While running windows 2000 i got a Messenger Service popup-spam. Screenshot

I read an article posted by JackG about this a few months ago Spam Takes New Form.

I followed the instructions in that article to disable Messenger Service from starting with windows.

Im posting to make sure that im on the right track. Am i done with Messenger Spam now? Or is this something trying to mimic it?

Also.. I think i know how i got this, or how they got my IP. From a spammers remove me page. I was searching for the IP some spam came from. Does this happen? Sites i visit log me then spam me thru Messenger Service? Or is it completely random? The reason i ask is that ive been running windows 2000 & XP for some time and ive never had this happen before.

I remember reading something about hiding your information from websites. Blocking what OS and browser you use. I dont remember any mention of being able to block my IP. Im guessing but i think it was done thru host files?

Does anyone know what im talking about? If so just let me know what its called so i can search for information.

Thanks.

More information..

I ran adaware & spybot and did a virus scan with norton 2002 & Housecalls Online scanner.. all ok. Im not running a firewall.

> What are you expecting on that removal page? A miracle!!

Never reply for a "pseudo" removal... it only confirm your email validity resulting in much more spams...

Here's how it is:

Your are probably running windows 2000. It comes with a program "Netsend" which allows people to send each other messages using ip addresses etc..

I used to get those all the time. Netsend runs 24/7 and I don't know exactly how to turn it off, IF I can turn it off. However I found a way to stop those messages: Get a Firewall! I'm using BlackIce and everything is fine..

If you want to know exactly how you received that message read below.
There are these people who run a script on their computer. The script sends the message you received to random ip adresses. This is very similar to telemarketing, where they have those machines that call random phone numbers and play a message.
First of all don't listen to what the message says, because there is no "removal". They would probably ask you for more information about youself (email address etc..)
The good thing is you have nothing on your computer like viruses or adware that caused this.

Hey guess what? I found out how to turn it off.

http://www.lemonbrain.com/tut/net-send/page1.html

Read this post at spywareinfo.com's forums:

http://www.spywareinfo.com/yabbse/index.php?board=3;action=display;threadid=1920

It has instructions on getting rid of it for all windows os.

Response #2
"> What are you expecting on that removal page? A miracle!!
Never reply for a "pseudo" removal... it only confirm your email validity resulting in much more spams... "

I was searching for the domain that the spam came from so i could include it to the list of offenders at my spamlist. I did not expect to be removed from the list. I know that its a trick to harvest valid addresses or a waste of time to make spam victims think they have been removed. See my spam info page for more information.

Response #3
Yes, in my first sentence i stated i am running windows 2000. It is possible to stop spam messages being sent thru the net send exploit by disabling the Windows Messenger Service. The link in my second paragraph explians how to do it. The firewall isnt neccesary to stop this type of spam but effective none the less.

Response #3
The instructions in that link are similar to the ones in the techtv article i linked to in the second paragraph of my initial post. The important difference is that your link provides screenshots for windows 2000 and the techtv article uses XP as the example. Thanks for the link. It took me a while to adapt the XP instructions to 2000 because the dialogue boxes arent the same.

Im sorry for the confusion. Let me try and explain again. I know what has happened, i located the fix, implemented it and i have windows messenger service disabled.

I know all about spam. Well.. everything but how to really stop it or where the spammers live. but im working on it. I only mentioned it because i experienced some malicous activity at a spammers fake remove me site today. Less than an hour later i got the Messenger Spam. First time ever and ive been running windows 2000 and XP since the release of each. I guessed that the spammer is tracking and spamming visitors. It could be completely random.. Just thought i would throw it out there and see if anyone had more information.

I would like to verify that the spam popup i received was in fact a Messenger Service exploit and not something new. Spyware or a virus masquerading as a Messenger Service popup.

Suzi,
Thats an even better link for killing Messenger Service. It offers isntructions for both 2000 and XP.

Also.. since the last post of Mike's thread was today i can safely assume its not a virus or spyware trying to pull a fast one.

Back to panranoia..

All the info i find says this is completely random. Is it possible to track a visitor [at the spam site for instance] then target him ?

If so.. i would like to know if its possible to conceal my info when surfing. Something easy? That i can do myself?

There's a couple of free proxy's that I found:

http://www.the-cloak.com/anonymous-surfing-home.html

http://www.safeproxy.org/use.html

They limit how much you can use them. If I want to go to a suspicious site, I'll use one of them. There are more if you do a search for them.

Then there's Anonymizer (you can get it through the link on my site:) and other paid ones. Based on what I've read there is no other way you can conceal your IP address.
But I could be wrong ......

And I get hits on my website that instead of showing the ip address, says "this field blocked by agnitum" which is something like anonymizer I guess.

Did the spam site put a cookie in? If so that might be used to track your surfing habits. Hopefully they didn't use active x to sneak something into your computer that could be phoning home since you don't use a firewall.

Thanks Suzi,

I remembered "host" for some reason but it was "proxy" that i was looking for :).

I dont know about a cookie, i immediately flushed and ran scans.

At this point.. I assume its random or that i was a target. The reason i asked for proxy info is because i visit many spam sites on a daily basis trying to locate information. Every day i find something new/worse [new to me].

I collect contact info of spammers and i use it at the remove me links to sign them up for spam [payback]. Usually i just get a "received" message but this time i got hit with tons of full page pop-ups. Closing one opened more etc. Finally the last page had a bunch of banner ads.. As if i would click thru after the popup attack. This is the first time a remove me link attacked me and it got me worried about future spam exploration.

hello smoud
i dont know if this is any help. but i got that mesanger spam once.and since ive put that list in hosts its not come uo agian.
could just be luck.

You can do more than just block these messages. Did you know you can actually track them too?

http://backtalk.rm-f.net

Hey Third of Five or anyone who can answer my question. The backtalk site don't seem to support it anymore, is there any other known way to track these spam?