"Messenger Service" spam

[Clay]

I keep getting a window that pops up every 5-10 minutes
entitled "Messenger Service"
it's some sort of spam about a website www.DESTROYADS.com
or something... I cannot get it to stop, no matter what I
do! I need help

the first line of the message that I'm looking at right
now says "Message from WINDOWS ALERT to WINDOWS USER on
5/3/2003 8:41:04 PM"

I have a screenshot of the window if anyone thinks it
will help.

[Torgeir Bakken (MVP)]

Clay wrote:

> I keep getting a window that pops up every 5-10 minutes
> entitled "Messenger Service"
> it's some sort of spam about a website www.DESTROYADS.com
> or something... I cannot get it to stop, no matter what I
> do! I need help
>
> the first line of the message that I'm looking at right
> now says "Message from WINDOWS ALERT to WINDOWS USER on
> 5/3/2003 8:41:04 PM"

Hi

You can disable the Messenger service, but by doing only that, the
computer will STILL be open to the Internet and be pretty unsecured. The
Messenger Service messages is only the symptom, and not the cause.

You should follow the recommendations in the MS Knowledge Base article 330904:

Messenger Service Window That Contains an Internet Advertisement Appears
http://support.microsoft.com/?id=330904

Here is the most important part of it:

"For this reason, Microsoft recommends that you install a firewall and
configure it to block NetBIOS traffic instead of merely just turning off
the Messenger service."

That means blocking internet access to ports 135, 137-139 and 445 with a SW or
HW firewall.

http://securityadmin.info/faq.htm#firewall

Some general information about popups and how to stop it:
http://securityadmin.info/faq.htm#pop-ups


--
torgeir
Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of the 1328 page
Scripting Guide: http://www.microsoft.com/technet/scriptcenter

[Bruce Chambers]

Greetings --

This particular "sales method" is strikingly similar to the
"protection" rackets offered to small businesses by organized
criminals. No, they're not "reputable." Particularly since they're
trying to sell you a type of protection that is already available to
you free of charge.

This a type of spam has become quite common over the past few
months, and unintentionally serves as a valid security "alert." It
demonstrates that you haven't been taking sufficient precautions while
connected to the Internet. Your data probably hasn't been compromised
by these specific advertisements, but if you're open to this exploit,
you may well be open to other threats. Install and use a decent,
properly configured firewall. (Disabling the messenger service, as
some people recommend, only hides the symptom, and does nothing to
secure your machine.) And ignoring or just "putting up with" these
messages and the problem they represent is particularly foolish.

Messenger Service of Windows
http://support.microsoft.com/default.aspx?scid=KB;en-us;168893

Messenger Service Window That Contains an Internet Advertisement
Appears
http://support.microsoft.com/?id=330904

Additionally:

Blocking Ads, Parasites, and Hijackers with a Hosts File
http://www.mvps.org/winhelp2002/hosts.htm


Bruce Chambers

Help us help you:
http://dts-l.org/goodpost.htm
http://www.catb.org/~esr/faqs/smart-questions.html
----
You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH


"Clay" > wrote in message
...
> I keep getting a window that pops up every 5-10 minutes
> entitled "Messenger Service"
> it's some sort of spam about a website www.DESTROYADS.com
> or something... I cannot get it to stop, no matter what I
> do! I need help
>
> the first line of the message that I'm looking at right
> now says "Message from WINDOWS ALERT to WINDOWS USER on
> 5/3/2003 8:41:04 PM"
>
> I have a screenshot of the window if anyone thinks it
> will help.

[Michael Howard [MSFT]]

from the cmd prompt, enter:

net stop alerter

--

Cheers, Michael
Writing Securce Code 2nd Edition
(http://www.microsoft.com/MSPress/books/5957.asp)

This posting is provided "AS IS" with no warranties, and confers no rights.
OR if you wish to include a script sample in your post please add "Use of
included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm"
"Clay" > wrote in message
...
> I keep getting a window that pops up every 5-10 minutes
> entitled "Messenger Service"
> it's some sort of spam about a website www.DESTROYADS.com
> or something... I cannot get it to stop, no matter what I
> do! I need help
>
> the first line of the message that I'm looking at right
> now says "Message from WINDOWS ALERT to WINDOWS USER on
> 5/3/2003 8:41:04 PM"
>
> I have a screenshot of the window if anyone thinks it
> will help.