OT: help reqd ending popups since updating msn messenger

Chris (23) · Jul 27, 2003

Hello,

I know this is very OT, but since the ppl in this newsgroup seem to be very knowledgable I was hoping you could help.

I recently updated my XP home Ed using WinUpdate, ever since then Ive had popups (saying they are from windows messenger) saying that to stop these popups I should visit endads.com.

I cannot seem to find the source of these popups on my pc. I installed SPYBOT, updated it and immunized my pc but I still get them. This is the ONLY thing that now p*sses me off on my pc now as they popup while I play games online, normally resulting in me getting splatted.

Has anyone else had this, or figured a way to stop it. I'm not sure if it is part of Messenger, I'd be peeved if it is!!!

Thanks for looking at this OT subject, and any help you throw on it.

regards

Chris

Abit KD7, XP2400 @ 2133, 2x256OCZ PC3200cas2, 3dB Gf4Ti4400, slk8+80mm delta screamer, win xp home ed (no sp1)

TomG · Jul 27, 2003

try disabling messenger via any number of different ways. see www.tweakxp.com/tweakxp for some ideas on how to disable messenger.

Jef Norton · Jul 27, 2003

Hi Chris -

The pop-ups aren't a result of Windows Messenger, rather they are resulting from spammers exploiting the Windows Messenger Service.

The symptom is not that the Messenger Service is running, but, rather, that you have open ports that these spammers are exploiting by sending you messages via the Messenger Service.

The best and easiest way to resolve this is to enable the Windows XP Firewall (on your Network Connection) or to install a 3rd party firewall, such as Sygate, ZoneAlarm, Norton Internet Security/Firewall, McAfee, etc. The Windows XP Firewall will work to eliminate in-bound accesses to your system, which will effectively stop the Messenger Service pop-ups. A 3rd party firewall will eliminate both in-bound and out-bound traffic (if you've got Spyware, etc., on your system, a 3rd party firewall will inform you of such and enable you to prevent it from "phoning home").

Jef

"Chris" wrote:

| Hello,
|
| I know this is very OT, but since the ppl in this newsgroup seem to be | very knowledgable I was hoping you could help. | | I recently updated my XP home Ed using WinUpdate, ever since then Ive | had popups (saying they are from windows messenger) saying that to stop | these popups I should visit endads.com. | | I cannot seem to find the source of these popups on my pc. I installed | SPYBOT, updated it and immunized my pc but I still get them. This is the | ONLY thing that now p*sses me off on my pc now as they popup while I play | games online, normally resulting in me getting splatted. | | Has anyone else had this, or figured a way to stop it. I'm not sure if | it is part of Messenger, I'd be peeved if it is!!! | | Thanks for looking at this OT subject, and any help you throw on it. | | regards | | Chris | | Abit KD7, XP2400 @ 2133, 2x256OCZ PC3200cas2, 3dB Gf4Ti4400, slk8+80mm delta | screamer, win xp home ed (no sp1) | | | |

Jef Norton · Jul 27, 2003

TomG · Jul 27, 2003

excellent point. I had totally forgotten about that approach, possibly because I never have the issue.

JimL · Jul 27, 2003

Chris,

Has anyone else had this, or figured a way to stop it. I'm not sure if it is part of Messenger, I'd be peeved if it is!!!

Ok, with Windows XP, there are two "Messengers".

The first is Windows Messenger, which allows communication with people who use MSN Messenger/Windows Messenger. It's a chat client.

The second is the Messenger Service, which (in a networked environment) is used to send administrative alerts to other computers. More often than not, though, the Messenger Service ends up getting abused by people sending spam messages to it.

The Messenger Service is disabled in the services portion of the Control Panel.....details as follows......

How to stop Messenger SPAM: Disable Windows Messenger Service http://www.auburn.edu/oit/security/messengerService.html

Btw; there are good newsgroups on WinXP at.......

microsoft.public.windowsxp.general

Jef Norton · Jul 27, 2003

Hi Tom -

I don't have the issue either -- I'm connected to a router to share my Internet connection between my laptop and desktop systems.

BTW... the new motherboard was DOA (BIOS was sheep dip). I'm RMAing hope to have a replacement any day now.

Jef

"TomG" wrote:

| excellent point. I had totally forgotten about that approach, possibly | because I never have the issue. | | -- | | Thomas Geery | Network+ certified | | ftp://geerynet.d2g.com | ftp://68.98.180.8 Abit Mirror <----- Cable modem IP | This IP is dynamic so it *could* change!... | over 115,000 FTP users served! | ^^^^^^^ | | | | | "Jef Norton" wrote:
|
| > Tom -
| >
| > Disabling the Messenger Service will stop the pop-up messages... but it | > won't solve the underlying problem: Open Ports. A Firewall is what's | > needed. See my response to the OP. | > | > Jef | > | > | > "TomG" wrote:
| >
| > | try disabling messenger via any number of different ways. see | > | www.tweakxp.com/tweakxp for some ideas on how to disable messenger. | > | | > | -- | > | | > | Thomas Geery | > | Network+ certified | > | | > | ftp://geerynet.d2g.com | > | ftp://68.98.180.8 Abit Mirror <----- Cable modem IP | > | This IP is dynamic so it *could* change!... | > | over 115,000 FTP users served! | > | ^^^^^^^ | > | | > | | > | | > | | > | "Chris" wrote:
| > |
| > | > Hello,
| > | >
| > | > I know this is very OT, but since the ppl in this newsgroup seem | to | > be | > | > very knowledgable I was hoping you could help. | > | > | > | > I recently updated my XP home Ed using WinUpdate, ever since then | > Ive | > | > had popups (saying they are from windows messenger) saying that to | stop | > | > these popups I should visit endads.com. | > | > | > | > I cannot seem to find the source of these popups on my pc. I | > | installed | > | > SPYBOT, updated it and immunized my pc but I still get them. This is | > the | > | > ONLY thing that now p*sses me off on my pc now as they popup while I | > play | > | > games online, normally resulting in me getting splatted. | > | > | > | > Has anyone else had this, or figured a way to stop it. I'm not | sure | > | if | > | > it is part of Messenger, I'd be peeved if it is!!! | > | > | > | > Thanks for looking at this OT subject, and any help you throw on | it. | > | > | > | > regards | > | > | > | > Chris | > | > | > | > Abit KD7, XP2400 @ 2133, 2x256OCZ PC3200cas2, 3dB Gf4Ti4400, slk8+80mm | > | delta | > | > screamer, win xp home ed (no sp1) | > | > | > | > | > | > | > | > | > | | > | | > | > | |

Jef Norton · Jul 27, 2003

Hi Jim -

Read my first response to TomG. Disabling the Messenger Service only puts a band-aid on the problem. A firewall is needed to cure the problem of open ports, which are being exploited by use of the Messenger Service.

See http://support.microsoft.com/?kbid=330904 (from the folks that brought us this problem in the first place).

Jef

"JimL" wrote:

| Chris,
|
| > Has anyone else had this, or figured a way to stop it. I'm not sure if | > it is part of Messenger, I'd be peeved if it is!!! | > | Ok, with Windows XP, there are two "Messengers". | | The first is Windows Messenger, which allows communication with | people who use MSN Messenger/Windows Messenger. It's a chat client. | | The second is the Messenger Service, which (in a networked | environment) is used to send administrative alerts to other | computers. More often than not, though, the Messenger Service ends | up getting abused by people sending spam messages to it. | | The Messenger Service is disabled in the services portion of the | Control Panel.....details as follows...... | | How to stop Messenger SPAM: Disable Windows Messenger Service | http://www.auburn.edu/oit/security/messengerService.html | | Btw; there are good newsgroups on WinXP at....... | | microsoft.public.windowsxp.general | -- | | Jim | Using - Virtual Access(OLR), ZAP 4.0, & WinXP Pro w/SP1 | http://www.virtual-access.org |

0_Qed · Jul 27, 2003

Jef Norton wrote:

Hi Chris -

...snip...

Agreed ...

What about 'steering' the OP to "news.grc.com" ...
lotsa great know_how folks there too ...

Qed.

TomG · Jul 27, 2003

Damn! new mobo was toast? that sucks in a big way. hopefully no issues with respect to getting it swapped out...

TomG · Jul 27, 2003

great site he has too at www.grc.com.

JimL · Jul 27, 2003

Jef,

Read my first response to TomG.

Already did. For me it's a non issue as I'm behind a Linksys (NAT based) Router and run ZAP 4.0 w/Web Filtering. Damn near nothing gets by my setup......'cept SPAM & I filter those out with POPFile.

0_Qed · Jul 27, 2003

TomG wrote:

great site he has too at www.grc.com.

Most assuridly.

'That' and the NGs ...

Not for the faint of heart tho ... "One" needs a sense of humor that would ask the Hubble_I webmiester " wheres the URL for the Hubble II ?? " ...

Cant beat `em ?? , ... join `em.

Qed.

Jef Norton · Jul 27, 2003

Jeff Lindstrom · Jul 28, 2003

"Jef Norton" wrote:

Tom -

Disabling the Messenger Service will stop the pop-up messages... but it won't solve the underlying problem: Open Ports. A Firewall is what's needed. See my response to the OP.

Jef

My parents' computers are both downstream of the same router and only my mother's has the popups problem. This is the primary problem I am supposed to fix when I visit in a couple weeks.

Would closing ports still seem the best approach in this situation?

TEQ · Jul 28, 2003

Have to disagree with you there Tom, Gibson is a snake-oil salesman who hypes up his little 'creations', claims invention on processes that existed way before his time, and is generally laughed at throughout the security community. Read more here http://www.grcsucks.com/

"TomG" wrote:

great site he has too at www.grc.com.

--

Thomas Geery
Network+ certified

ftp://geerynet.d2g.com
ftp://68.98.180.8 Abit Mirror <----- Cable modem IP This IP is dynamic so it *could* change!... over 115,000 FTP users served!
^^^^^^^
...

TEQ · Jul 28, 2003

I think this is the most concerning bit, and yes it does work, and yes he has been informed of it, and no, he hasn't done anything about it whatsoever. http://www.grcsucks.com/shieldsupscan.htm

"TomG" wrote:

great site he has too at www.grc.com.

--

Thomas Geery
Network+ certified

ftp://geerynet.d2g.com
ftp://68.98.180.8 Abit Mirror <----- Cable modem IP This IP is dynamic so it *could* change!... over 115,000 FTP users served!
^^^^^^^
...

Jef Norton · Jul 28, 2003

"Jeff Lindstrom" wrote:

|
| My parents' computers are both downstream of the same router and only my | mother's has the popups problem. This is the primary problem I am supposed | to fix when I visit in a couple weeks. | | Would closing ports still seem the best approach in this situation? | | | -- | Jeff | |

Hi Jeff -

In a word: yes. It's interesting that you say that both your parent's computers are behind the same router. Is the router by chance connected to a cable modem? And, is the cable modem cloning the MAC address of your mother's computer? This is one scenario where you could explain why your mother is getting pop-ups and your father isn't.

I personally can't explain it, but I'm connected downstream from a router in a PPPoE DSL environment and both my computers should be completely invisible to the web. But... I open up the statistics from Zone Alarm on both of my computers and see that both have recorded intrusions and both computers have not connected to the web in any manner other than by way of the router since the install of ZAP 4.0. As I said before, I can't explain it, but I'm better safe than sorry running both hardware and software firewalls.

In any event, go into Network properties in Control Panel and right-click Local Area Connection. Select Properties. In the Properties sheet, click on the Advanced tab and put a checkmark in the Internet Connection Firewall box. Click Apply and OK all the way out. Reboot and you should have the Windows XP in-built firewall enabled.

Jef

0_Qed · Jul 28, 2003

TEQ wrote:

Have to disagree with you there Tom, Gibson is a snake-oil salesman who hypes up his little 'creations', claims invention on processes that existed way before his time, and is generally laughed at throughout the security community. Read more here http://www.grcsucks.com/

Sorry "TEQ" ... I have to disagree with you, in turn ...

My apologies to TomG for getting "piled upon" at my instigation ...

Oh Well ...

...............
Mite I `umbly suggest a little "whois" be used on grcsucks.com ... followed by a little G_Groups on the holder of the URL ...

I doubt that will deter you ... change your mind in any respect ... but , never the less, I thot it worth a 'try'.

..................
Now ...
as to " who invented what, when " ...

That too is yet another interesting story ...

The US "PO" can simply resolve that one for your edification ...

..................
Now ...
as to " ... Snake Oil ... " ...

Anyone who can be as adept at "reading" the 80xxx machine code as Gibson is, has earned, & deserves, my respect ...

=NOT= the written Assember, mind you ...
but the machine code(mc) "inside" an executeable ...

Me? I got so I could do "that" for 360/370 asslr ...
I had to,
compiles took too long and rep_cards hadda be punched such that they worked.

'80xxx' mc ... nah, never really bothered ...

I think I 'did' "Hello", on a PC mono screen, back when ... bfd.

..................
Now ...
as to "Wicked", the 'perp' of GRC's DoS attack ...

Go find/read the =full= story ...
come 'back' and we'll( you & I ) discuss further ...

The 'kid' was/is, most probably, a repressed genius ... BUT ... better described as "wasted" by an entire lack of parental 'nurture' ...

..................
Now ...
as to the " Security Industry " ...

I can "suggest" that many State Pol units use SG's stuff ... also, "some" in NSI ... CIA/FBI too, I 'hear' , but =no= direct knowledge.

Also, ...
some commercial 'peeps' ... mostly former Fed TSCM 'types'

I'd have to form the conclusion that 'SG' has earned a measure of respect in both commercial & government areas.

..................
Now ...
as to "me" ... moi ...

I ...
. own no stock in GRC ... none/nada/zip
. am not employed by 'GRC' in =any= capacity ... none/nada/zip . do not 'see' any GRC perks, et al ... none/nada/zip . closest I got to 'him' was an " audience seat " in a local seminar, back_when.

I ...
. dont dismiss GRC/Gibson out of hand ,
, nor, do I his 'detractors' ...
. I made an effort to 'look&peep' for myself ...
. whereupon ... it became abundantly clear to me(moi) that :
. he (SAG) has a real track record of accomplishment ; . his detractors have aught but thier own adgenda to pursue.

I ...
. respect, =not= admire=, the script_kiddies for thier accomplishments, . piled on the backs of others, more talented ...

. I doubt "Wicked" knows an index_reg from his/her index_finger . from his/her arse_hole, ... . sad, when I think of what s/he mite have "been".

In closing ...
" each to his own " ...
and, fwiw, ...
given the choice twixt a Trabi or a Yugo ... I'd choose "neither".

Be well,
Qed.

JimL · Jul 28, 2003

0_Qed,

I'd have to form the conclusion that 'SG' has earned a measure of respect in both commercial & government areas.

Exactly!

The wanna bee's will always attack those whom have achieved such respect. SG isn't infallible, but he does far more good than the detractors can ever hope to.