pop-up removal

[tdrawdy]

Can anyone tell me how remove the annoying pop-ups that
just seem to appear on my desktop.

 

[Richard Keirle]

Spend lots of time reading up on hoe and why they appear. Implement a
"multi-layered" approach to preventing and restricting pop-ups.

My latest discovery is, (okay, okay - some wise crack is gonna say it's been
around for ages) :-

http://www.staff.uiuc.edu/~ehowes/main.htm

Visit this site for a couple of *.reg files that will add several thousand
sites to your "Restricted sites" zone in IE
(Sites that are known to abuse ActiveX controls and Java Applets etc.)

regards, Richard

 

[Willit]

Get a fire wall or turn on the built-in one.

or

If They say "Messenger Service" in the top frame. There
are Several ways to do it.

Disable Method: Start > Run > Type "services.msc" >ok ,
on the services and applications find "Messenger" and
right click on it and choose properties choose "Disable"
in the middle Apply > ok.

or

Start Method : goto Start > Run > Type "msconfig" on the
Start Config. Menu go to Services Tab , go down the list
to "Messenger" uncheck, apply> ok re-boot. you will get a
warning when you re-boot >ok Done.

or

If you don't want it or need it or the Alerter Service
Delete it. Most don't, unless you are on a network, other
than your own. The Alerter Service is used on a network to
send virus alerts. You have to be on a network before
either have any use.

To Delete the Messenger Service:

Go to Start/Run/CMD and type in: sc delete messenger.
Reboot.

or

Or go to Start/Run/Regedit and go to this key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
Messengerservice Delete Key. You can export it in case you
want it again,
then delete. Reboot

 

[Richard Keirle]

"hoe" should have been "how," LOL ...that's an American word !!!

regards, Richard

 

[tdrawdy]

Thanks. Messenger service is the problem. I have
disabled it. Willit rules!!!!!

 

[Jim Byrd]

Hi tdrawdy - There are currently two classes of things going on that are
causing people popup difficulties. If you get popups even when your browser
is not connected to the Internet with a title bar reading "Messenger
Service", then these are most likely due to open NetBios ports 135, 137-139
and 445. You really need to block these with a firewall as a general
protection measure. You can stop the popups by turning off Messenger
Service; however, this still leaves you vulnerable. If you have an NT-based
OS such as XP or Win2k, you should probably also specifically block the
following additional ports as well: UDP 135, and TCP 593, and install the
very important 823980 patch from MS03-026, here:
http://support.microsoft.com/?kbid=823980.

See: Messenger Service Window That Contains an Internet Advertisement
Appears http://support.microsoft.com/?id=330904 which identifies reasons to
keep this service and steps to take if you do.

You can test your system and follow the 'Prevention' link to get additional
information here:
http://www.mynetwatchman.com/winpopuptester.asp Unless you have very good
reasons to keep this active, it should be turned off in Win2k and XP. Go
here and do what it says:
http://www.itc.virginia.edu/desktop/docs/messagepopup/ or, even better, get
MessageSubtract, free, here, which will give you flexible control of the
service and viewing of these messages:
http://www.intermute.com/messagesubtract/help.html Recommended.

(FWIW, ZoneAlarm's default Internet Zone firewall configuration blocks the
necessary ports to prevent this use of Messenger Service. I don't know the
situation with regard to other firewalls.)

Messenger Service is not per se Spyware or something that MS did wrong - It
provides a messaging capability which is useful for local intranets and is
also sometimes (albeit nowdays infrequently) used by some applications to
provide popup messaages to users. However, it can also be (and now
frequently is) used to introduce spam via this open NetBios channel.
For a single user home computer, it normally isn't needed and can be turned
off which will eliminate the spam popups. This DOESN'T, however, remove the
vulnerability of having these ports open, when in fact they aren't needed,
since they can be perverted in other ways as well, some of which can be much
more damaging than just a spam popup.



If you're getting a lot of popups while surfing, then the following may be
useful:

Popups - The best way to start is to get Ad-Aware 6.0, Build 162 or later,
here: http://www.lavasoftusa.com/support/download/. Update and run this
regularly to get rid of most "spyware/hijackware" on your machine.

Another excellent program for this purpose is SpyBot Search and Destroy
available here: http://security.kolla.de/ SpyBot Support Forum here:
http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi I recommend
using both normally. After fixing things with SpyBot S&D, be sure to re-boot
and rerun SpyBot again and repeat this cycle until you get a clean "no red"
scan.

Then, there are a variety of third party "Popup Killers" available. I
normally use AdShield, which, if you maintain its Block List every now and
then, almost totally stops this. In addition, it stops a variety of
ads/banners/etc. (particularly spyware like doubleclick) on pages I access.
This is probably all you'll need; however, I've also investigated a program
called ebwasher which appears to be very good, but decided that AdShield was
sufficient. At the bottom of this post, you'll find a list provided courtesy
of bc_acadia of a number of free popup blockers with links.

****** NOTE: As of 28 Apr 03 AdShield appears to have partnered with a new
reseller, and AdShield is no longer free. There is a trial version of
AdShield3; however, IMO it is seriously crippled in not being able to import
or export block lists and I think for reasonable utility one would have to
go to the full version. While I don't normally recommend non-free software,
I personally will continue to use AdShield3, since I think it is the best
currently available combined Popup/Ad/Malware blocker, but you should be
aware of the fact that it now costs, ($29.95), whereas the earlier versions
upon which I based my original recommendation were free, although not nearly
as capable as the AdShield3 release. I've included below links to both the
older free version and the new paid version. You'll have to investigate and
make your own choice in the matter. *******

Here are a number of AdShield-related links:

http://www.fsd1.org/technology/Files/AdShield.exe - AdShield1.2 (free)
http://www.internettechs.net/utilities/AdShield.exe - AdShield1.2
(free)
http://ftp.ural.ru/home/index/windows/networking/utils/AdShield -
AdShield1.2 (free)
http://www.megalog.ru/info/utilz/AdShield.zip - AdShield1.2 (free)
http://www.allstarss.com/store/adshield.html - AdShield3
http://www.mvps.org/winhelp2002/block.txt - (Mike Burgess' .txt Block List
for AdShield)
http://www.mvps.org/winhelp2002/block.zip - Mike Burgess' Zipped Block List
for AdShield - Recommended)
http://adshield.briankass.com/blocklists.html (lists a number of blocklists)
http://adshield.briankass.com/blocklist.abl (brian's blocklist in .abl
format)
http://adshield.briankass.com/blocklist.txt (brian's blocklist in .txt
format)
http://www.songwave.com/software/adshield_blocklist.txt (40,000 pornsites
blocked - *VERY* large list - use at your own risk)
http://www.chrismyden.com/temp/block.abl (chrismyden's blocklist in .abl
format)
http://www.staff.uiuc.edu/~ehowes/resource.htm#AdShield (Eric Howes AGNIS
for AdShield block list - Recommended) (BTW, Eric's site contains a wealth
of very valuable information about all aspects of net security - Very Highly
Recommended)

There's also a new AdShield forum here:
http://users.boardnation.com/~adshield/index.php

Here's a good AdShield test site, courtesy of siljaline: "Make ***SURE***
you have your block scripted popups enabled
http://www.mediaboy.net/1010100-1100001-1111010/gahk/>>>> [Warning this URL
opens a multitude of Browser windows almost instantly]"

http://www.webwasher.com - Webwasher


Additionally, some people have recommended Popup Stopper and PopupBuster,
but they have also been reported or experienced to cause perceived problems
for some people with "normal" links in IE6 such as Google search results and
links from OE. Some proponents of PopupBuster assert, however, that this is
normal operation for this program under
certain circumstances which can be overridden if necessary. YMMV Another
"Proxy" type blocker similar to Webwasher and Proxomitron but supposedly a
bit easier to configure is Privoxy here: http://www.privoxy.org/

Also, if you're comfortable allowing changes to the registry, there is an
approach, IE-SPYAD, using the restricted sites list which can be used for
scripted popups. I use this and it works very well. See here:
http://www.staff.uiuc.edu/~ehowes/resource.htm

There is additonal information about setting up and using AdShield, and
about using the Restriced Zone (and an additional list) here:
http://www.mvps.org/winhelp2002/hosts.htm and some of the Frequently Asked
Questions (FAQ's) about AdShield here: http://adshield.briankass.com

Lastly, ZoneAlarmPro3/4 has added provisions for stopping adds/popups,
handling cookies, web bugs, and scripting/ActiveX components in addition to
it's firewall functionality. Not free, but I have used it with my other
AdBlocking stuff (AdShield, etc.) turned off as a test, and it appears to be
very good indeed. So far I've experienced no problems at
all with it set in its High Security modes for Ads although others have
reported the need to temporarily turn it off to reach some sites. Also,
Agnitum's Outpost Firewall supports a plug-in for this: "Pre-configured to
block most banner advertisement. Can be configured manually or by simply
dragging and dropping unwanted banners into the Ad Trashcan." I
have no experience as to how effective it is, but I have received a
favorable report.

There's good information about hijacking in general and fixes available for
specific hijackers here: http://www.spywareinfo.com/hijacked.html
http://gmpservicesinc.com/Articles/hijack.asp
http://www.mvps.org/inetexplorer/Darnit.htm#pop_up
http://www.doxdesk.com/parasite/

bc_acadia's list:

"Some popup blockers. All of these are 100% pure freeware, no trial
periods. Some of these do more than just handle popups.

Pow!: http://www.analogx.com/contents/download/network/pow.htm
NoAds: http://www.southbaypc.com/NoAds/
PopupEraser: http://www.webknacks.com/popuperaser.htm
Stop-the-Pop: http://www.bysoft.se/sureshot/stopthepop/index.html
Internet Organizer: http://www.sf.yucom.be/wdprojects/
PopKi: http://ranfo.com/popki.html
PopUpPopper: http://www.bayden.com/Popper/default.asp
PopUpKiller: http://sourceforge.net/projects/puk/
AdCruncher Proxy:
http://home.sprintmail.com/~dtrout/AdCruncher/ReadMe.html
KillAd: http://www.wplus.net/pp/fsc/
ClickOff: http://www.johanneshuebner.com/en/download.html
PopupBuster: http://www.popupbuster.com/PopUpBuster/
Free Surfer: http://www.kolumbus.fi/eero.muhonen/FS/
Window Shades: http://www.g-m-m.com/Software/WindowShades/index.php
AdShield (my personal favorite): http://www.adshield.org/
PopupStopper: http://www.panicware.com/popupstopper.html
Proxomitron (has learning curve): http://www.proxomitron.org/
For those who don't want third party stuff, your own pc's built-in
host file:
http://www.mvps.org/winhelp2002/hosts.htm and
http://www.smartin-designs.com/ and http://www.accs-net.com/hosts/


Here is a review of 61 popup killers, not all of them are free:
http://www.popup-killer-review.com/index.htm"

NOTE that this site also contains a good, comprehensive series of popup
killer tests.


Finally, there's a new class of hijacker using Window's Messenger Service
(not Instant Messaging, BTW) that I discussed at first.

Perhaps these will help.

 

[S. Browning]

-----Original Message-----
Can anyone tell me how remove the annoying pop-ups that
just seem to appear on my desktop.
.

 

[purplehaz]

Yes but your ports are still wide open. Easily hacked ports, I might add.
Install and/or enable a firewall as well.

 

[Bruce Chambers]

Greetings --

There are several varieties of pop-ups, and the solutions vary
accordingly. Which specific type(s) is troubling you?

Does the title bar of these pop-ups read "Messenger Service?"

This particular "sales method" is strikingly similar to the
"protection" rackets offered to small businesses by organized
criminals. Yes, it's a scam; no reputable business would need to
resort to extortion. Particularly since they're trying to sell you a
type of protection that is already available to you free of charge.

This type of spam has become quite common over the past few
months, and unintentionally serves as a valid security "alert." It
demonstrates that you haven't been taking sufficient precautions while
connected to the Internet. Your data probably hasn't been compromised
by these specific advertisements, but if you're open to this exploit,
you may well be open to other threats. Install and use a decent,
properly configured firewall. (Disabling the messenger service, as
some people recommend, only hides the symptom, and does nothing to
secure your machine.) And ignoring or just "putting up with" these
messages and the problem they represent is particularly foolish.

Messenger Service of Windows
http://support.microsoft.com/default.aspx?scid=KB;en-us;168893

Messenger Service Window That Contains an Internet Advertisement
Appears
http://support.microsoft.com/?id=330904

Stopping Advertisements with Messenger Service Titles
http://www.microsoft.com/windowsxp/pro/using/howto/communicate/stopspam.asp

Blocking Ads, Parasites, and Hijackers with a Hosts File
http://www.mvps.org/winhelp2002/hosts.htm

Oh, and be especially wary of people who advise you to do nothing
more than disable the messenger service. Disabling the messenger
service is a "head in the sand" approach to computer security.

The real problem is _not_ the messenger service pop-ups; they're
actually providing a useful service by acting as a security alert. The
true problem is the unsecured computer, and you've been
advised to merely turn off the warnings. How is this helpful?

Equivalent Scenario 1: Somewhere in a house, a small fire starts,
and sets off the smoke alarm. You, not immediately seeing any
fire/smoke, complain about the noise of the smoke detector, and are
advised to remove the smoke detector's battery and go back to sleep.

Equivalent Scenario 2: You over-exert your shoulder at work or
play, causing bursitis. After weeks of annoying and sometimes
excruciating pain whenever you try to reach over your head, you go to
a doctor and say, while demonstrating the motion, "Doc, it hurts when
I do this." The doctor, being as helpful as some of your respondents,
replies, "Well, don't do that."

I'm beginning to think that the people deliberately posting such
bad advice are hacker-wannabes who have no true interest in helping
you secure your system, but would rather give you a false sense of
security while ensuring that your computer is still open to
exploitation.

For regular Internet pop-ups, you might try the free 12Ghosts
Popup-killer from http://12ghosts.com/ghosts/popup.htm or Pop-Up
Stopper from http://www.panicware.com/. Myself, I use Norton Internet
Security, which, in addition to containing Norton Anti-Virus and
Personal Firewall, also blocks most of the pop-up adds on the
Internet.

For pop-ups caused by some sort of "adware" and/or "spyware" that
you've inadvertently installed, two products that are quite effective
at finding and removing scumware are Ad-Aware from www.lavasoft.de and
SpyBot Search and Destroy from http://security.kolla.de/. Both have
free evaluation versions.


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Eric Warnke]

The real problem is _not_ the messenger service pop-ups; they're
actually providing a useful service by acting as a security alert. The
true problem is the unsecured computer, and you've been
advised to merely turn off the warnings. How is this helpful?

I have never *ever* received any security related information
through the messanger service. Are you referring to a LAN office
or home environment?

I would never use not trust anything sent through windows
messaging and I disable it on every PC I have access to. One
less service to worry about.

 

[purplehaz]

I have never *ever* received any security related information
through the messanger service. Are you referring to a LAN office
or home environment?

I would never use not trust anything sent through windows
messaging and I disable it on every PC I have access to. One
less service to worry about.

The messenger service is a very useful tool. There is nothing bad about it.
Why would you disable it? Open netbios ports and not using a firewall is
bad. The security alert he's talking about is, if you get messenger service
ads, that's telling you, that you're netbios ports are wide open to the
internet. Ports that can be easily hacked or explotied. (he said acting as a
security alert, not that you get alerts).
The messenger service(and netsend) can very useful in office or home
environments. It is very common today to have a lan in your home. MS says
some versions of anti-virus software use it also. I use it every single day.

 

[Bruce Chambers]

Greetings --

Then you've apparently had very little experience supporting
corporate LANs and enterprise or network level anti-virus solutions.

While it's true that the average home consumer has little or no
use for the messenger service, disabling said service does nothing but
hide the security problem. The system "resources" freed by disabling
the messenger service are insignificant.


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH