield appears to have partnered with a new
reseller, and AdShield is no longer free. There is a trial version of
AdShield3; however, IMO it is seriously crippled in not being able to import
or export block lists and I think for reasonable utility one would have to
go to the full version. While I don't normally recommend non-free software,
I personally will continue to use AdShield3, since I think it is the best
currently available combined Popup/Ad/Malware blocker, but you should be
aware of the fact that it now costs, ($29.95), whereas the earlier versions
upon which I based my original recommendation were free, although not nearly
as capable as the AdShield3 release. I've included below links to both the
older free version and the new paid version. You'll have to investigate and
make your own choice in the matter. *******

Here are a number of AdShield-related links:

http://www.fsd1.org/technology/Files/AdShield.exe - AdShield1.2 (free)

http://www.internettechs.net/utilities/AdShield.exe - AdShield1.2 (free)

http://ftp.ural.ru/home/index/windows/networking/utils/AdShield -
AdShield1.2 (free)

http://www.megalog.ru/info/utilz/AdShield.zip - AdShield1.2 (free)

http://www.allstarss.com/store/adshield.html - AdShield3

http://www.ad-shield.com/ AdShield3 Info/Purchase/Block List

http://www.mvps.org/winhelp2002/block.txt - (Mike Burgess' .txt Block List
for AdShield - Recommended)

http://www.mvps.org/winhelp2002/block.zip - Mike Burgess' Zipped Block List
for AdShield - Recommended)

http://www.songwave.com/software/adshield_blocklist.txt (40,000 pornsites
blocked - *VERY* large list - use at your own risk)

http://www.chrismyden.com/temp/block.abl (chrismyden's blocklist in .abl
format - Recommended)

http://www.staff.uiuc.edu/~ehowes/resource.htm#AdShield (Eric Howes AGNIS
for AdShield block list - Recommended) (BTW, Eric's site contains a wealth
of very valuable information about all aspects of net security - Very Highly
Recommended)



Here's a good AdShield test site, courtesy of siljaline: "Make ***SURE***
you have your block scripted popups enabled

http://www.mediaboy.net/1010100-1100001-1111010/gahk/>>>> [Warning this URL
opens a multitude of Browser windows almost instantly - YOU'VE BEEN
WARNED!]"

http://www.webwasher.com - Webwasher



Additionally, some people have recommended Popup Stopper and PopupBuster,
but they have also been reported or experienced to cause perceived problems
for some people with "normal" links in IE6 such as Google search results and
links from OE. Some proponents of PopupBuster assert, however, that this is
normal operation for this program under

certain circumstances which can be overridden if necessary. YMMV Another
"Proxy" type blocker similar to Webwasher and Proxomitron but supposedly a
bit easier to configure is Privoxy here: http://www.privoxy.org/ Also, the
free Google Tool Bar has a builtin popup blocker which is fairly effective.



Also, if you're comfortable allowing changes to the registry, there is an
approach, IE-SPYAD, using the restricted sites list which can be used for
scripted popups. I use this and it works very well. See here:
https://netfiles.uiuc.edu/ehowes/www/resource.htm




There is additonal information about setting up and using AdShield, and
about using the Restriced Zone (and an additional list) here:
http://www.mvps.org/winhelp2002/hosts.htm

Lastly, ZoneAlarmPro3/4 has added provisions for stopping adds/popups,
handling cookies, web bugs, and scripting/ActiveX components in addition to
it's firewall functionality. Not free, but I have used it with my other
AdBlocking stuff (AdShield, etc.) turned off as a test, and it appears to be
very good indeed. So far I've experienced no problems at all with it set in
its High Security modes for Ads although others have reported the need to
temporarily turn it off to reach some sites. Also, Agnitum's Outpost
Firewall supports a plug-in for this: "Pre-configured to block most banner
advertisement. Can be configured manually or by simply dragging and dropping
unwanted banners into the Ad Trashcan." I have no experience as to how
effective it is, but I have received a favorable report.

There's good information about hijacking in general and fixes available for
specific hijackers here: http://www.spywareinfo.com/articles/hijacked/

http://gmpservicesinc.com/Articles/hijack.asp

http://www.mvps.org/inetexplorer/Darnit.htm#pop_up

http://www.doxdesk.com/parasite/

bc_acadia's list:

"Some popup blockers. All of these are 100% pure freeware, no trial periods.
Some of these do more than just handle popups.

Pow!: http://www.analogx.com/contents/download/network/pow.htm

NoAds: http://www.southbaypc.com/NoAds/

PopupEraser: http://www.webknacks.com/popuperaser.htm

Stop-the-Pop: http://www.bysoft.se/sureshot/stopthepop/index.html

Internet Organizer: http://www.sf.yucom.be/wdprojects/

PopKi: http://ranfo.com/popki.html

PopUpKiller: http://sourceforge.net/projects/puk/

AdCruncher Proxy:

http://mysite.verizon.net/~mr_fish/AdCruncher/ReadMe.html

KillAd: http://www.iomagic.org/fsc/

ClickOff: http://www.johanneshuebner.com/en/download.html

PopupBuster: http://www.popupbuster.com/PopUpBuster/

Free Surfer: http://www.kolumbus.fi/eero.muhonen/FS/

Window Shades: http://www.g-m-m.com/Software/WindowShades/index.php

AdShield (my personal favorite): http://www.ad-shield.com/

PopupStopper: http://www.panicware.com/popupstopper.html

Proxomitron (Is no longer supported and has a learning curve):
http://www.proxomitron.org/

For those who don't want third party stuff, your own pc's built-in

host file:

http://www.mvps.org/winhelp2002/hosts.htm and

http://www.accs-net.com/hosts/



Here is a review of 61 popup killers, not all of them are free:

http://www.popup-killer-review.com/index.htm"

NOTE that this site also contains a good, comprehensive series of popup
killer tests. Some good additional tests are also available here:
http://www.webknacks.com/aptest.htm



There's another popup test page here:
http://www.kephyr.com/popupkillertest/index.html



Another good test page and lists of both free and cost popup blockers is
here: http://www.popuptest.com/ Recommended

Another list of some popup blockers:
http://www.messaging-software.net/popup-killer-software.htm


If you install and keep UPDATED a good HOSTS file, it can help you avoid
most adware/malware. See here: <http://www.mvps.org/winhelp2002/hosts.htm>
(Be sure it's named/renamed HOSTS - all caps, no extension)




You might want to consider installing the SpywareBlaster and SpywareGuard
here to help prevent this kind of thing and other malware from happening in
the future:

http://www.javacoolsoftware.com/spywareblaster.html (Prevents malware Active
X installs) (BTW, SpyWareBlaster is not memory resident ... no CPU or memory
load - but keep it UPDATED) The latest version as of this writing will
prevent installation or prevent the malware from running if it is already
installed, and it provides information and fixit-links for a variety of
parasites.

http://www.wilderssecurity.net/spywareguard.html (Monitors for attempts to
install malware) Both Very Highly Recommended.

Perhaps these will help.



--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

 

[Bruce Chambers]

Greetings --

There are at least three varieties of pop-ups, and the solutions
vary accordingly. Which specific type(s) is troubling you?

1) Does the title bar of these pop-ups read "Messenger Service?"

This type of spam has become quite common over the past several
months, and unintentionally serves as a valid security "alert." It
demonstrates that you haven't been taking sufficient precautions while
connected to the Internet. Your data probably hasn't been compromised
by these specific advertisements, but if you're open to this exploit,
you may well be open to other threats, such as the Blaster Worm that
recently swept cross the Internet. Install and use a decent,
properly configured firewall. (Merely disabling the messenger
service, as some people recommend, only hides the symptom, and does
little or nothing to truly secure your machine.) And ignoring or just
"putting up with" the security gap represented by these messages is
particularly foolish.

Messenger Service of Windows
http://support.microsoft.com/default.aspx?scid=KB;en-us;168893

Messenger Service Window That Contains an Internet Advertisement
Appears
http://support.microsoft.com/?id=330904

Stopping Advertisements with Messenger Service Titles
http://www.microsoft.com/windowsxp/pro/using/howto/communicate/stopspam.asp

Blocking Ads, Parasites, and Hijackers with a Hosts File
http://www.mvps.org/winhelp2002/hosts.htm

Oh, and be especially wary of people who advise you to do nothing
more than disable the messenger service. Disabling the messenger
service, by itself, is a "head in the sand" approach to computer
security. The real problem is _not_ the messenger service pop-ups;
they're actually providing a useful, if annoying, service by acting as
a security alert. The true problem is the unsecured computer, and
you've been advised to merely turn off the warnings. How is this
helpful?

2) For regular Internet pop-ups, you might try the free 12Ghosts
Popup-killer from http://12ghosts.com/ghosts/popup.htm, Pop-Up Stopper
from http://www.panicware.com/, or the Google Toolbar from
http://toolbar.google.com/, which is what I use.

3) To deal with pop-ups caused by any sort of "adware" and/or
"spyware,"such as Gator, Comet Cursors, Xupiter, Bonzai Buddy, or
KaZaA, and their remnants, that you've deliberately (but without
understanding the consequences) installed, two products that are
quite effective (at finding and removing this type of scumware) are
Ad-Aware from www.lavasoft.de and SpyBot Search & Destroy from
www.safer-networking.org/. Both have free versions. It's even
possible to use SpyBot Search & Destroy to "immunize" your system
against most future intrusions. I use both and generally perform
manual scans every week or so to clean out cookies, etc.


Bruce Chambers
--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. - RAH

 

[Bruce Chambers]

Greetings --

I realize that you may be trying to help, and that such an intent
is commendable, but please don't post potentially harmful advice.

Disabling the messenger service, as you advise, is nothing more
than a "head in the sand" approach to computer security that leaves
the PC vulnerable to threats such as the W32.Blaster.Worm and the
W32.Sasser.Worm.

The real problem is _not_ the messenger service pop-ups; they're
actually providing a useful service by acting as a security alert. The
true problem is the unsecured computer, and you're only advice,
however well-intended, was to turn off the warnings. How is this
helpful?

Equivalent Scenario: You over-exert your shoulder at work or
play, causing bursitis. After weeks of annoying and sometimes
excruciating pain whenever you try to reach over your head, you go to
a doctor and say, while demonstrating the motion, "Doc, it hurts when
I do this." The doctor, being as helpful as you are, replies, "Well,
don't do that."

An absolutely essential step towards securing the PC, short of
disconnecting it from the Internet, is to install and *properly*
configure a firewall.


Bruce Chambers
--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. - RAH

 

[Plato]

How do I stop these Microsoft Internet Explorer popup ads?
I have Earthlink Explorer popup blocker. It blocks all
the other ads but not M I E ads.

http://www.bootdisk.com/xptop15.htm#3

 

[Ccharlie]

I went to control panel, administrative tools (ie
not 'systems' which didn't have a 'services'
option),'services', 'messenger'.
I got the warning below. Should I go ahead and disable
this 'messenger' choice (and if I do what will be the
effect as outlined below, ie will I be effecting other
applications, servers,etc.) or do I need to find Windows
Messenger to stop the Microsoft Internet Explorer popup
ads? How then would I find Windows Messenger? I have XP
Home.
Thanks a million!



Transmits net send and Alerter service messages between
clients and servers. This service is not related to
Windows Messenger. If this service is stopped, Alerter
messages will not be transmitted. If this service is
disabled, any services that explicitly depend on it will
fail to start.

 

[TJ]

I would say that you definitely DO want to disable this service. See
www.grc.com reference "Shoot the Messenger" for more details. This is not
the same thing as "Windows Messenger" which opens automatically with Outlook
Express. While "Windows Messenger" is certainly annoying, it's really just
another instant messaging client like AOL IM or Yahoo IM. it's not the same
thing as the service described below. The service described below is not
used by anything important. It's used maliciously to generate unsolicited
pop-ups on your machine. I doubt you will ever miss it.
Anyway the www.grc.com web site has a little utility to turn it on and off
that will give a little more comfort factor in disabling it knowing you can
turn it back on anytime you want. But like I said, this service is
useless....

 

[Bruce Chambers]

Greetings --

The messenger service has nothing to do with Internet pop-ups.
For regular Internet pop-ups, you might try the free 12Ghosts
Popup-killer from http://12ghosts.com/ghosts/popup.htm, Pop-Up Stopper
from http://www.panicware.com/, or the Google Toolbar from
http://toolbar.google.com/, which is what I use.


Bruce Chambers
--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. - RAH

 

[TJ]

People/spammers do use the messenger service to feed "pop-ups" unsolicited
to unprotected machines. They are using the -internet- to do this since
they can't just wish them onto your computer. What you are talking about is
blocking Web-generated or Internet Explorer generated pop-ups - in other
words, pop-ups that show up as little mini web pages while surfing the web
using Internet Explorer. The original poster said he's using Earthlink's
pop-up blocker to do this, which makes me think he's getting some other
pop-ups via the messenger service.
But his post says he's still getting them from Internet Explorer, so maybe
one of the other pop-up blockers like you suggested would help (I use the
Google Toolbar).
In the mean time, I still think shutting down the messenger service is a
good idea unless the user has a specific reason for having it on (most
people have no idea what it is or what it's for; it's an old service that's
not needed by most users).

 

[Bruce Chambers]

Greetings --

Disabling the messenger service, as Gibson's utility does, is a
"head in the sand" approach to computer security that leaves the PC
vulnerable to threats such as the W32.Blaster.Worm.

Gibson has been fooling a lot of people for several years, now, so
don't feel too bad about having believed him. He mixes just enough
facts in with his hysteria and hyperbole to be plausible. Gibson's
"Shoot the Messenger" may be free, but I really don't believe that a
free bogus solution is significantly better than unnecessarily paying
for the real solution offered by many of the spammers. To my way of
thinking, they're just unscrupulous salesmen taking advantage of the
gullible to make money; something unscrupulous salesmen have been
doing for centuries. People should know better, Buyer Beware, and all
of that. :-} Gibson, on the other hand, is assuming a presumably
morally superior pose as a White Knight out to rescue the poor,
defenseless computer user, all the while offering a solution that does
no good whatsoever.

Perhaps you should hear what computer security specialists have to
say about Steve Gibson's "security" expertise. You can start here:
http://www.grcsucks.com/


Bruce Chambers
--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. - RAH

 

[Bruce Chambers]

Greetings --

The problem is that turning off the Messenger Service does _not_
block the wide open TCP and UDP ports that the spammers used to
deliver the spam to the Messenger Service for display. With the
Messenger Service disabled, those spam deliveries are still
continuing, but they're simply not being displayed. It's like pulling
the battery out of a noisy smoke detector to silence it, rather than
looking for and eliminating the source of the smoke that set it off.

The danger of this "treat the symptoms" approach has been more
than aptly demonstrated by the advent of the W32.Blaster.Worm, the
W32.Welchia.Worm, The W32.Sasser. Worm, and their variants. These
worms attack PCs via some of the very same open ports that the
Messenger Service uses. Need I mention how many hundreds of thousands
of PCs have been infected by these worms since last August? To date,
according to my records, I have personally responded to over 1000
Usenet posts concerning Blaster/Welchia/Sasser infections since last
August, and I can't possibly have seen and replied to every one that
there's been posted in this period.

Now, how many of those infected with Blaster/Welchia had turned
off the Messenger Service to hide spam? I can't say, and I don't
think anyone can. What I can say with absolutely certainty is that if
they'd all had a properly configured firewall in place, they would
have blocked the annoying spam _and_ been safe from a great many other
dangers, particularly Blaster/Welchia/Sasser.

Of course, like the Messenger Service Buffer Overrun threat, there
is also a patch available to fix a PC's vulnerability to
Blaster/Welchia, which was available to the general public a full
month before the first instances of Blaster/Welchia "in the wild." If
people learned to stay aware of computer security issues and updated
their systems as needed, a whole lot of grief could have been avoided.
The problem with relying upon patches, however, is that they're
sometimes not available until _after_ the exploit has become
wide-spread. Antivirus software suffers from this same weakness; it's
simply not always possible to provide protection from threats that
have not yet been developed and/or discovered. Both approaches, while
important, are re-active in nature.

There are several essential components to computer security: a
knowledgeable and pro-active user, a properly configured firewall,
reliable and up-to-date antivirus software, and the prompt repair (via
patches, hotfixes, or service packs) of any known vulnerabilities.
The weak link in this "equation" is, of course, the computer user.
All too many people have bought into the various PC/software
manufacturers marketing claims of easy computing. They believe that
their computer should be no harder to use than a toaster oven; they
have neither the inclination or desire to learn how to safely use
their computer. All to few people keep their antivirus software
current, install patches in a timely manner, or stop to really think
about that cutesy link they're about to click. Therefore, I (and
anyone who's thought about the matter) always recommend the use of a
firewall. Naturally, properly configuring a firewall requires an
investment of time and effort that most people won't give, but even
the default settings of the firewall will offer more automatic
protection than is currently present.

Now, as for the Messenger Service itself, it generally doesn't
hurt any thing to turn it off, although I never recommend doing so.
Granted, the service is of little or no use to most home PC users
(Although I've had uses it on my home LAN.), and turning off
unnecessary services is part of any standard computer security
protocol. However, I feel that the potential benefits of leaving the
Messenger Service enabled out-weigh any as-yet-theoretical risks that
it presents. It will indirectly let the computer user know that
his/her firewall has failed by displaying the Messenger Service spam.
Think of it as the canary that miners used to take down into the
mineshafts with them. There are others, of course, who disagree with
me on this point and advise turning off the service because it isn't
needed; you'll have to make up your own mind here.


Bruce Chambers
--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. - RAH

 

[TJ]

Greetings --

Disabling the messenger service, as Gibson's utility does, is a
"head in the sand" approach to computer security that leaves the PC
vulnerable to threats such as the W32.Blaster.Worm.

I know you didn't do it intentionally, but the above statement is
misleading. Disabling the Messenger Service doesn't leave the PC more or
less vulnerable to the blaster worm. As you said yourself, whether the
service is on or off, if one's ports are wide open, you are vulnerable.
Since I am behind a router and a software firewall, with anti-virus
protection and updated OS, I leave the messenger service shut off, it's
useless to me. However, I understand what you're getting at, about allowing
it to be a warning system for if/when one's defenses fail - that's certainly
worth considering when deciding to shut it off or leave it on.
Your other points are well taken.
Thanks

 

[Kevin Davis³]

Oh, and be especially wary of people who advise you to do nothing
more than disable the messenger service. Disabling the messenger
service, by itself, is a "head in the sand" approach to computer
security. The real problem is _not_ the messenger service pop-ups;
they're actually providing a useful, if annoying, service by acting as
a security alert. The true problem is the unsecured computer, and
you've been advised to merely turn off the warnings. How is this
helpful?

Don't forget that the Messenger Service would also provide a useful
service to hackers if it is not patched:

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms03-043.asp

Setup a firewall first, but if you don't need the Messenger Service,
turn it off. If you need it, patch it. You would also be well
advised to spend $50 and buy a home router.

Be especially wary of people who would insist on having you keep the
Messenger Service on as a "helpful feature" and conveniently
forgetting to inform you that it has a very serious vulnerability that
needs to be patched immediately.

And of particular interest is that Microsoft itself and security
experts are seriously reconsidering the role of the Messenger service:

http://www.infoworld.com/article/03/10/28/HNmessengeroff_1.html

http://www.pcworld.com/news/article/0,aid,113321,tk,dn110703X,00.asp

http://news.com.com/2100-7355_3-5095935.html

http://www.cnn.com/2003/TECH/internet/11/07/microsoft.popup.reut/index.html


Here's a link where Microsoft actually outright advises the user to
turn off the Messenger Service:

http://www.microsoft.com/WindowsXP/pro/using/howto/communicate/stopspam.asp


Those who would advise not to turn off the Messenger Service for the
less than trivial unintended side benefit of being a warning is
dispensing advice which contradicts the advice of many real security
professionals.

If you were protecting your house and you had one door that nobody
ever used and that door was really loud and squeaky, would you:

A: Keep the door unlocked all the time and actually depend on the
loud squeak of the door to be an integral part of your house alarm
system to alert you of an intruder?

or

B. Since no legitimate people would ever use the door, bar the door
shut so that there was no chance no-one could enter through it?

 

[Kevin Davis³]

Equivalent Scenario: You over-exert your shoulder at work or
play, causing bursitis. After weeks of annoying and sometimes
excruciating pain whenever you try to reach over your head, you go to
a doctor and say, while demonstrating the motion, "Doc, it hurts when
I do this." The doctor, being as helpful as you are, replies, "Well,
don't do that."

If you were protecting your house and you had one door that nobody
ever used and that door was really loud and squeaky, would you:

A: Keep the door unlocked all the time and actually depend on the
loud squeak of the door to be an integral part of your house alarm
system to alert you of an intruder?

or

B. Since no legitimate people would ever use the door, bar the door
shut so that there was no chance no-one could enter through it?

 

[Kevin Davis³]

Now, as for the Messenger Service itself, it generally doesn't
hurt any thing to turn it off, although I never recommend doing so.
Granted, the service is of little or no use to most home PC users
(Although I've had uses it on my home LAN.), and turning off
unnecessary services is part of any standard computer security
protocol. However, I feel that the potential benefits of leaving the
Messenger Service enabled out-weigh any as-yet-theoretical risks that
it presents. It will indirectly let the computer user know that
his/her firewall has failed by displaying the Messenger Service spam.
Think of it as the canary that miners used to take down into the
mineshafts with them. There are others, of course, who disagree with
me on this point and advise turning off the service because it isn't
needed; you'll have to make up your own mind here.

Be especially wary of people who would insist on having you keep the
Messenger Service on as a "helpful feature". Of particular interest
is that Microsoft itself and security experts are seriously
reconsidering the role of the Messenger service:

http://www.infoworld.com/article/03/10/28/HNmessengeroff_1.html

http://www.pcworld.com/news/article/0,aid,113321,tk,dn110703X,00.asp

http://news.com.com/2100-7355_3-5095935.html

http://www.cnn.com/2003/TECH/internet/11/07/microsoft.popup.reut/index.html


Here's a link where Microsoft actually outright advises the user to
turn off the Messenger Service:

http://www.microsoft.com/WindowsXP/pro/using/howto/communicate/stopspam.asp


Those who would advise not to turn off the Messenger Service for the
less than trivial unintended side benefit of being a warning is
dispensing advice which contradicts the advice of many real security
professionals.

If you were protecting your house and you had one door that nobody
ever used and that door was really loud and squeaky, would you:

A: Keep the door unlocked all the time and actually depend on the
loud squeak of the door to be an integral part of your house alarm
system to alert you of an intruder?

or

B. Since no legitimate people would ever use the door, bar the door
shut so that there was no chance no-one could enter through it?