Windows Messenger Service

[G H]

I keep getting these annoying pop-up messages (in grey boxes, and usually
advertising some porn site), despite the fact that my Nortons Firewall is
cranked up to the max! I understand that this is something to do with the
Windows Messenger Service (not to be confused with MSN Messenger - the chat
program).
I know there is a way to disable this on my PC, can anyone tell me how to go
about it, thanks!

 

[Doug Knox MS-MVP]

Open Help and Support and search for "firewall". This will tell you how to enable XP's built in firewall. If you have a valid reason not to use a firewall, click Start, Run and enter SERVICES.MSC Locate the Messenger entry and double click it. Set it to Stopped and Disabled.

However, the reason they can get to the Messenger Service (not to be confused with Windows Messenger) in the first place, is that your internet connection is not secure.

http://www.dougknox.com/xp/tips/winmesspop.htm

 

[Guest]

Try visiting www,grc.com and download there shoot the
messenger file.

-----Original Message-----
Open Help and Support and search for "firewall". This

will tell you how to enable XP's built in firewall. If
you have a valid reason not to use a firewall, click
Start, Run and enter SERVICES.MSC Locate the Messenger
entry and double click it. Set it to Stopped and
Disabled.

However, the reason they can get to the Messenger

Service (not to be confused with Windows Messenger) in
the first place, is that your internet connection is not
secure.

http://www.dougknox.com/xp/tips/winmesspop.htm

--
Doug Knox, MS-MVP Windows XP/ Windows Smart Display
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/xp_securityconsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

"G H" <[email protected]> wrote in

message news:[email protected]...

 

[Redmond]

I believe GH just got the best info on his problem..from Doug Knox..he is
one of the best here (if not the best).But your advice is ok too..been to
that site.

 

[Bruce Chambers]

Greetings --

This type of spam has become quite common over the past several
months, and unintentionally serves as a valid security "alert." It
demonstrates that you haven't been taking sufficient precautions while
connected to the Internet. Your data probably hasn't been compromised
by these specific advertisements, but if you're open to this exploit,
you may well be open to other threats, such as the Blaster Worm that
recently swept cross the Internet. Install and use a decent,
properly configured firewall. (Merely disabling the messenger
service, as some people recommend, only hides the symptom, and does
little or nothing to truly secure your machine.) And ignoring or just
"putting up with" the security gap represented by these messages is
particularly foolish.

Messenger Service of Windows
http://support.microsoft.com/default.aspx?scid=KB;en-us;168893

Messenger Service Window That Contains an Internet Advertisement
Appears
http://support.microsoft.com/?id=330904

Stopping Advertisements with Messenger Service Titles
http://www.microsoft.com/windowsxp/pro/using/howto/communicate/stopspam.asp

Blocking Ads, Parasites, and Hijackers with a Hosts File
http://www.mvps.org/winhelp2002/hosts.htm

Whichever firewall you decide upon, be sure to ensure
UDP ports 135, 137, and 138 and TCP ports 135, 139, and 445 are _all_
blocked. You may also disable Inbound NetBIOS (NetBIOS over TCP/IP).
You'll have to follow the instructions from firewall's manufacturer
for the specific steps.

You can test your firewall at:

Symantec Security Check
http://security.symantec.com/ssc/vr_main.asp?langid=ie&venid=sym&plfid=23&pkj=GPVHGBYNCJEIMXQKCDT

Oh, and be especially wary of people who advise you to do nothing
more than disable the messenger service. Disabling the messenger
service, by itself, is a "head in the sand" approach to computer
security. The real problem is _not_ the messenger service pop-ups;
they're actually providing a useful, if annoying, service by acting as
a security alert. The true problem is the unsecured computer, and
you've been advised to merely turn off the warnings. How is this
helpful?


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Bruce Chambers]

Greetings --

Please stop deliberately posting potentially harmful advice.

Disabling the messenger service, as Gibson's utility does, is a
"head in the sand" approach to computer security that leaves the PC
vulnerable to threats such as the W32.Blaster.Worm.

The real problem is _not_ the messenger service pop-ups; they're
actually providing a useful service by acting as a security alert. The
true problem is the unsecured computer, and you're only
advice, however well-intended, was to turn off the warnings. How is
this helpful?

Equivalent Scenario: You over-exert your shoulder at work or
play, causing bursitis. After weeks of annoying and sometimes
excruciating pain whenever you try to reach over your head, you go to
a doctor and say, while demonstrating the motion, "Doc, it hurts when
I do this." The doctor, being as helpful as you are, replies, "Well,
don't do that."

The only true way to secure the PC, short of disconnecting it from
the Internet, is to install and *properly* configure a firewall; just
installing one and letting it's default settings handle things is no
good. Unfortunately, this does require one to learn a little bit more
about using a computer than used to be necessary.


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Bruce Chambers]

Greetings --

You quite correct about Doug being one of the best.

However, perhaps you should hear what computer security
specialists have to say about Steve Gibson's "security" expertise
before deciding. You can start here: http://www.grcsucks.com/


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Guest]

Great Post, you got your brownie points, now post
something constructive.

 

[Redmond]

Bruce, All I said was been to that site..CAN YOU READ????

 

[Guest]

The poster asked about Messenger Service they never asked
how to protect their entire system from all perils, but
since you mentioned it why don't you volunteer to go do a
back up for them.

 

[Guest]

Windows Messenger is a worthless piece of crap. Why in
the world MS would not make it a installable option I
have no idea.

If you don't want it or need it or the Alerter Service
Delete it. Most don't, unless you are on a network, other
than your own. The Alerter Service is used on a network
to send virus alerts. You have to be on a network before
either have any use.

To Delete the Messenger Service:

Go to Start/Run/CMD and type in: sc delete messenger.
Reboot.

or

Or go to Start/Run/Regedit and go to this key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
Messengerservice Delete Key. You can export it in case
you want it again,
then delete. Reboot

 

[Bruce Chambers]

Greetings --

Of course, I can read. You also said the information that site
provided was OK. It plainly isn't.

Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Redmond]

Amazing, here I'm giving credit to a MVP giving credit for trying to help to
a anonymous user, and the results is another MVP comes on gives same advice
as 1st MVP and knocks down people!

 

[Redmond]

Point was he was trying to help..I don't knock people..was at that site..if
no one answered the post but him at least its a start. Not all are PC
brains!

 

[MAP]

Interesting reading Bruce,Thanks I'll have to read more
and decied if I'm one of them who has been snokered

 

[MAP]

Norton's firewall should be able to stop this, check your
settings something may be wrong with it.

 

[Alex Nichol]

I keep getting these annoying pop-up messages (in grey boxes, and usually
advertising some porn site), despite the fact that my Nortons Firewall is
cranked up to the max! I understand that this is something to do with the
Windows Messenger Service (not to be confused with MSN Messenger - the chat
program).

Make sure that your firewall is set to block port 138 - used by NETBIOS
- it is that facility that is being used to get at the Messenger
service. Port 138 is the one used, and should be blocked.
You can turn off the Messenger service in Admin Tools - Services, but I
would first track down why the firewall is not being effective - that
port was also the one used by the BLAST Worm, so if anything suggests it
is not blocked it needs investigation