Re: Q. Some Internet bug stopped by diabling the Messenger Service

From: Bruce Chambers (bruce_a_chambers_at_h0tmail.com)
Date: 12/19/04 

Date: Sun, 19 Dec 2004 10:36:29 -0700

George wrote:
> Hi,
>
> I was getting a few pop-ups, while surfing the web. These weren't your
> normal Internet pop-ups. They were more like system-looking pop-ups,
> that were grey, with black text, that would make one think was being
> generated from the Windows environment.
>
> They ARE NOT. They are spam, like most everything else on the web.
> BUT, these were a real paint to get rid of. They would pop up about
> every 15 minutes or so.
>
> I don't wish to say which sites they were spamming for, as I realized
> part of their ploy was to promote the site, first by invading the
> machines, and 2nd by people filling the newsgroups with complaints
> about them, enabling more traffic to their site.
>
> So, I stopped my Windows 2000 messenger service, and so far, the
> messages stopped.
>
> I would just like to know if anything bad can happen as a result of my
> having completely 'disabled' the service, or if I should expect
> something to not work.
> Thanks, George
>

     This type of spam has become quite common over the last couple of
years, and unintentionally serves as a valid security "alert." It
demonstrates that you haven't been taking sufficient precautions while
connected to the Internet. Your data probably hasn't been compromised
by these specific advertisements, but if you're open to this exploit,
you may well be open to other threats, such as the Blaster and Welchia
Worms that swept across the Internet last year and the currently active
Sasser Worm. Install and use a decent, properly configured firewall.
(Merely disabling the messenger service, as some people recommend, only
hides the symptom, and does little or nothing to truly secure your
machine.) And ignoring or just "putting up with" the security gap
represented by these messages is particularly foolish.

Messenger Service of Windows
http://support.microsoft.com/default.aspx?scid=KB;en-us;168893

Messenger Service Window That Contains an Internet Advertisement
Appears
http://support.microsoft.com/?id=330904

Stopping Advertisements with Messenger Service Titles
http://www.microsoft.com/windowsxp/pro/using/howto/communicate/stopspam.asp

Blocking Ads, Parasites, and Hijackers with a Hosts File
http://www.mvps.org/winhelp2002/hosts.htm

     Oh, and be especially wary of people who advise you to do nothing
more than disable the messenger service. Disabling the messenger
service, by itself, is a "head in the sand" approach to computer
security. The real problem is not the messenger service pop-ups;
they're actually providing a useful, if annoying, service by acting as a
security alert. The true problem is the unsecured computer, and you've
been advised to merely turn off the warnings. How is this helpful?

     Now, as for the Messenger Service itself, it generally doesn't
hurt any thing to turn it off, although I never recommend doing so.
Granted, the service is of little or no use to most home PC users
(Although I've had uses it on my home LAN.), and turning off
unnecessary services is part of any standard computer security
protocol. However, I feel that the potential benefits of leaving the
Messenger Service enabled out-weigh any as-yet-theoretical risks that
it presents. It will indirectly let the computer user know that
his/her firewall has failed by displaying the Messenger Service spam.
Think of it as the canary that miners used to take down into the
mineshafts with them. There are others, of course, who disagree with
me on this point and advise turning off the service because it isn't
needed; you'll have to make up your own mind here. 

-- 
Bruce Chambers
Help us help you:
http://dts-l.org/goodpost.htm
http://www.catb.org/~esr/faqs/smart-questions.html
You can have peace. Or you can have freedom. Don't ever count on having 
both at once. - RAH

Relevant Pages

  • Re: Messager Service Pop-up Dialogs
    ... WINDOWS REQUIRES IMMEDIATE ATTENTION. ... ignoring or just "putting up with" the security gap represented by ... Messenger Service of Windows ... reliable and up-to-date antivirus software, ...
    (microsoft.public.win2000.security)
  • Re: licensing
    ... (Merely disabling the messenger service, ... the security gap represented by these messages is particularly ... Messenger Service of Windows ...
    (microsoft.public.windowsxp.general)
  • Question on Windows Messenger Service
    ... the security gap represented by these messages is ... Messenger Service of Windows ... Disabling the messenger service, by itself, is a "head in ...
    (microsoft.public.windowsxp.general)
  • Re: VIRUS
    ... (Merely disabling the messenger service, ... the security gap represented by these messages is particularly ... Messenger Service of Windows ...
    (microsoft.public.security.virus)
  • Re: mydoom popup? need answer now ty
    ... (Merely disabling the messenger service, ... the security gap represented by these messages is particularly ... Messenger Service of Windows ...
    (microsoft.public.security.virus)
Loading