Messenger Service

[David A Gourlay]

I keep getting annoying messages appearing, in a window that has "Messenger
Service" at the top. Some messages try to sell me things, others tell me to
buy their software to stop the others sending me messages.

AFAIK, this is not the usual Windows Messenger, but I don't know what it is,
or how to stop it. Any ideas?

 

[Carey Frisch [MVP]]

You can disable the Messenger Service in Windows XP. However, when
you disable the messenger service, it is no longer available for receiving
legitimate messages, such as administrative alerts and notifications
from antivirus programs or firewall failures and others.

Ref:
http://www.microsoft.com/windowsxp/pro/using/howto/communicate/stopspam.asp

Protect Your PC
http://www.microsoft.com/security/protect/default.asp

A New Window Appears When You Visit Some Web Sites
http://support.microsoft.com/default.aspx?scid=kb;[LN];Q308446

Messenger Service Window That Contains an Internet Advertisement Appears
http://support.microsoft.com/default.aspx?scid=kb;en-us;330904&sd=tech


--
Carey Frisch
Microsoft MVP
Windows XP Shell/User

----------------------------------------------------------------------------------------------


| I keep getting annoying messages appearing, in a window that has "Messenger
| Service" at the top. Some messages try to sell me things, others tell me to
| buy their software to stop the others sending me messages.
|
| AFAIK, this is not the usual Windows Messenger, but I don't know what it is,
| or how to stop it. Any ideas?

 

[David Robbins]

I keep getting annoying messages appearing, in a window that has "Messenger
Service" at the top. Some messages try to sell me things, others tell me to
buy their software to stop the others sending me messages.

AFAIK, this is not the usual Windows Messenger, but I don't know what it is,
or how to stop it. Any ideas?

its the people that want to sell you the software to stop getting the
messages that are of course sending you the messages in the first place.
get a firewall, the messages are a good warning that your machine is exposed
to the internet without proper protection.

 

[David A Gourlay]

its the people that want to sell you the software to stop getting the
messages that are of course sending you the messages in the first place.
get a firewall, the messages are a good warning that your machine is exposed
to the internet without proper protection.

That's just it, I DO have a firewall, Norton Firewall! And it's enabled!

Are there settings there I need to change?

 

[David Robbins]

Are there settings there I need to change?

must be, but i don't know norton so can't say how. if there is an option to
block everything incoming then do it and only reopen incoming ports for
things you specifically need, which for most people is nothing.

 

[Bruce Chambers]

Greetings --

This type of spam has become quite common over the past year, and
unintentionally serves as a valid security "alert." It demonstrates
that you haven't been taking sufficient precautions while connected to
the Internet. Your data probably hasn't been compromised by these
specific advertisements, but if you're open to this exploit, you may
well be open to other threats, such as the Blaster Worm that recently
swept cross the Internet. Install and use a decent, properly
configured firewall. (Merely disabling the messenger service, as some
people recommend, only hides the symptom, and does almost nothing to
truly secure your machine.) And ignoring or just "putting up with"
the security gap represented by these messages is particularly
foolish.

Messenger Service of Windows
http://support.microsoft.com/default.aspx?scid=KB;en-us;168893

Messenger Service Window That Contains an Internet Advertisement
Appears
http://support.microsoft.com/?id=330904

Blocking Ads, Parasites, and Hijackers with a Hosts File
http://www.mvps.org/winhelp2002/hosts.htm

Oh, and be especially wary of people who advise you to do nothing
more than disable the messenger service. Disabling the messenger
service, by itself, is a "head in the sand" approach to computer
security. The real problem is _not_ the messenger service pop-ups;
they're actually providing a useful, if annoying, service by acting as
a security alert. The true problem is the unsecured computer, and
you've been advised to merely turn off the warnings. How is this
truly helpful?


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Bruce Chambers]

Greetings --

Use the firewall to ensure UDP ports 135, 137, and 138 and TCP
ports 135, 139, and 445 are _all_ blocked. You may also disable
Inbound NetBIOS (NetBIOS over TCP/IP). You'll have to follow the
instructions from firewall's manufacturer for the specific steps.


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[David A Gourlay]

Thanks for the advice Bruce.

I use Norton Internet Security 2004, and can't see how to block these ports.
I've checked the help. Can you, or anyone with knowledge of Norton Internet
Security advise?

I am on a home peer to peer network, with my computer, running Win XP Home
the host, and the other computer, running W2000 the client. Files/printers
are shared.

 

[Kevin Davis³]

Oh, and be especially wary of people who advise you to do nothing
more than disable the messenger service. Disabling the messenger
service, by itself, is a "head in the sand" approach to computer
security. The real problem is _not_ the messenger service pop-ups;
they're actually providing a useful, if annoying, service by acting as
a security alert. The true problem is the unsecured computer, and
you've been advised to merely turn off the warnings. How is this
truly helpful?

Oh, and don't forget that the Messenger Service would also provide a
useful service to hackers if it is not patched:

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms03-043.asp

Setup a firewall first, but if you don't need the Messenger Service,
turn it off. If you need it, patch it. You would also be well
advised to spend $50 and buy a home router.

Be especially wary of people who would insist on having you keep the
Messenger Service on as a "helpful feature" and conveniently
forgetting to inform you that it has a very serious vulnerability that
needs to be patched immediately.

And of particular interest is that Microsoft itself and security
experts are seriously reconsidering the role of the Messenger service:

http://www.infoworld.com/article/03/10/28/HNmessengeroff_1.html

http://www.pcworld.com/news/article/0,aid,113321,tk,dn110703X,00.asp

http://news.com.com/2100-7355_3-5095935.html

http://www.cnn.com/2003/TECH/internet/11/07/microsoft.popup.reut/index.html


Here's a link where Microsoft actually outright advises the user to
turn off the Messenger Service:

http://www.microsoft.com/WindowsXP/pro/using/howto/communicate/stopspam.asp


Those who would advise not to turn off the Messenger Service for the
less than trivial unintended side benefit of being a warning is
dispensing advice which contradicts the advice of many real security
professionals.