Spammed Through Messenger Service

[owensdj]

A strange thing has been happening on my computer today. Sometimes a window will popup with an ad message on it. It's coming from Win2K Messenger service! I've never seen that happen before. How could anybody send my computer a message through the Messenger service?

 

[mboy]

NET SEND!, Do you have broadband? Better get you a firewall or router

 

[IcemanJer]

alternatively you can go into the Services control console and stop and disable the Messenger service.

 

[hpfanatic]

You can read up on this here at The Screen Savers form last week: Messenger Spam

 

[owensdj]

New pop-up spam mail creeps onto desktop

:|

 

[Homer]

DirectAdvertiser. Block ports 135, 137, 139 UDP on your firewall. Alternative to disabling the Messenger Service in W2K, (?XP). Says so on their site. Other measures described for W98.

 

[Treeburst155]

Even with "messenger" disabled in Services, it still starts with Outlook Express. Is there no way to completely rid myself of this crap?! Do I need to do away with Outlook Express?

I thought XP came with a built in firewall. Do I need to throw in Zone Alarm again?

 

[Treeburst155]

OK, I wasn't reading carefully. "messenger" in Services is NOT Windows Messenger. Maybe the SPAM will stop even though Windows Messenger still activates with Outlook. Time will tell. Is there any way to completely disable Windows Messenger?

Thanks!

 

[owensdj]

Treeburst, yes you can completely disable the Messenger service. Go to Services under Control Panel->Administrative Tools. Click on the Stop button and then change the Startup type to Disabled.

 

[Gooberlx2]

Treeburst,
I assume you're talking Windows (MSN?) Messenger.

Goto c:\windows(or WINNT)\inf and find sysoc.inf edit this line:

msmsgs=msgrocm.dll,0cEntry,msmsgs.inf,hide,7

to look exactly like:

msmsgs=msgrocm.dll,0cEntry,msmsgs.inf,,7 (notice hide is gone but the commas are still there)

Now goto Add/remove programs --> add/remove components: uncheck windows messenger and finish.

 

[glugglug]

If people can send you windows messenger messages through the internet that means you are allowing netbios connections thru the net.

Which with Windows means there is almost 100% chance your machine is hacked.

 

[owensdj]

glugglug, nope that's not true. I have NetBIOS over TCP/IP disabled on my computer, but I still got those spam messages over the Messenger service.

 

[Treeburst155]

Thanks guys! I think Gooberlx2 has the answer I was looking for. BTW, I diabled the "messenger" service in Services, and now it's gone from the list completely. I haven't figured out how I did that yet.

EDIT: Woohoo!! Windows Messenger is gone forever. I just did what Gooberlx2 said above. Hehe....I feel better now. I love disabling things MS doesn't want me to disable.

Treeburst155 out.

 

[EeyoreX]

I do not think this is a function of Windows/MSN Messenger, it is the network messaging service included with Windows to allow for network admins, networked printers, UPSes, etc to communicate with computers over a network. Some companies and blackhatters have found a way to send ads/links to virus ladden webpages, etc over the internet to dupe unsuspecting people. You don't need to have anything but a connection to the internet, and they can get you once they find your IP address.

I would put Zone Alarm or BlackICE or Norton and disable that crappy XP firewall. That, or use a router and/or hardware firewall solution.

\Dan

 

[Treeburst155]

EeyoreX,

I think you are right, but I wanted to be rid of both the spam coming through the "messenger service" AND Windows Messenger.

 

[EeyoreX]

Ah ha, getting rid of MSN Messenger is a great thing! I think if you have SP3 on a Win2k machine you can remove MSN/Windows Messenger via Add/Remove Programs, similar to Windows XP. I am not toatally sure of that, though.

\Dan

 

[Dreadogg]

easyest way I have found to rid of that program is to run this >> start/run/ (type) "RunDll32 advpack.dll,LaunchINFSection %windir%\INF\msmsgs.inf,BLC.Remove" without quotes, this will rid system of msn mesenge1 Been posted here several times is accuallly a very old covered topic!