Messenger Service

[frustrated]

i am running Win2K Pro on my home PC, not connected to a
network (and running MS Office Pro 2003, in case that
matters). the OS is running fine, no problems there.
i am using Symantec 2004 Personal Firewall, with the Ad
Blocker activated. it works great - except it does not
block ads that come thru on the Messenger Service.

so my question is: is there a way for me to turn off the
Messenger service on my system? if so, can somebody tell
me how - or where to find the instructions? and, any
pitfalls i should consider?

TIA!

 

[Bruce Chambers]

Greetings --

This type of spam has become quite common over the past several
months, and unintentionally serves as a valid security "alert." It
demonstrates that you haven't been taking sufficient precautions while
connected to the Internet. Your data probably hasn't been compromised
by these specific advertisements, but if you're open to this exploit,
you may well be open to other threats, such as the Blaster Worm that
recently swept cross the Internet. Install and use a decent,
properly configured firewall. (Merely disabling the messenger
service, as some people recommend, only hides the symptom, and does
little or nothing to truly secure your machine.) And ignoring or just
"putting up with" the security gap represented by these messages is
particularly foolish.

Messenger Service of Windows
http://support.microsoft.com/default.aspx?scid=KB;en-us;168893

Messenger Service Window That Contains an Internet Advertisement
Appears
http://support.microsoft.com/?id=330904

Stopping Advertisements with Messenger Service Titles
http://www.microsoft.com/windowsxp/pro/using/howto/communicate/stopspam.asp

Blocking Ads, Parasites, and Hijackers with a Hosts File
http://www.mvps.org/winhelp2002/hosts.htm

Whichever firewall you decide upon, be sure to ensure UDP ports 135,
137, and 138 and TCP ports 135, 139, and 445 are _all_ blocked. You
may also disable Inbound NetBIOS (NetBIOS over TCP/IP). You'll have to
follow the instructions from firewall's manufacturer for the specific
steps.

You can test your firewall at:

Symantec Security Check
http://security.symantec.com/ssc/vr_main.asp?langid=ie&venid=sym&plfid=23&pkj=GPVHGBYNCJEIMXQKCDT

Security Scan - Sygate Online Services
http://www.sygatetech.com/

Oh, and be especially wary of people who advise you to do nothing
more than disable the messenger service. Disabling the messenger
service, by itself, is a "head in the sand" approach to computer
security. The real problem is _not_ the messenger service pop-ups;
they're actually providing a useful, if annoying, service by acting as
a security alert. The true problem is the unsecured computer, and
you've been advised to merely turn off the warnings. How is this
helpful?


Bruce Chambers

--
Help us help you:




You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[frustrated]

Bruce, thanks for the information and links. last night i
looked at the ones that apply to Win2K, and then went to
work on my (already existing) Symantec firewall - with the
messenger service interrupting every few minutes, all the
while, of course.
symantec's test page (which was testing their own
product's protection) told me that everything was fine, in
each of three categories. i might have felt more confident
of that if the test page hadn't also included a message
saying the testing was incomplete in the three areas - and
definitely more confident if the messenger service wasn't
merrily doing its' thing, as well.
then i tried to configure my firewall to block those ports
you specified, but the (ambiguous) setup seemed to
indicate that they're already being monitored for the
inbound NetBIOS and inbound UDP. i tinkered a bit, and
seemed to reduce the frequency of the pop-ups (they had
started to come up every few mintes in the last several
days) without completely eliminating them.
finally i blocked all inbound NetBIOS, UDP, and TCP from
all ports (local and remote - the only option available).
so far, i've not gotten any more messenger service pop-
ups....and so far, i've been able to do the things i
normally do on the internet - accessing my usual "login
required" websites, downloading zip files, downloading
email thru outlook, etc.
so i guess we can count this venture a success. thanks for
your time and patience in explaining the situation, i much
appreciate it!

 

[Bruce Chambers]

Greetings --

You're welcome.

As time goes on, and stories like yours grow in number, I'm
becoming less and less impressed with Symantec's consumer grade
products. I had used, and recommended, Norton Antivirus and then
Norton Internet Security, for many years, on Win98, WinNT, Win2K, and
WinXP, all without any but the most insignificant of problems.

However, when my subscription to Symantec's updates for Norton
Internet Security 2002 came up for renewal last year (at a cost
substantially higher than the preceding year's subscription), I
decided to try less expensive solutions. I downloaded and installed
the free version of GriSoft's AVG
(http://www.grisoft.com/us/us_dwnl_free.php ) and the free version of
Sygate's Personal Firewall (http://smb.sygate.com/free/default.php ).
Both have proven to be easily installed, easy to use, and quite
effective. Additionally, I was pleasantly surprised to see a small
but very noticeable improvement in my PC's performance, once I'd
replaced the Symantec products.

You might want to think about doing something similar when your
current subscription expires.


Bruce Chambers

--
Help us help you:




You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[frustrated]

now that is really interesting info. my pc (purchased
online 3/2004) came with Norton Antivirus 2004, and i
purchased/installed Symantec's Personal Firewall 2004
immediately - figuring, you know, "it's a well-known name,
and the same company as the antivirus software i already
have", etc, etc. now i will think twice before renewing my
download subscriptions, and take a look at the
alternatives you suggest.
thanks again for your help and great info!

-----Original Message-----
Greetings --

You're welcome.

As time goes on, and stories like yours grow in number, I'm
becoming less and less impressed with Symantec's consumer grade
products. I had used, and recommended, Norton Antivirus and then
Norton Internet Security, for many years, on Win98, WinNT, Win2K, and
WinXP, all without any but the most insignificant of problems.

However, when my subscription to Symantec's updates for Norton
Internet Security 2002 came up for renewal last year (at a cost
substantially higher than the preceding year's subscription), I
decided to try less expensive solutions. I downloaded and installed
the free version of GriSoft's AVG
(http://www.grisoft.com/us/us_dwnl_free.php ) and the free version of
Sygate's Personal Firewall

(http://smb.sygate.com/free/default.php ).