Re: Messenger Service Popups

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: Phil \(a.k.a. purplehaz\) (software_at_for.me)
Date: 04/09/04 

Date: Thu, 8 Apr 2004 22:44:29 -0400

Steevo wrote:
> "Phil (a.k.a. purplehaz)" <software@for.me> wrote in message
> news:unuDe5aHEHA.3696@TK2MSFTNGP10.phx.gbl...
> Secure your hacker prone computer:
>
> If they say messenger service in the title bar, these pop ups have
> nothing to do with MSN messenger or Windows messenger. What this is a
> new way for spammers to attack your computer and send you pop-up ads.
> If you receive these ads it means that your computers netbios ports
> are wide open to the internet and this could be a real security
> problem. What you should do is install a good firewall that will
> block the ports the spammers use and stop the ads. A good place to
> start is Zone Alarm ( www.zonelabs.com ) for an inbound/outbound
> blocking firewall or use the inbound blocking only firewall built in
> to XP. If needed configure the firewall to block ports 135, 137-139
> and 445. Zone Alarm will block these ports by default.
>
> Use this site to test some of your ports security:
> https://grc.com/x/ne.dll?bh0bkyd2
>
> You can/should also disable the messenger service, which is the
> service the spammers exploit, but it isn't needed to stop the ads and
> disabling the service will not block the open netbios ports.
>
> Note: If the Messenger service is stopped, messages from the Alerter
> service (notifications from your antivirus software, for example) are
> not transmitted. If the Messenger service is turned off, any services
> that explicitly depend on the Messenger service do not start, and an
> error message is logged in the System event log. For this reason,
> Microsoft recommends that you install a firewall and configure it to
> block NetBIOS and RPC traffic instead of turning off the Messenger
> service. To turn off the service goto, control panel, administrative
> tools, services, find messenger, right click, properties, hit the
> stop button, set startup type to manual or disabled. (be sure to stay
> patched at windows update as well)
>
> If the pop-ups appear while surfing web pages then download and
> install one of the many pop-up blocker programs. Search
> www.download.com for popup blocker, you'll find many free ones.
>
> Also get a good spyware cleaner:
>
> Spybot - http://www.safer-networking.org/
>
> Ad-aware - http://www.lavasoft.com
>
>
>
> Many thanks for your advice, the messages do have "Messenger Service"
> in the title bar, and are not website popups.
> I had disabled the messenger service although since seeing your first
> post I have re-enabled it.
> I am currently using Norton Internet Security with the firewall
> installed and, as far as I was aware working. I have just checked the
> general rules section on the firewall and the "Default Inbound
> NetBIOS Name" and "Default Inbound NetBIOS" are both blocked. Despite
> this I am still recieving the messages. Do you know if there are any
> other settings I need to check/alter? In addition to this I already
> have both adaware and spybot installed and I regularly perform scans
> with both. As yet I have not found any items of concern.
>
>
> Many thanks

You can disable the service, that's up to you, just as long as you have a
firewall up and running and blocking the correct ports. I have no experience
with nortons firewall so I have no clue as to why it does not block the
netbios ports by default. Every firewall should and if yours isn't then I'd
try another firewall. Zone alarm and the built in firewall in xp will block
these ports by default with no configuring necessary.
Try the port scan at https://grc.com/x/ne.dll?bh0bkyd2
and see if your netbios ports are open. If so, then either setup nortons
correctly or try another firewall.

Quantcast