Messenger Service Ads

[Still Frustrated]

I posted here about a month ago, asking for help in
stopping those irritating popup ads that come thru
Messenger Service.
I got some advice at the time, though some of the links
given were for info aimed at WinXP rather than 2000.
Here's what I've done:
Have Symantec 2004 Personal Firewall running on my pc
(home pc, not on a network). Created a rule to block *all*
incoming TCP and UDP communications on all ports from any
computer. This seemed to work for awhile, but two days ago
I started getting the popups again. So I created
additional rules to block the specific ports 135, 137,
138, 139 and 445 from TCP and UDP communcations, per
instructions on one of the webpages - I think it was an
MVP website page. I've taken the free tests at three
different websites now, and they all come back saying my
protection is "perfect".
That's wonderful, except I'm still getting the Messenger
Service popup ads. I'm at my wit's end, and ready to
disable the service as a last resort - just to stop seeing
those stupid ads. Does anybody have any alternative
suggestions for me?
Thanks for any help!

 

[Kerodo]

I posted here about a month ago, asking for help in
stopping those irritating popup ads that come thru
Messenger Service.
I got some advice at the time, though some of the links
given were for info aimed at WinXP rather than 2000.
Here's what I've done:
Have Symantec 2004 Personal Firewall running on my pc
(home pc, not on a network). Created a rule to block *all*
incoming TCP and UDP communications on all ports from any
computer. This seemed to work for awhile, but two days ago
I started getting the popups again. So I created
additional rules to block the specific ports 135, 137,
138, 139 and 445 from TCP and UDP communcations, per
instructions on one of the webpages - I think it was an
MVP website page. I've taken the free tests at three
different websites now, and they all come back saying my
protection is "perfect".
That's wonderful, except I'm still getting the Messenger
Service popup ads. I'm at my wit's end, and ready to
disable the service as a last resort - just to stop seeing
those stupid ads. Does anybody have any alternative
suggestions for me?
Thanks for any help!

Sounds like your firewall isn't doing it's job. I hate to say it but
perhaps you should have chosen Sygate or Kerio instead of Norton. The
Messenger spammers are very sneaky and tricky. They sometimes attempt
to sneak spam in via remote port 53 pretending they're DNS. I've seen
other attempts to get past some firewalls too. It's amazing. I'd
suggest you try another firewall. Sygate works well for me here, and
it's free.. http://www.sygate.com/

 

[Bruce Chambers]

Greetings --

Your firewall isn't working properly. You might try another. The
free version of Sygate's Personal Firewall
(http://smb.sygate.com/free/default.php ) works quite well.

Bruce Chambers
--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. - RAH

 

[George Hester]

Why don't you just turm off the Messenger Service and stop it from starting automatically and be done with it?

 

[Bruce Chambers]

Greetings --

I realize that you're trying to help, and that such an intent is
commendable, but please don't post potentially harmful advice.

Disabling the messenger service, as you advise, is a "head in the
sand" approach to computer security that leaves the PC vulnerable to
threats such as the W32.Blaster.Worm.

The real problem is _not_ the messenger service pop-ups; they're
actually providing a useful service by acting as a security alert. The
true problem is the unsecured computer, and you're only advice,
however well-intended, was to turn off the warnings. How is this
helpful?

Equivalent Scenario: You over-exert your shoulder at work or
play, causing bursitis. After weeks of annoying and sometimes
excruciating pain whenever you try to reach over your head, you go to
a doctor and say, while demonstrating the motion, "Doc, it hurts when
I do this." The doctor, being as helpful as you are, replies, "Well,
don't do that."

The only true way to secure the PC, short of disconnecting it from
the Internet, is to install and *properly* configure a firewall.

Bruce Chambers
--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. - RAH


Why don't you just turm off the Messenger Service and stop it from
starting automatically and be done with it?

 

[George Hester]

It is not harmful and is in fact exactly what Microsoft says to do.

http://support.microsoft.com/default.aspx?scid=kb;en-us;330904

 

[Still Frustrated]

Ah, that helped. I've been tinkering with my firewall
rules all along, but I didn't know from local vs remote. I
don't recall any mention of that in any of the articles I
read, and it's also not mentioned in my firewall's Help.
So I went back and found that the software had created a
default Permit All rule for inbound DNS from remote port
53. I changed that to Block All, and have been selectively
unblocking specific computer IPs as I find that I need
them.
Thanks for your help, and thanks to the other folks who
answered also. When my Symantec renewal comes up, I'll be
considering other options, believe me!

 

[dcdon]

Hi Still,

I tried what you're going through. Finally got a Router, and learned how to
use it. Also have Zone Alarm firewall. Also use Adaware, SpyBot S&D, Hijack
This, and best of all learned to use the "hosts" folder to my advantage. If
you you're interested the site is www.someonewhocares.org . It keeps many of
the dataminers from ever knowing anything about your computer of you.

You also might make it a regular practice to peruse this NG and some of the
others that many problems are solved on. It gives me a heads up to keep from
getting a left cross on my blind side.

good luck,
don



Ah, that helped. I've been tinkering with my firewall
rules all along, but I didn't know from local vs remote. I
don't recall any mention of that in any of the articles I
read, and it's also not mentioned in my firewall's Help.
So I went back and found that the software had created a
default Permit All rule for inbound DNS from remote port
53. I changed that to Block All, and have been selectively
unblocking specific computer IPs as I find that I need
them.
Thanks for your help, and thanks to the other folks who
answered also. When my Symantec renewal comes up, I'll be
considering other options, believe me!