Squishing Popups

  • Thread starter Thread starter LucretiaBorgia
  • Start date Start date
L

LucretiaBorgia

I went to my firewall (PC_Cillin) and put in UDP 135 and TCP 593, I
also have 823980, plus I disabled Messenger on run.

I still keep getting the popup, after I reboot, usually the next day.
Back to run and disable because I find it has started itself again.

From all the threads on the subject, the only other thing would be the
Net Bios numbers mentioned, but (doubtless because I am not very
familiar with these things) I have not been able to find out where and
how to deal with them.

Any not too technical help appreciated, thanks.

Sheena
 
If they say messenger service in the title bar, these popups have nothing to
do with MSN messenger or Windows messenger. What this is a new way for
spammers to attack your computer and send you pop-up ads. If you receive
these ads it means that your computers netbios ports are wide open to the
internet and this could be a real security problem. What you should do is
install a good firewall that will block the ports the spammers use and stop
the ads. A good place to start is Zone Alarm ( www.zonelabs.com ) for an
inbound/outbound blocking firewall or use the inbound blocking only firewall
built in to XP. If needed configure the XP firewall to block ports 135,
137-139 and 445. Zone Alarm will block these ports by default.

Use this site to test some of your ports security:
https://grc.com/x/ne.dll?bh0bkyd2

You can disable the messenger service, which is the service the spammers
exploit, but it isn't needed to stop the ads and disabling the service will
not secure your computer from outside attacks or block the open netbios
ports.

Note: If the Messenger service is stopped, messages from the Alerter
service (notifications from your antivirus software, for example) are
not transmitted. If the Messenger service is turned off, any services
that explicitly depend on the Messenger service do not start, and an
error message is logged in the System event log. For this reason,
Microsoft recommends that you install a firewall and configure it to
block NetBIOS and RPC traffic instead of turning off the Messenger
service.

If the pop-ups appear while surfing web pages then download and install one
of the many pop-up blocker programs. Search www.download.com for popup
blocker, you'll find many free ones.

Also get a good spyware cleaner -- http://security.kolla.de/
 
Greetings --

There are several varieties of pop-ups, and the solutions vary
accordingly. Which specific type(s) is troubling you?

Does the title bar of these pop-ups read "Messenger Service?"

This particular "sales method" is strikingly similar to the
"protection" rackets offered to small businesses by organized
criminals. Yes, it's a scam; no reputable business would need to
resort to extortion. Particularly since they're trying to sell you a
type of protection that is already available to you free of charge.

This type of spam has become quite common over the past few
months, and unintentionally serves as a valid security "alert." It
demonstrates that you haven't been taking sufficient precautions while
connected to the Internet. Your data probably hasn't been compromised
by these specific advertisements, but if you're open to this exploit,
you may well be open to other threats. Install and use a decent,
properly configured firewall. (Disabling the messenger service, as
some people recommend, only hides the symptom, and does nothing to
secure your machine.) And ignoring or just "putting up with" these
messages and the problem they represent is particularly foolish.

Messenger Service of Windows
http://support.microsoft.com/default.aspx?scid=KB;en-us;168893

Messenger Service Window That Contains an Internet Advertisement
Appears
http://support.microsoft.com/?id=330904

Stopping Advertisements with Messenger Service Titles
http://www.microsoft.com/windowsxp/pro/using/howto/communicate/stopspam.asp

Blocking Ads, Parasites, and Hijackers with a Hosts File
http://www.mvps.org/winhelp2002/hosts.htm

Oh, and be especially wary of people who advise you to do nothing
more than disable the messenger service. Disabling the messenger
service is a "head in the sand" approach to computer security.

The real problem is _not_ the messenger service pop-ups; they're
actually providing a useful service by acting as a security alert. The
true problem is the unsecured computer, and you've been
advised to merely turn off the warnings. How is this helpful?

Equivalent Scenario 1: Somewhere in a house, a small fire starts,
and sets off the smoke alarm. You, not immediately seeing any
fire/smoke, complain about the noise of the smoke detector, and are
advised to remove the smoke detector's battery and go back to sleep.

Equivalent Scenario 2: You over-exert your shoulder at work or
play, causing bursitis. After weeks of annoying and sometimes
excruciating pain whenever you try to reach over your head, you go to
a doctor and say, while demonstrating the motion, "Doc, it hurts when
I do this." The doctor, being as helpful as some of your respondents,
replies, "Well, don't do that."

I'm beginning to think that the people deliberately posting such
bad advice are hacker-wannabes who have no true interest in helping
you secure your system, but would rather give you a false sense of
security while ensuring that your computer is still open to
exploitation.

For regular Internet pop-ups, you might try the free 12Ghosts
Popup-killer from http://12ghosts.com/ghosts/popup.htm or Pop-Up
Stopper from http://www.panicware.com/. Myself, I use Norton Internet
Security, which, in addition to containing Norton Anti-Virus and
Personal Firewall, also blocks most of the pop-up adds on the
Internet.

For pop-ups caused by some sort of "adware" and/or "spyware" that
you've inadvertently installed, two products that are quite effective
at finding and removing scumware are Ad-Aware from www.lavasoft.de and
SpyBot Search and Destroy from http://security.kolla.de/. Both have
free evaluation versions.


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH
 
Greetings --

FYI, the GRS Shields Up Port Probe doesn't even scan/test one of
the ports (137) used by the messenger service.


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH
 
Thanks very much - I went to the Shield site and passed with flying
colours.

However, I am still getting the messenger popups after I reboot.

Do I understand you to mean that if I disable messenger through the
Run/disable method, I am also then stopping PC_Cillin sending me
updates on viruses etc ?

I already had Spybot and use it regularly.

The popups appear mostly when I am on msn.zone playing bridge, but
also at other times as well. Even once when editing some jpegs.

I don't know what NetBIOS and RPC traffic are I am afraid, far less
where to find them.

Thanks, Sheena

I'm not sure if it will effect pc-cillin. I don't use that av program. MS
says it could effect some av programs, but not sure which, if any.
If you still get them after tweaking the firewall, I would say try another
firewall. I know for a fact, 100%, that zone alarm firewall will block/stop
them. Since pc-cillin is really in the anti-virus business, it could be that
there firewall just isn't that good. Get a web page pop-up blocker as well.
(spybot is good).
 
Back
Top