Worse than a virus

[Richard]

This may not be the right forum but those that seemed
correct were unavailable. This is certainly a security
issue, I veiw the problem in the same vein as a virus. I
am receiving many Pop Ups, via messenger service. I
understand this is a feature of Windows XP. The pop Up are
usually a sales pitch for software that will eliminate the
pop ups forever and a URL to their site with instructions
of how to buy. This seems akin to trying to sell me fire
protection after setting my house on fire. That would be a
perfect example of why I would need the protection but a
pretty unethical way of getting the sale. My question is
this: If this is a feature of Windows XP.....how can I
disable that feature, short of not using the XP operating
system any longer?

 

[Sarah]

Start
right click "My Computer"
"MAnage"
services
find MESSENGER on the list, right click, STOP
then right click on it, PROPERTIES,
in there make it say DISABLED. apply, ok, wah la

Sarah

 

[Chris Lanier]

If is a feature do IT ppl. But just like all good things, they can be
exploited.

Stopping Advertisements with Messenger Service Titles
http://www.microsoft.com/windowsxp/pro/using/howto/communicate/stopspam.asp

 

[Ken Briscoe]

how can I

disable that feature, short of not using the XP operating
system any longer?

2 ways:
1) install a firewall. ZoneAlarm works (www.zonelabs.com), outpost is
another good one. they're free and easy to use. Alternatively, you can
enable XP's built in firewall by going to your network connections, right
clicking your connection, selecting Properties, and I believe it's just
ticking "Enable ICF" or something to that effect.
2) You can disable the messenger service itself, by right-clicking My
Computer, select Manage. Go to Services, then select "Messenger Service".
Right click it, select Properties, and stop the service and make it not
start when you reboot.

The first way is the safest way. The second way will get rid of your pop
ups, but it won't solve the problem of having your computer exposed to the
internet.

KB

 

[purplehaz]

Secure your hacker prone computer:

If they say messenger service in the title bar, these popups have nothing to
do with MSN messenger or Windows messenger. What this is a new way for
spammers to attack your computer and send you pop-up ads. If you receive
these ads it means that your computers netbios ports are wide open to the
internet and this could be a real security problem. What you should do is
install a good firewall that will block the ports the spammers use and stop
the ads. A good place to start is Zone Alarm ( www.zonelabs.com ) for an
inbound/outbound blocking firewall or use the inbound blocking only firewall
built in to XP. If needed configure the XP firewall to block ports 135,
137-139 and 445. Zone Alarm will block these ports by default.

Use this site to test some of your ports security:
https://grc.com/x/ne.dll?bh0bkyd2

You can disable the messenger service, which is the service the spammers
exploit, but it isn't needed to stop the ads and disabling the service will
not secure your computer from outside attacks or block the open netbios
ports.

Note: If the Messenger service is stopped, messages from the Alerter
service (notifications from your antivirus software, for example) are
not transmitted. If the Messenger service is turned off, any services
that explicitly depend on the Messenger service do not start, and an
error message is logged in the System event log. For this reason,
Microsoft recommends that you install a firewall and configure it to
block NetBIOS and RPC traffic instead of turning off the Messenger
service.

If the pop-ups appear while surfing web pages then download and install one
of the many pop-up blocker programs. Search www.download.com for popup
blocker, you'll find many free ones.

Also get a good spyware cleaner -- http://security.kolla.de/

 

[Gordon Burgess-Parker]

This may not be the right forum but those that seemed
correct were unavailable. This is certainly a security
issue, I veiw the problem in the same vein as a virus. I
am receiving many Pop Ups, via messenger service. I
understand this is a feature of Windows XP. The pop Up are
usually a sales pitch for software that will eliminate the
pop ups forever and a URL to their site with instructions
of how to buy. This seems akin to trying to sell me fire
protection after setting my house on fire. That would be a
perfect example of why I would need the protection but a
pretty unethical way of getting the sale. My question is
this: If this is a feature of Windows XP.....how can I
disable that feature, short of not using the XP operating
system any longer?

Install a firewall.

 

[Chris Lanier]

NOTE: This does not slove the problem of the un-need traffic getting into
your PC. You need to be running a firewall first, then if you wish you may
disable the service.

 

[Gordon Burgess-Parker]

Start
right click "My Computer"
"MAnage"
services
find MESSENGER on the list, right click, STOP
then right click on it, PROPERTIES,
in there make it say DISABLED. apply, ok, wah la

Sarah

This is only HALF the solution. You MUST recommend a firewall as well.
Stopping the messenger service still leaves the NETBios ports through which
they are sent WIDE OPEN.

 

[purplehaz]

Disabling the messenger service does not stop the real problem, which is
open netbios ports. These ports are easy to hack and exploit. The only
correct solution to stopping messenger service spam is to enable a firewall.
Disabling the messenger service should not even be an option. In fact, the
messenger service is doing the user a service by warning them that their
netbios ports are open and they will most likely be hacked. Enabling a
firewall is the solution to messenger service spam and hackers/exploits.
Posting info on disabling the service without providing the real solution
could be potnetially dangerous to the end user.

 

[mccoyn]

Here is the MS page explaining what it is and how to get
rid of it.

http://support.microsoft.com/default.aspx?scid=kb;en-
us;330904

 

[Rob Schneider]

This may not be the right forum but those that seemed
correct were unavailable. This is certainly a security
issue, I veiw the problem in the same vein as a virus. I
am receiving many Pop Ups, via messenger service. I
understand this is a feature of Windows XP. The pop Up are

They are not a feature of Windows XP. It's really how the http protocal
and the Internet works, and limitations in Internet Explorer prevent you
to enable you to control it better.

usually a sales pitch for software that will eliminate the
pop ups forever and a URL to their site with instructions
of how to buy. This seems akin to trying to sell me fire
protection after setting my house on fire. That would be a
perfect example of why I would need the protection but a
pretty unethical way of getting the sale. My question is
this: If this is a feature of Windows XP.....how can I
disable that feature, short of not using the XP operating
system any longer?

There are plenty of pop-up eliminators available in the world. Search
Google. Symantec will sell you software to do this, as will others. Free
software can be found.

My favourites:

1. Use Mozilla web browser. Not only is it better than IE (tabbed
browsing is terrific), it has built-in popup eliminator. See
www.mozilla.org
2. Add the Google Toolbar to Microsoft Internet Explorer. It seems to
be very effective, plus it gives some good added features to improve use
of Google. See http://toolbar.google.com/

You'll get lots of other ideas on this thread from others.

 

[Jim Macklin]

That stops the symptom, turn on the firewall to stop the
messenger and block the hole.


| Start
| right click "My Computer"
| "MAnage"
| services
| find MESSENGER on the list, right click, STOP
| then right click on it, PROPERTIES,
| in there make it say DISABLED. apply, ok, wah la
|
| Sarah
|
| | > This may not be the right forum but those that seemed
| > correct were unavailable. This is certainly a security
| > issue, I veiw the problem in the same vein as a virus. I
| > am receiving many Pop Ups, via messenger service. I
| > understand this is a feature of Windows XP. The pop Up
are
| > usually a sales pitch for software that will eliminate
the
| > pop ups forever and a URL to their site with
instructions
| > of how to buy. This seems akin to trying to sell me fire
| > protection after setting my house on fire. That would be
a
| > perfect example of why I would need the protection but a
| > pretty unethical way of getting the sale. My question is
| > this: If this is a feature of Windows XP.....how can I
| > disable that feature, short of not using the XP
operating
| > system any longer?
| >
|
|

 

[dev]

Richard said:

This may not be the right forum but those that seemed
correct were unavailable. This is certainly a security
issue, I veiw the problem in the same vein as a virus. I
am receiving many Pop Ups, via messenger service. I
understand this is a feature of Windows XP. The pop Up are
usually a sales pitch for software that will eliminate the
pop ups forever and a URL to their site with instructions
of how to buy. This seems akin to trying to sell me fire
protection after setting my house on fire. That would be a
perfect example of why I would need the protection but a
pretty unethical way of getting the sale. My question is
this: If this is a feature of Windows XP.....how can I
disable that feature, short of not using the XP operating
system any longer?

This is a useful feature - being misused. Enable the XP firewall. See
HELP & SUPPORT for easy instructions. Type "firewall" into the search box.

Then, if necessary, disable Messenger. START
button|ALL|ADMINISTRATIVE|SERVICES. Double-click the item, then click the
small black arrow at the right of the Startup Type box. Choose DISABLE,
then click on OK.

 

[Crusty \(-: Old B@stard :-\)]

Use a "GOOD" firewall program. I use ZoneAlarm Pro, and have never even seen
one of these pop-ups that so many complain about.

 

[Bruce Chambers]

Greetings --

This type of spam has become quite common over the past year, and
unintentionally serves as a valid security "alert." It demonstrates
that you haven't been taking sufficient precautions while connected to
the Internet. Your data probably hasn't been compromised by these
specific advertisements, but if you're open to this exploit, you are
open to other threats, such as the Blaster and Welchia worms that
recently swept cross the Internet. Install and use a decent,
properly configured firewall. (Merely disabling the messenger
service, as some people recommend, only hides the symptom, and does
little or nothing to truly secure your machine.) And ignoring or just
"putting up with" the security gap represented by these messages is
particularly foolish.

Messenger Service of Windows
http://support.microsoft.com/default.aspx?scid=KB;en-us;168893

Messenger Service Window That Contains an Internet Advertisement
Appears
http://support.microsoft.com/?id=330904

Stopping Advertisements with Messenger Service Titles
http://www.microsoft.com/windowsxp/pro/using/howto/communicate/stopspam.asp

Blocking Ads, Parasites, and Hijackers with a Hosts File
http://www.mvps.org/winhelp2002/hosts.htm

Oh, and be especially wary of people who advise you to do nothing
more than disable the messenger service. Disabling the messenger
service, by itself, is a "head in the sand" approach to computer
security. The real problem is _not_ the messenger service pop-ups;
they're actually providing a useful, if annoying, service by acting as
a security alert. The true problem is the unsecured computer, and
you've been advised to merely turn off the warnings. How is this
helpful?


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Bruce Chambers]

Greetings --

Please stop deliberately posting potentially harmful advice.

Disabling the messenger service is a "head in the sand" approach
to computer security that leaves the PC vulnerable to threats such as
the W32.Blaster.Worm.

The real problem is _not_ the messenger service pop-ups; they're
actually providing a useful service by acting as a security alert. The
true problem is the unsecured computer, and you're only
advice, however well-intended, was to turn off the warnings. How is
this helpful?

Equivalent Scenario: You over-exert your shoulder at work or
play, causing bursitis. After weeks of annoying and sometimes
excruciating pain whenever you try to reach over your head, you go to
a doctor and say, while demonstrating the motion, "Doc, it hurts when
I do this." The doctor, being as helpful as you are, replies, "Well,
don't do that."

The only true way to secure the PC, short of disconnecting it from
the Internet, is to install and *properly* configure a firewall; just
installing one and letting it's default settings handle things is no
good. Unfortunately, this does require one to learn a little bit more
about using a computer than used to be necessary.


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Dwight Stewart]

Please stop deliberately posting potentially harmful advice.

Actually, Sarah didn't offer any "advice," Bruce. Richard specifically
asked how to disable Messenger Service and Sarah told him how to do so.
Therefore, there was no need to mischaracterize her comments when adding
additional information to that.


Dwight Stewart (W5NET)

http://www.qsl.net/w5net/

 

[purplehaz]

Actually, Sarah didn't offer any "advice," Bruce. Richard specifically
asked how to disable Messenger Service and Sarah told him how to do so.
Therefore, there was no need to mischaracterize her comments when adding
additional information to that.

Not quite, at least that not how I read it. The op actually said they are
getting pop-ups via the messenger service. Then they said they understand
this is a feature of xp, (that the pop-ups are a feature of xp is how I read
it). Then he asked how to disable that feature. They did not want to disable
the messenger service, nor did they ever say how do you disable the
messenger service, they wanted to stop the pop-ups. Sarah then posted the
wrong answer on how to stop messenger service popups. Bruce and others were
right in correcting her about posting potentially harmful advice.

 

[=?ISO-8859-1?Q?SunnyB=A9?=]

Try this quote from Slashdot.
http://slashdot.org/article.pl?sid=03/10/16/125223
At this point Microsoft has even posted that the Messenger Service should be
disabled.

"Microsoft released yesterday a whole bunch of critical security updates.
Out of these, MS03-043 is a flaw in the Windows Messenger Service (not MSN
Messenger) with the possibility of a remote attacker gaining complete
control of a Windows NT/2000/XP/2003 based PC remotely. If this sounds like
another possible vector for a worm to spread, you'd probably be right.
Microsoft's recommendation is to 'disable the Messenger Service immediately
and evaluate their need to deploy the patch'. Of course a firewall will
offer some protection but shouldn't be relied on. At least administrators
can disable the Messenger Service remotely. Of course this is another
headache for admins still patching for last month's RPC flaw."

Seems you are the one posting "potentially harmful advice" and are guilty of
a "head in the sand" approach. One of the problems with that position is
that it leaves your backside vulnerable.

Greetings --

Please stop deliberately posting potentially harmful advice.

Disabling the messenger service is a "head in the sand" approach
to computer security that leaves the PC vulnerable to threats such as
the W32.Blaster.Worm.

The real problem is _not_ the messenger service pop-ups; they're
actually providing a useful service by acting as a security alert. The
true problem is the unsecured computer, and you're only
advice, however well-intended, was to turn off the warnings. How is
this helpful?

Equivalent Scenario: You over-exert your shoulder at work or
play, causing bursitis. After weeks of annoying and sometimes
excruciating pain whenever you try to reach over your head, you go to
a doctor and say, while demonstrating the motion, "Doc, it hurts when
I do this." The doctor, being as helpful as you are, replies, "Well,
don't do that."

The only true way to secure the PC, short of disconnecting it from
the Internet, is to install and *properly* configure a firewall; just
installing one and letting it's default settings handle things is no
good. Unfortunately, this does require one to learn a little bit more
about using a computer than used to be necessary.


Bruce Chambers

§ß©

 

[=?ISO-8859-1?Q?SunnyB=A9?=]

Try this quote from Slashdot.
http://slashdot.org/article.pl?sid=03/10/16/125223
At this point Microsoft has even posted that the Messenger Service should be
disabled.

"Microsoft released yesterday a whole bunch of critical security updates.
Out of these, MS03-043 is a flaw in the Windows Messenger Service (not MSN
Messenger) with the possibility of a remote attacker gaining complete
control of a Windows NT/2000/XP/2003 based PC remotely. If this sounds like
another possible vector for a worm to spread, you'd probably be right.
Microsoft's recommendation is to 'disable the Messenger Service immediately
and evaluate their need to deploy the patch'. Of course a firewall will
offer some protection but shouldn't be relied on. At least administrators
can disable the Messenger Service remotely. Of course this is another
headache for admins still patching for last month's RPC flaw."

Seems you are the one posting "potentially harmful advice" and are guilty of
a "head in the sand" approach. One of the problems with that position is
that it leaves your backside vulnerable.

Greetings --

Please stop deliberately posting potentially harmful advice.

Disabling the messenger service is a "head in the sand" approach
to computer security that leaves the PC vulnerable to threats such as
the W32.Blaster.Worm.

The real problem is _not_ the messenger service pop-ups; they're
actually providing a useful service by acting as a security alert. The
true problem is the unsecured computer, and you're only
advice, however well-intended, was to turn off the warnings. How is
this helpful?

Equivalent Scenario: You over-exert your shoulder at work or
play, causing bursitis. After weeks of annoying and sometimes
excruciating pain whenever you try to reach over your head, you go to
a doctor and say, while demonstrating the motion, "Doc, it hurts when
I do this." The doctor, being as helpful as you are, replies, "Well,
don't do that."

The only true way to secure the PC, short of disconnecting it from
the Internet, is to install and *properly* configure a firewall; just
installing one and letting it's default settings handle things is no
good. Unfortunately, this does require one to learn a little bit more
about using a computer than used to be necessary.


Bruce Chambers

§ß©