messenger service

[Guest]

I am new to XP and everytime im on the net i keep getting messenger service ads which to me are pop-up ads that arent hurting my computer but are very irritating. I have pop-up stopper pro and although it blocks out all of the regular pop-ups from websites it doesnt stop these "messenger service" ads. does anyone know how to prevent this from happening besides downloading another program? is there a setting in windows that i havent seen? any help would be greatly appreciated.

 

[Plato]

I am new to XP and everytime im on the net i keep getting messenger service ads which to me are pop-up ads that arent hurting my computer but are very irritating. I have

http://www.bootdisk.com/xptop10.htm#3

 

[Bruce Chambers]

Greetings --

I realize that you're trying to help, and that such an intent is
commendable, but please don't post potentially harmful advice.

Disabling the messenger service, as that particular web site
advises, is a "treat the symptoms" approach to computer security still
that leaves the PC vulnerable to threats such as the W32.Blaster.Worm.

The real problem is _not_ the messenger service pop-ups; they're
actually providing a useful service by acting as a security alert.
The true problem is the unsecured computer, and your only advice,
however well-intended, was to turn off the warnings.

Equivalent Scenario: Pulling the battery out of a noisy smoke
detector instead of seeking and eliminating the source of the smoke
that set it off.

The only true way to secure the PC, short of disconnecting it from
the Internet, is to install and *properly* configure a firewall; just
installing one and letting it's default settings handle things is no
good.


Bruce Chambers
--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Grinder]

Greetings --

I realize that you're trying to help, and that such an intent is
commendable, but please don't post potentially harmful advice.

Disabling the messenger service, as that particular web site
advises, is a "treat the symptoms" approach to computer security still
that leaves the PC vulnerable to threats such as the W32.Blaster.Worm.

The real problem is _not_ the messenger service pop-ups; they're
actually providing a useful service by acting as a security alert.
The true problem is the unsecured computer, and your only advice,
however well-intended, was to turn off the warnings.

Equivalent Scenario: Pulling the battery out of a noisy smoke
detector instead of seeking and eliminating the source of the smoke
that set it off.

The only true way to secure the PC, short of disconnecting it from
the Internet, is to install and *properly* configure a firewall; just
installing one and letting it's default settings handle things is no
good.

I here what you saying, but your analogy is hyperbolic. The messenger
service for most users is non-essential. Given that Chris remarked that he
gets these messages when he "is on the net," I made the calculated guess
that he was a dial-up user, unattached to a system administrator that would
need to send him messages.

I felt that disabling this feature would not increase his risk of being
burned alive, and would be more adequate than barking "secure your system"
at him. Please feel free to offer Chris a more competent solution.

 

[Bruce Chambers]

Greetings --

The better solution, as I've said, is to install and use a
firewall. If the OP is on-line long enough to receive messenger
service spams, then he's been connected more than long enough to have
contracted Blaster, Welchia, or any worms that exploit the same ports
messenger service uses. It doesn't matter whether he has a dial-up
connection or broadband; it only takes a few milliseconds of exposure.

Merely advising turning off the Messenger Service to eliminate
Messenger Service spam, which is annoying but harmless, in and of
itself, is the sort of advice that I find dangerous. The problem is
that turning off the Messenger Service does _not_ block the wide open
TCP and UDP ports that the spammers used to deliver the spam to the
Messenger Service for display. With the Messenger Service disabled,
those spam deliveries are still continuing, but they're simply not
being displayed. It really is exactly like pulling the battery out of
a noisy smoke detector to silence it, rather than looking for and
eliminating the source of the smoke that set it off.

The danger of this "treat the symptoms" approach has been more
than aptly demonstrated by the advent of the W32.Blaster.Worm, the
W32.Welchia.Worm, and their variants. These worms attack PCs via some
of the very same open ports that the Messenger Service uses. Need I
mention how many hundreds of thousands of PCs have been infected by
these worms since last August? To date, according to my records, I
have personally responded to over 800 Usenet posts concerning
Blaster/Welchia infections since last August, and I can't possibly
have seen and replied to every one that there's been posted in this
period.

Now, how many of those infected with Blaster/Welchia had turned
off the Messenger Service to hide spam? I can't say, and I don't
think anyone can. What I can say with absolutely certainty is that if
they'd all had a properly configured firewall in place, they would
have blocked the annoying spam _and_ been safe from a great many other
dangers, particularly Blaster/Welchia.

There are several essential components to computer security: a
knowledgeable and pro-active user, a properly configured firewall,
reliable and up-to-date antivirus software, and the prompt repair (via
patches, hotfixes, or service packs) of any known vulnerabilities.
The weak link in this "equation" is, of course, the computer user.
All too many people have bought into the various PC/software
manufacturers marketing claims of easy computing. They believe that
their computer should be no harder to use than a toaster oven; they
have neither the inclination or desire to learn how to safely use
their computer. All too few people keep their antivirus software
current, install patches in a timely manner, or stop to really think
about that cutesy link they're about to click. Therefore, I (and
anyone who's thought about the matter) always recommend the use of a
firewall. Naturally, properly configuring a firewall requires an
investment of time and effort that most people won't give, but even
the default settings of the firewall will offer more automatic
protection than is currently present.

Now, as for the Messenger Service itself, it generally doesn't
hurt any thing to turn it off, although I never recommend doing so.
Granted, the service is of little or no use to most home PC users
(Although I've had uses for it on my home LAN.), and turning off
unnecessary services is part of any standard computer security
protocol. However, I feel that the potential benefits of leaving the
Messenger Service enabled out-weigh any as-yet-theoretical risks that
it presents. It will indirectly let the computer user know that
his/her firewall has failed by displaying the Messenger Service spam.
Think of it as the canary that miners used to take down into the
mineshafts with them. There are others, of course, who disagree with
me on this point and advise turning off the service because it isn't
needed; you'll have to make up your own mind here.


Bruce Chambers
--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Bruce Chambers]

Greetings --

Does the title bar of these pop-ups read "Messenger Service?"

This type of spam has become quite common over the past several
months, and unintentionally serves as a valid security "alert." It
demonstrates that you haven't been taking sufficient precautions while
connected to the Internet. Your data probably hasn't been compromised
by these specific advertisements, but if you're open to this exploit,
you may well be open to other threats, such as the Blaster Worm that
recently swept cross the Internet. Install and use a decent,
properly configured firewall. (Merely disabling the messenger
service, as some people recommend, only hides the symptom, and does
little or nothing to truly secure your machine.) And ignoring or just
"putting up with" the security gap represented by these messages is
particularly foolish.

Messenger Service of Windows
http://support.microsoft.com/default.aspx?scid=KB;en-us;168893

Messenger Service Window That Contains an Internet Advertisement
Appears
http://support.microsoft.com/?id=330904

Stopping Advertisements with Messenger Service Titles
http://www.microsoft.com/windowsxp/pro/using/howto/communicate/stopspam.asp

Blocking Ads, Parasites, and Hijackers with a Hosts File
http://www.mvps.org/winhelp2002/hosts.htm

Whichever firewall you decide upon, be sure to ensure
UDP ports 135, 137, and 138 and TCP ports 135, 139, and 445 are _all_
blocked. You may also disable Inbound NetBIOS (NetBIOS over TCP/IP).
You'll have to follow the instructions from firewall's manufacturer
for the specific steps.

You can test your firewall at:

Symantec Security Check
http://security.symantec.com/ssc/vr_main.asp?langid=ie&venid=sym&plfid=23&pkj=GPVHGBYNCJEIMXQKCDT

Security Scan - Sygate Online Services
http://www.sygatetech.com/

Oh, and be especially wary of people who advise you to do nothing
more than disable the messenger service. Disabling the messenger
service, by itself, is a "head in the sand" approach to computer
security. The real problem is _not_ the messenger service pop-ups;
they're actually providing a useful, if annoying, service by acting as
a security alert. The true problem is the unsecured computer, and
you've been advised to merely turn off the warnings. How is this
helpful?


Bruce Chambers
--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Spinner]

Bruce,
This is one of the best posts I have seen on this subject.
Great post!!

 

[Bruce Chambers]

Greetings --

Aw, shucks.... ;-}

Thank you for the kind words.

Bruce Chambers
--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[NobodyMan]

I here what you saying, but your analogy is hyperbolic. The messenger
service for most users is non-essential. Given that Chris remarked that he
gets these messages when he "is on the net," I made the calculated guess
that he was a dial-up user, unattached to a system administrator that would
need to send him messages.

Don't assume that when somebody says "only when I'm on the net"
implies dialup access. Many users on broadband only think they are
"on the net" when they are actively using their computer on the
internet - surfing, e-mail, messaging, etc. They don't stop to think
that broadband connections are almost always on, even when they aren't
using the system.

I felt that disabling this feature would not increase his risk of being
burned alive, and would be more adequate than barking "secure your system"
at him. Please feel free to offer Chris a more competent solution.

The more competent solution is not to disable the service, but to
close the hole that allows it to display the messages in the first
place. That's where a properly configured firewall come into play.

 

[Paul]

Even better go to www.grc.com and d/l
Shoot The Messenger. That'll kill the popups.

Or remove Windows Messenger
completely and use MSN Messenger or another
IM program.

 

[Bruce Chambers]

Greetings --

Using "Shoot the Messenger" is as bad as doing nothing. All it
does is hide the problem.

Bruce Chambers
--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Paul]

Well remove it altogether. Windows
Messenger is hopeless. Use something
else. Video doesnt work in it anyway
so what was the point of having it as part of XP.

 

[Paul]

Well that was the question the
user was asking wasnt it?

To get rid of the popups.
Shoot the messenger does that.

I removed it altogether. No use to me
if it doesnt work as it should.