Non-stop "Messenger Service Notice" Pop-up windows!!!

[James]

A friend of mine is running Windows 2000 Professional with Service Pack 3
and all of the post-SP3 security hot fixes (Service Pack 4 not installed
yet). Every so often she would get a little pop-up window (no, it's not an
Internet Explorer or any browser window, it's just an application window)
showing "Messenger Service: get this for free at www.this.com", and if you
close the window, another one would start with a message "Messenger Service:
get that for free at www.that.com),... When I looked in the Task Manger,
there is a running application/process called "Messenger Service" and if I
choose "Go to process" it will show csrss.exe/csrsrv.dll which is an exe/dll
from Microsoft. And no, she never installed MSN/Windows Messenger or Yahoo!
Messenger or anything similar.

\winnt\system32\csrss.exe 5,392 Bytes July 22, 2002 12:05PM
\winnt\system32\csrsrv.dll 35,088 Bytes July 22, 2002 12:05PM

How to get rid of this annoying pop-up message?

Thanks in advance,
James

 

[Lanwench [MVP - Exchange]]

You need a firewall. 'Messenger spam', is not in itself harmful,
but is symptomatic of a larger problem - your computer has ports open from
the Internet.

You can disable the Messenger service, but that is unwise as a solution as
you'll still have the underlying problem that caused you to get the messages
in the first place - consider the messages a useful warning that you have no
protection from the Internet.

For a standalone machine, see www.sygate.com for a free personal firewall.

See http://securityadmin.info/faq.htm for more info.

 

[Lanwench [MVP - Exchange]]

Yes, and if that port is open, they all are. Very bad thing. The messenger
service is in the services applet. You can stop it there. However, I don't
recommend it - it's a good reminder that the machine is still unprotected.

Thank you very much for the advice, and of course I will consider
installing a firewall application for her machine. So I guess you are
saying this problem was due to some port open to the Internet?

You did mention "disable the Messenger Service", and I'd like to know
how to disable it? Thanks again.

James

"Lanwench [MVP - Exchange]"

You need a firewall. 'Messenger spam', is not in itself harmful,
but is symptomatic of a larger problem - your computer has ports
open from the Internet.

You can disable the Messenger service, but that is unwise as a
solution as you'll still have the underlying problem that caused you
to get the messages in the first place - consider the messages a
useful warning that you have no protection from the Internet.

For a standalone machine, see www.sygate.com for a free personal
firewall.

See http://securityadmin.info/faq.htm for more info.