pop ups

N

neil

ever since upgrading to windos xp , I keep on getting pop
ups on the screen which will not go away. They invite me
to go to different web sites to buy a programme which
will stop the pop ups . It really is like blackmail. Aany
ideas how to stop them please.
 
J

Jim Byrd

Hi Neil - Well, more like extortion. If you get popups even when your
browser is not connected to the Internet with a title bar reading "Messenger
Service", then these are most likely due to open NetBios TCP ports 135, 139
and 445 and UDP ports 135, 137-138 and a UDP port in the range of
1026-1029.. You really need to block these with a firewall as a general
protection measure. You can stop the popups by turning off Messenger
Service; however, this still leaves you vulnerable. If you have an NT-based
OS such as XP or Win2k, you should probably also specifically block TCP
593, 4444 and UDP 69, 139, 445, and install the very important 823980 patch
from MS03-026, here: http://support.microsoft.com/?kbid=823980 to block
the Blaster worm.


See: Messenger Service Window That Contains an Internet Advertisement
Appears http://support.microsoft.com/?id=330904 which identifies reasons to
keep this service and steps to take if you do.

You can test your system and follow the 'Prevention' link to get additional
information here:
http://www.mynetwatchman.com/winpopuptester.asp Unless you have very good
reasons to keep this active, it should be turned off in Win2k and XP. Go
here and do what it says:
http://www.itc.virginia.edu/desktop/docs/messagepopup/ or, even better, get
MessageSubtract, free, here, which will give you flexible control of the
service and viewing of these messages:
http://www.intermute.com/messagesubtract/help.html Recommended.

(FWIW, ZoneAlarm's default Internet Zone firewall configuration blocks the
necessary ports to prevent this use of Messenger Service. I don't know the
situation with regard to other firewalls.)

Messenger Service is not per se Spyware or something that MS did wrong - It
provides a messaging capability which is useful for local intranets and is
also sometimes (albeit nowdays infrequently) used by some applications to
provide popup messaages to users. However, it can also be (and now
frequently is) used to introduce spam via this open NetBios channel. For a
single user home computer, it normally isn't needed and can be turned off
which will eliminate the spam popups. This DOESN'T, however, remove the
vulnerability of having these ports open, when in fact they aren't needed,
since they can be perverted in other ways as well, some of which can be much
more damaging than just a spam popup.


--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In
 
J

John Dingley

You have an open port somewhere. If you are not in an office, try enabling
the firewall on your web connection. Then run something like add aware and
spybot (both free) to get rid of any resident programs.
 
R

robert

only get.........

ad-aware
spybot

download these free and use them.
search for these in google.com/web
==================================================
 
R

rory

You can laugh now at the extortionists' expense. I swear, they took six
months off my life in two weeks before I took action against them. My
favorite popup was when they say, "OK, click here, and we'll never bother
you again." Five minutes later, the next popup says "BUT..." But nothing!
They want $30 to give you this very advice!
What you need to do is enable your firewall. Just type "firewall" into Help
and Support.
I found that this was not enough, however. I have McAfee Firewall, which is
blocking ALL my ports, and they still get through. My popup blocker kills
them, but disrupts the computer as it does its job. (Pop-up Stopper, free
from PanicWare.com)
 
E

EGMcCann

1. Get, and use, a firewall. XP's built in one is OK. ZoneAlarm works
wonderfully, though, and it's free. Alternately, if you're on broadband,
most routers have one built in as well.

2. If you're getting them offline, search for, download, and use Lavasoft's
Ad-Aware and/or Spybot S&D (don't recall the maker of the second program.)
They'll get rid of spyware.
 
A

AC

I'm guessing that these Pop-Ups are small grey rectangular
boxes that look as though they are from a Network
Administrator. They're not multi-coloured normal
advertising type Pop-Ups. If this is the case then to
prevent them ever coming in again do the following:

Control Panel|Administrative Tools|Services

Look for 'Messenger' in the right-hand Window and double-
click it. Under 'Start Up Type' select 'Disbled.' Problem
gone.

I would echo others and definitely download Ad-Aware
(free) from www.lavasoft.de

Regards
AC
 
W

Willit

If you don't want it or need it or the Alerter Service
Delete it. Most don't, unless you are on a network, other
than your own. The Alerter Service is used on a network to
send virus alerts. You have to be on a network before
either have any use.

To Delete the Messenger Service:

Go to Start/Run/CMD and type in: sc delete messenger.
Reboot.

or

Or go to Start/Run/Regedit and go to this key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
Messengerservice Delete Key. You can export it in case you
want it again,
then delete. Reboot
 
B

Bruce Chambers

Greetings --

There are at least three varieties of pop-ups, and the solutions
vary accordingly. Which specific type(s) is troubling you?

1) Does the title bar of these pop-ups read "Messenger Service?"

This type of spam has become quite common over the past several
months, and unintentionally serves as a valid security "alert." It
demonstrates that you haven't been taking sufficient precautions while
connected to the Internet. Your data probably hasn't been compromised
by these specific advertisements, but if you're open to this exploit,
you may well be open to other threats, such as the Blaster Worm that
recently swept cross the Internet. Install and use a decent,
properly configured firewall. (Merely disabling the messenger
service, as some people recommend, only hides the symptom, and does
little or nothing to truly secure your machine.) And ignoring or just
"putting up with" the security gap represented by these messages is
particularly foolish.

Messenger Service of Windows
http://support.microsoft.com/default.aspx?scid=KB;en-us;168893

Messenger Service Window That Contains an Internet Advertisement
Appears
http://support.microsoft.com/?id=330904

Stopping Advertisements with Messenger Service Titles
http://www.microsoft.com/windowsxp/pro/using/howto/communicate/stopspam.asp

Blocking Ads, Parasites, and Hijackers with a Hosts File
http://www.mvps.org/winhelp2002/hosts.htm

Oh, and be especially wary of people who advise you to do nothing
more than disable the messenger service. Disabling the messenger
service, by itself, is a "head in the sand" approach to computer
security. The real problem is _not_ the messenger service pop-ups;
they're actually providing a useful, if annoying, service by acting as
a security alert. The true problem is the unsecured computer, and
you've been advised to merely turn off the warnings. How is this
helpful?

2) For regular Internet pop-ups, you might try the free 12Ghosts
Popup-killer from http://12ghosts.com/ghosts/popup.htm, Pop-Up
Stopper from http://www.panicware.com/, or the Google Toolbar from
http://toolbar.google.com/. Myself, I use Norton Internet Security,
which, in addition to containing Norton Anti-Virus and Personal
Firewall, also blocks many of the pop-up adds on the Internet.

3) For pop-ups caused by some sort of "adware" and/or "spyware,"
such as Gator, Comet Cursors, or Bonzai Buddy, that you've
deliberately installed, two products that are quite effective at
finding and removing scumware are Ad-Aware from www.lavasoft.de and
SpyBot Search and Destroy from http://security.kolla.de/. Both have
free evaluation versions.


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH
 
B

Bruce Chambers

Greetings --

If messenger service pop-ups are still getting through, your
firewall isn't configured properly.

Use the firewall to ensure UDP ports 135, 137, and 138 and TCP
ports 135, 139, and 445 are _all_ blocked. You may also disable
Inbound NetBIOS (NetBIOS over TCP/IP). You'll have to follow the
instructions from firewall's manufacturer for the specific steps.


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH
 
B

Bruce Chambers

Greetings --

Please stop deliberately posting potentially harmful advice.

Disabling the messenger service is a "head in the sand" approach
to computer security that leaves the PC vulnerable to threats such as
the W32.Blaster.Worm.

The real problem is _not_ the messenger service pop-ups; they're
actually providing a useful service by acting as a security alert. The
true problem is the unsecured computer, and you're only
advice, however well-intended, was to turn off the warnings. How is
this helpful?

Equivalent Scenario: You over-exert your shoulder at work or
play, causing bursitis. After weeks of annoying and sometimes
excruciating pain whenever you try to reach over your head, you go to
a doctor and say, while demonstrating the motion, "Doc, it hurts when
I do this." The doctor, being as helpful as you are, replies, "Well,
don't do that."

The only true way to secure the PC, short of disconnecting it from
the Internet, is to install and *properly* configure a firewall; just
installing one and letting it's default settings handle things is no
good. Unfortunately, this does require one to learn a little bit more
about using a computer than used to be necessary.


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH
 
B

Bruce Chambers

Greetings --

Please stop deliberately posting potentially harmful advice.

Disabling the messenger service is a "head in the sand" approach
to computer security that leaves the PC vulnerable to threats such as
the W32.Blaster.Worm.

The real problem is _not_ the messenger service pop-ups; they're
actually providing a useful service by acting as a security alert. The
true problem is the unsecured computer, and you're only
advice, however well-intended, was to turn off the warnings. How is
this helpful?

Equivalent Scenario: You over-exert your shoulder at work or
play, causing bursitis. After weeks of annoying and sometimes
excruciating pain whenever you try to reach over your head, you go to
a doctor and say, while demonstrating the motion, "Doc, it hurts when
I do this." The doctor, being as helpful as you are, replies, "Well,
don't do that."

The only true way to secure the PC, short of disconnecting it from
the Internet, is to install and *properly* configure a firewall; just
installing one and letting it's default settings handle things is no
good. Unfortunately, this does require one to learn a little bit more
about using a computer than used to be necessary.


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH
 
R

rory

Thanks, I will test some more. Also, I have not used my computer while
offline lately. Apparently, those buggers may be "resident."
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

How To Stop Pop Ups? 4
Pop-Ups From New Owner 7
"Messenger Service" pop ups 10
Pop-Ups 2
Pop-Ups? 5
HOT DO I STOP THE POP UPS!!!!!!???? 9
Pop-Ups 10
pop ups? 2

Top