Why do all these messages keep popping up on my firend's computer?

[IgoByte]

Moved this from General Hardware:

So, I got my firend a Dell D4600 w/ 18" LCD and he's using AOL (something I've been advising against for long...). When he dials up, he keeps getting these little Windows-like pop-up messages about doing away with pop-ups and spam, etc. Last time I was there, I got rid of Windows Messenger (using an uninstall tool), and he's got a ZoneAlarm firewall, Norton AV 2003, and a SpyBot on his computer. Both the firewall and the AV are constantly running in the background and with Windows Messenger gone, these $hitty things shouldn't be popping up... Or should they? It seems to me like this is the result of him using AOL; not sure though. Does he need a pop-up blocker tool as well?
I've been telling him that he should switch to a different ISP, and he might, but I'd really just love to find out WTF is causing this and to correct it if possible...

Thanks in advance...

 

[SaigonK]

Ok so what type of popups are they? It is a messenger screen? Or is it a web browser screen?
Try this out first:

[url]http://www.anandtech.com/guides/viewfaq.html?i=153[/url]

 

[IgoByte]

They look like Windows error/notification messages, not like regular IE pop-ups. They are advertisements, though...

 

[Lalakai]

check the settings on Norton; he may be allowing pop-ups, or doesn't have it activated. Spybots will only remove spy programs on your system and won't really filter incoming stuff. Norton should catch most of them, but since he's using AOL, there are variables that Norton may not be able to counter.

 

[noxxic]

Try running "net send 127.0.0.1 hello" - if that's the kind of popup message, go to Administrative Tools, Services and disable "Messager" (and make sure it's not set to load again on startup). But I think the firewall should really be blocking it though... I'm not sure what port it uses.

 

[bjc112]

Turn off messanger under services.

 

[glugglug]

If you are getting popups through messenger service your firewall is configured to let anyone do whatever they want with your machine.

 

[IgoByte]

Originally posted by: glugglug
If you are getting popups through messenger service your firewall is configured to let anyone do whatever they want with your machine.

Now, that's a truly useful piece of advice.

 

[SaigonK]

Originally posted by: glugglug
If you are getting popups through messenger service your firewall is configured to let anyone do whatever they want with your machine.

That is so NOT true. Why is it that everyone assumes if your PC isnt behind a firewall it isnt safe?

Patch your system, it does wonders for your security.

 

[IgoByte]

Originally posted by: SaigonK

Originally posted by: glugglug
If you are getting popups through messenger service your firewall is configured to let anyone do whatever they want with your machine.

That is so NOT true. Why is it that everyone assumes if your PC isnt behind a firewall it isnt safe?

Patch your system, it does wonders for your security.

More important than a firewall is a router, at least is you have an always-on connection, and that your system is patched.

Anyway, my friend's system is completely up to date for Windows and Office. It's running an up-to-date Norton AV 2003 Pro and an up-to-date firewall that's configured the same way as mine. I think that removing Messenger alone didn't do the trick, but disabling it in Services might...

Let's see what happens and thanks for the help...

 

[glugglug]

Originally posted by: SaigonK

Originally posted by: glugglug
If you are getting popups through messenger service your firewall is configured to let anyone do whatever they want with your machine.

That is so NOT true. Why is it that everyone assumes if your PC isnt behind a firewall it isnt safe?

Patch your system, it does wonders for your security.

Because it's true. Getting those stupid popups means you don't have port 139 blocked. And if you think the 3 patches dealing with that port in the past month fixed that gaping hole I have a bridge to sell you. Yes, that's right, 3, although only the 1st and 3rd were highly publicized.

Security Bulletin for 1st recent hole patched dealing with RPC/Netbios

Security Bulletin for 2nd recently patched hole on this same port/service

Security Bulletin for 3rd recently patched hole on this same port/service

If you believe that the 3rd rushed out emergency patch fixes things and you actually aren't behind a firewall how about you give out your IP publicly and see what happens.

 

[skyking]

I think that removing Messenger alone didn't do the trick, but disabling it in Services might...

MSN messenger is not the problem. Many people confuse the two. It is messenger service, labeled "messenger" in services.
The only application I can think of for it is for sysadmins to broadcast system shutdowns, messages of that nature. Why Microsoft chose to ship Windows with the default setting for it as "enabled" is a mystery to me. It was a big fat juicy exploit waiting to happen.

 

[jonmullen]

Originally posted by: IgoByte

Originally posted by: SaigonK

Originally posted by: glugglug
If you are getting popups through messenger service your firewall is configured to let anyone do whatever they want with your machine.

That is so NOT true. Why is it that everyone assumes if your PC isnt behind a firewall it isnt safe?

Patch your system, it does wonders for your security.

More important than a firewall is a router, at least is you have an always-on connection, and that your system is patched.

Anyway, my friend's system is completely up to date for Windows and Office. It's running an up-to-date Norton AV 2003 Pro and an up-to-date firewall that's configured the same way as mine. I think that removing Messenger alone didn't do the trick, but disabling it in Services might...

Let's see what happens and thanks for the help...

Well unless the router is doing NAT (which is arguably not really a firewall at all) a router is not going to do anything for your security. It just happens to be a common by product of the way most SOHO routers work that you also get a NAT firewall.

 

[IgoByte]

Originally posted by: jonmullen

Originally posted by: IgoByte

Originally posted by: SaigonK

Originally posted by: glugglug
If you are getting popups through messenger service your firewall is configured to let anyone do whatever they want with your machine.

That is so NOT true. Why is it that everyone assumes if your PC isnt behind a firewall it isnt safe?

Patch your system, it does wonders for your security.

More important than a firewall is a router, at least is you have an always-on connection, and that your system is patched.

Anyway, my friend's system is completely up to date for Windows and Office. It's running an up-to-date Norton AV 2003 Pro and an up-to-date firewall that's configured the same way as mine. I think that removing Messenger alone didn't do the trick, but disabling it in Services might...

Let's see what happens and thanks for the help...

Well unless the router is doing NAT (which is arguably not really a firewall at all) a router is not going to do anything for your security. It just happens to be a common by product of the way most SOHO routers work that you also get a NAT firewall.

Most routers that I've seen do NAT. They also block the WAN IP so that it cannot be pinged. Also, they keep a log of outgoing requests and only let certain things back through...

 

[glugglug]

Originally posted by: IgoByte

Originally posted by: jonmullen

Originally posted by: IgoByte

Originally posted by: SaigonK

Originally posted by: glugglug
If you are getting popups through messenger service your firewall is configured to let anyone do whatever they want with your machine.

That is so NOT true. Why is it that everyone assumes if your PC isnt behind a firewall it isnt safe?

Patch your system, it does wonders for your security.

More important than a firewall is a router, at least is you have an always-on connection, and that your system is patched.

Anyway, my friend's system is completely up to date for Windows and Office. It's running an up-to-date Norton AV 2003 Pro and an up-to-date firewall that's configured the same way as mine. I think that removing Messenger alone didn't do the trick, but disabling it in Services might...

Let's see what happens and thanks for the help...

Well unless the router is doing NAT (which is arguably not really a firewall at all) a router is not going to do anything for your security. It just happens to be a common by product of the way most SOHO routers work that you also get a NAT firewall.

Most routers that I've seen do NAT. They also block the WAN IP so that it cannot be pinged. Also, they keep a log of outgoing requests and only let certain things back through...

I've never seen a home consumer-grade router do logging. They DO generally do NAT though.

 

[earthman]

The messenger in services is not the same as MSN Messenger. Windows messenger is the messaging service that runs in the OS that gives you warning messages for some functions among other things. Disabling it may or may not cause problems. The MSN Messenger shows up a msmsgs or something like that. Alot of annoy-ware uses the messenger service to give you popups. These are not the same as a browser popup, and may not be affected by programs that block browser popups.

 

[labgeek]

Originally posted by: glugglug

Originally posted by: SaigonK

Originally posted by: glugglug
If you are getting popups through messenger service your firewall is configured to let anyone do whatever they want with your machine.

That is so NOT true. Why is it that everyone assumes if your PC isnt behind a firewall it isnt safe?

Patch your system, it does wonders for your security.

Because it's true. Getting those stupid popups means you don't have port 139 blocked. And if you think the 3 patches dealing with that port in the past month fixed that gaping hole I have a bridge to sell you. Yes, that's right, 3, although only the 1st and 3rd were highly publicized.

Security Bulletin for 1st recent hole patched dealing with RPC/Netbios

Security Bulletin for 2nd recently patched hole on this same port/service

Security Bulletin for 3rd recently patched hole on this same port/service

If you believe that the 3rd rushed out emergency patch fixes things and you actually aren't behind a firewall how about you give out your IP publicly and see what happens.

Messenger is on port 135 not 139. Well actually, it connects for a epmap on 135. Then with the response of the port (above 1024) that messenger is listening to, it does a 2nd connect to that port to send the actual message.


Ports to block Windows Networking are 135, 137-139, and 445.