Windows Messenger Service

[Ilan Howatson]

I have recently started to receive what looks like spam
messeges using the Windows messenger service. They just
appear as pop up windows even when I'm not running I.E.
and seem to advertise a particular web-site called
DESTROYADS.COM. I use Norton Antivirus and Personal
Firewall which are regularly updated and also use Adaware
to scan my system for adware, spyware e.t.c. But still
these ads appear. Is it a security breach on my computer
or is it something I can just block or disable????

 

[rifleman]

I have recently started to receive what looks like spam
messeges using the Windows messenger service. They just
appear as pop up windows even when I'm not running I.E.
and seem to advertise a particular web-site called
DESTROYADS.COM. I use Norton Antivirus and Personal
Firewall which are regularly updated and also use Adaware
to scan my system for adware, spyware e.t.c. But still
these ads appear. Is it a security breach on my computer
or is it something I can just block or disable????

Deary me! Another one! Install a firewall, as the THOUSANDS of responses
to this very question have indicated.

 

[Willit]

Get a fire wall or turn on the built-in one.

or

If They say "Messenger Service" in the top frame. There
are Several ways to do it.

Disable Method: Start > Run > Type "services.msc" >ok ,
on the services and applications find "Messenger" and
right click on it and choose properties choose "Disable"
in the middle Apply > ok.

or

Start Method : goto Start > Run > Type "msconfig" on the
Start Config. Menu go to Services Tab , go down the list
to "Messenger" uncheck, apply> ok re-boot. you will get a
warning when you re-boot >ok Done.

or

If you don't want it or need it or the Alerter Service
Delete it. Most don't, unless you are on a network, other
than your own. The Alerter Service is used on a network to
send virus alerts. You have to be on a network before
either have any use.

To Delete the Messenger Service:

Go to Start/Run/CMD and type in: sc delete messenger.
Reboot.

or

Or go to Start/Run/Regedit and go to this key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
Messengerservice Delete Key. You can export it in case you
want it again,
then delete. Reboot

 

[Ilan Howatson]

Please note that I DO have both Norton Internet Firewall
AND the Windows XP firewall both running!!!!

I have now disabled the messenger service which hopefully
will work.

 

[rifleman]

Please note that I DO have both Norton Internet Firewall
AND the Windows XP firewall both running!!!!

I have now disabled the messenger service which hopefully
will work.

Well Norton obviously wasn't set up properly then. I use kerio and have
NEVER had a messenger pop-up, and I haven't disabled the messenger
service either!

 

[Cool_Pete]

I have firewall running - I disabled the ports recommended in all posts and
I still get the pop ups. I've tried everything. It seems like if I set it
really tight - then it's ok - but my network is completely shut down and I
have no actual network left. I think that the ports to enable or disable
are the issue - but shutting them down seems to eliminate my network, so I
have to reopen them and let these messages in and expose myself. There has
to be a better answer, but I've not yet found it. Of course, I'm not nearly
as talented as most on this list and maybe I just don't know what the heck
I'm doing.

 

[Jon]

Hi

As well as the commonly suggested ports to block to avoid Messenger spam

ie TCP / UDP ports 135, 137-139, 445

I've also noticed that you can also get spam via UDP Port 1026.
I've not received any more since blocking inbound traffic on this port too.

Hope this helps
Jon (non-expert)

 

[Bruce Chambers]

Greetings --

Use the firewall to ensure UDP ports 135, 137, and 138 and TCP
ports 135, 139, and 445 are _all_ blocked. You may also disable
Inbound NetBIOS (NetBIOS over TCP/IP). You'll have to follow the
instructions from firewall's manufacturer for the specific steps.


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Jeff Malka]

I am running Zone Alarm - which seems to work just fine. However, I find no
setting anywhere to block or unblock specific ports. Maybe that is not a
function included in the free version. If so, how do I find out what ports
are blocked or open?

Thanks.

 

[Jeff Steinkamp - N7YG]

You can test for open ports here. http://www.pcflank.com/scanner1.htm or
here https://grc.com/x/ne.dll?bh0bkyd2

Open Zone Alarm, Select Firewall and the custom button for each zone. It
will tell you which ports are selected open and which are not.


--
Jeff Steinkamp - N7YG
Tucson, AZ
SCUD Missile Coordinates
N32-13-52 W110-52-15
_______________________________________________
FAILURE IS NOT AN OPTION. It comes bundled with the software.

 

[Jeff Malka]

Thank you. This was most educational and comforting. I found out I am
stealthed and protected everywhere, except for one vulnerability: The
"Universal Plug'n'Play" which remains open. Is this serious?

Thanks.

 

[sli]

Thank you. This was most educational and comforting. I found out I
am stealthed and protected everywhere, except for one vulnerability:
The "Universal Plug'n'Play" which remains open. Is this serious?

Thanks.

It is very unlikely that you have any UPnP devices on your system so you can
probably disable this service for security reasons. This is not Plug and
Play (scanners, etc.). Don't disable Plug and Play. Read about it here
http://blackviper.com/WinXP/service411.htm#Universal_Plug_and_Play_Device_Host

 

[Patricko]

http://grc.com/UnPnP/UnPnP.htm

Thank you. This was most educational and comforting. I found out I am
stealthed and protected everywhere, except for one vulnerability: The
"Universal Plug'n'Play" which remains open. Is this serious?

Thanks.

 

[schism]

Thank you. This was most educational and comforting. I found out I am
stealthed and protected everywhere, except for one vulnerability: The
"Universal Plug'n'Play" which remains open. Is this serious?

Thanks.

Go to www.grc.com awesome site that fixes most of the problems....
incluseing a patvh for upnp

 

[Jeff Malka]

Thank you.

--
Jeff Malka
(e-mail address removed)

I am running Zone Alarm - which seems to work just fine. However, I find no
setting anywhere to block or unblock specific ports. Maybe that is not a
function included in the free version. If so, how do I find out what ports
are blocked or open?

You have to go to ZA Pro to get an ability to bloack/unblock individual
ports. AFAIK (subject to correction) the free version blocks all
ports where not associated with a program that is allowed access. Eg 80
will be opened so that web browsing will work - for Internet Explorer or
other specified programs. If you want Messenger to send files, you give
that Server access, which allows the request to send to come through the
relevant port into *it* but not to anything else. And so on