Hi William - There are currently two classes of things going on that are
causing people popup difficulties. If you get popups even when your
browser is not connected to the Internet, then these are most likely due
to open NetBios ports 135, 137-139 and 445. You really need to block
these with a firewall as a general protection measure. You can stop the
popups by turning off Messenger Service; however, this still leaves you
vulnerable.
See: Messenger Service Window That Contains an Internet Advertisement
Appears
http://support.microsoft.com/?id=330904 which identifies reasons
to keep this service and steps to take if you do.
You can test your system and follow the 'Prevention' link to get
additional information here:
http://www.mynetwatchman.com/winpopuptester.asp Unless you have very
good reasons to keep this active, it should be turned off in Win2k and
XP. Go here and do what it says:
http://www.itc.virginia.edu/desktop/docs/messagepopup/ or, even better,
get MessageSubtract, free, here, which will give you flexible control of
the service and viewing of these messages:
http://www.intermute.com/messagesubtract/help.html Recommended.
(FWIW, ZoneAlarm's default Internet Zone firewall configuration blocks
the necessary ports to prevent this use of Messenger Service. I don't
know the situation with regard to other firewalls.)
Messenger Service is not per se Spyware or something that MS did wrong -
It provides a messaging capability which is useful for local intranets
and is also sometimes (albeit nowdays infrequently) used by some
applications to provide popup messaages to users. However, it can also
be (and now frequently is) used to introduce spam via this open NetBios
channel.
For a single user home computer, it normally isn't needed and can be
turned off which will eliminate the spam popups. This DOESN'T, however,
remove the vulnerability of having these ports open, when in fact they
aren't needed, since they can be perverted in other ways as well, some
of which can be much more damaging than just a spam popup.
If you're getting a lot of popups while surfing, then the following my
be useful:
Popups - The best way to start is to get Ad-Aware 6.0, Build 162 or
later, here:
http://www.lavasoftusa.com/support/download/. Update and
run this regularly to get rid of most "spyware/hijackware" on your
machine.
Another excellent program for this purpose is SpyBot Search and Destroy
available here:
http://security.kolla.de/ SpyBot Support Forum here:
http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi
I recommend using both normally. After fixing things with SpyBot S&D,
be sure to re-boot and rerun SpyBot again and repeat this cycle until
you get a clean "no red" scan.
Then, there are a variety of third party "Popup Killers" available. I
normally use AdShield, which, if you maintain its Block List every now
and then, almost totally stops this. In addition, it stops a variety of
ads/banners/etc. (particularly spyware like doubleclick) on pages I
access. This is probably all you'll need; however, I've also
investigated a program called Webwasher which appears to be very good,
but decided that AdShield was sufficient. At the bottom of this post,
you'll find a list provided courtesy of bc_acadia of a number of free
popup blockers with links.
****** NOTE: As of 28 Apr 03 AdShield appears to have partnered with a
new reseller, and AdShield is no longer free. There is a trial version
of AdShield3; however, IMO it is seriously crippled in not being able to
import or export block lists and I think for reasonable utility one
would have to go to the full version. While I don't normally recommend
non-free software, I personally will continue to use AdShield3, since I
think it is the best currently available combined Popup/Ad/Malware
blocker, but you should be aware of the fact that it now costs,
($29.95), whereas the earlier versions upon which I based my original
recommendation were free, although not nearly as capable as the
AdShield3 release. I've included below links to both the older free
version and the new paid version. You'll have to investigate and make
your own choice in the matter. *******
Here are a number of AdShield-related links:
http://www.fsd1.org/technology/Files/AdShield.exe - AdShield1.2 (free)
http://www.internettechs.net/utilities/AdShield.exe - AdShield1.2
(free)
http://ftp.ural.ru/home/index/windows/networking/utils/AdShield -
AdShield1.2 (free)
http://www.megalog.ru/info/utilz/AdShield.zip - AdShield1.2 (free)
http://www.allstarss.com/store/adshield.html - AdShield3
http://www.mvps.org/winhelp2002/block.txt - (Mike Burgess' .txt Block
List for AdShield)
http://www.mvps.org/winhelp2002/block.zip - Mike Burgess' Zipped Block
List for AdShield - Recommended)
http://adshield.briankass.com/blocklists.html (lists a number of
blocklists)
http://adshield.briankass.com/blocklist.abl (brian's blocklist in .abl
format)
http://adshield.briankass.com/blocklist.txt (brian's blocklist in
..txt format)
http://www.songwave.com/software/adshield_blocklist.txt (40,000
pornsites blocked - *VERY* large list - use at your own risk)
http://www.chrismyden.com/temp/block.abl (chrismyden's blocklist in
..abl format)
http://www.staff.uiuc.edu/~ehowes/resource.htm#AdShield (Eric Howes
AGNIS for AdShield block list - Recommended) (BTW, Eric's site contains
a wealth of very valuable information about all aspects of net
security - Very Highly Recommended)
There's also a new AdShield forum here:
http://users.boardnation.com/~adshield/index.php
Here's a good AdShield test site, courtesy of siljaline: "Make
***SURE*** you have your block scripted popups enabled
http://www.mediaboy.net/1010100-1100001-1111010/gahk/>>>> [Warning this
URL opens a multitude of Browser windows almost instantly]"
http://www.webwasher.com - Webwasher
Additionally, some people have recommended Popup Stopper and
PopupBuster, but they have also been reported or experienced to cause
perceived problems for some people with "normal" links in IE6 such as
Google search results and links from OE. Some proponents of PopupBuster
assert, however, that this is normal operation for this program under
certain circumstances which can be overridden if necessary. YMMV
Another "Proxy" type blocker similar to Webwasher and Proxomitron but
supposedly a bit easier to configure is Privoxy here:
http://www.privoxy.org/
Also, if you're comfortable allowing changes to the registry, there is
an approach, IE-SPYAD, using the restricted sites list which can be used
for scripted popups. I use this and it works very well. See here:
http://www.staff.uiuc.edu/~ehowes/resource.htm
There is additonal information about setting up and using AdShield, and
about using the Restriced Zone (and an additional list) here:
http://www.mvps.org/winhelp2002/hosts.htm
and some of the Frequently Asked Questions (FAQ's) about AdShield here:
http://adshield.briankass.com
Lastly, ZoneAlarmPro3/4 has added provisions for stopping adds/popups,
handling cookies, web bugs, and scripting/ActiveX components in addition
to it's firewall functionality. Not free, but I have used it with my
other AdBlocking stuff (AdShield, etc.) turned off as a test, and it
appears to be very good indeed. So far I've experienced no problems at
all with it set in its High Security modes for Ads although others have
reported the need to temporarily turn it off to reach some sites. Also,
Agnitum's Outpost Firewall supports a plug-in for this: "Pre-configured
to block most banner advertisement. Can be configured manually or by
simply dragging and dropping unwanted banners into the Ad Trashcan." I
have no experience as to how effective it is, but I have received a
favorable report.
There's good information about hijacking in general and fixes available
for specific hijackers here:
http://www.spywareinfo.com/hijacked.html
http://gmpservicesinc.com/Articles/hijack.asp
http://www.mvps.org/inetexplorer/Darnit.htm#pop_up
http://www.doxdesk.com/parasite/
bc_acadia's list:
"Some popup blockers.
All of these are 100% pure freeware, no trial periods. Some of these
do more than just handle popups.
Pow!:
http://www.analogx.com/contents/download/network/pow.htm
NoAds:
http://www.southbaypc.com/NoAds/
PopupEraser:
http://www.webknacks.com/popuperaser.htm
Stop-the-Pop:
http://www.bysoft.se/sureshot/stopthepop/index.html
Internet Organizer:
http://www.sf.yucom.be/wdprojects/
PopKi:
http://ranfo.com/popki.html
PopUpPopper:
http://www.bayden.com/Popper/default.asp
PopUpKiller:
http://sourceforge.net/projects/puk/
AdCruncher Proxy:
http://home.sprintmail.com/~dtrout/AdCruncher/ReadMe.html
KillAd:
http://www.wplus.net/pp/fsc/
ClickOff:
http://www.johanneshuebner.com/en/download.html
PopupBuster:
http://www.popupbuster.com/PopUpBuster/
Free Surfer:
http://www.kolumbus.fi/eero.muhonen/FS/
Window Shades:
http://www.g-m-m.com/Software/WindowShades/index.php
AdShield (my personal favorite):
http://www.adshield.org/
PopupStopper:
http://www.panicware.com/popupstopper.html
Proxomitron (has learning curve):
http://www.proxomitron.org/
For those who don't want third party stuff, your own pc's built-in
host file:
http://www.mvps.org/winhelp2002/hosts.htm and
http://www.smartin-designs.com/ and
http://www.accs-net.com/hosts/
Here is a review of 61 popup killers, not all of them are free:
http://www.popup-killer-review.com/index.htm"
NOTE that this site also contains a good, comprehensive series of popup
killer tests.
Finally, there's a new class of hijacker using Window's Messenger
Service (not Instant Messaging, BTW) that I discussed at first.
Perhaps these will help.
--
Regards, Jim Byrd, MS-MVP
Please respond in original thread in Newsgroup.
In
[email protected], William Boyd typed:
