http://support.microsoft.com/default.aspx?scid=kb;en-us;Q330904
Messenger Service Window That Contains an Internet Advertisement Appears
The information in this article applies to:
Microsoft Windows XP Professional
Microsoft Windows XP Home Edition
Microsoft Windows XP Tablet PC Edition
Microsoft Windows XP Media Center Edition
Microsoft Windows XP 64-Bit Edition
Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Server
Microsoft Windows 2000 Professional
Microsoft MSN Messenger 4.5
Microsoft MSN Messenger 4.6
Microsoft MSN Messenger 5.0
Microsoft Windows Messenger 4.0
Microsoft Windows Messenger 4.5
Microsoft Windows Messenger 4.6
Microsoft Windows Messenger 4.7
This article was previously published under Q330904
SYMPTOMS
A Messenger service window that contains an Internet advertisement appears. The text in the advertisement is similar to the following text:
Messenger Service
Message from source to your_computer_name.ISP_name on date time
Message Text
These messages are also called "messenger spam."
CAUSE
This issue occurs if you are sent anet send message by someone who is using the Messenger service in Windows. The Messenger service is a Windows service that transmits net send messages and messages that are sent through the Alerter service between client computers and servers. For example, the Messenger service can be used by network administrators to send administrative alerts to network users. The Messenger service can also be used by Windows and other software programs. For example, Windows may use it to inform you when a print job is completed or when you lose power to your computer and switch to a uninterruptible power supply (UPS). Your antivirus program may use the Messenger service to send you notifications. The Messenger service is not related to your Web browser, e-mail program, Windows Messenger, or MSN Messenger. This issue may occur if the following conditions exist:
The Messenger service is started.
The Remote Procedure Call service is started.
Inbound NetBIOS (NetBIOS over TCP/IP) and UDP broadcast traffic is turned on for your Internet connection.
RESOLUTION
To resolve this issue, install or turn on a firewall that blocks inbound NetBIOS and UDP broadcast traffic. The method that you use to resolve this issue depends on your operating system and how you connect to the Internet. The following sections provide examples of several different configurations and possible methods of resolution.
You Connect to the Internet Directly
If you use a single computer that is connected to the Internet directly (by using a cable modem, a DSL modem, or a dial-up modem, for example), install a firewall and block inbound NetBIOS and UDPbroadcast traffic on your computer.
You Are Running Windows XP
If you are running Windows XP and connect to the Internet directly (by using a cable modem, a DSL modem, or a dial-up modem, for example), install Windows XP Service Pack 1 (SP1) and turn on Internet Connection Firewall (ICF). By default, the installation of Windows XP SP1 allows Internet Connection Firewall (ICF) to block all incoming traffic (unicast, multicast, and broadcast). For additional information about this change in ICF blocking behavior in Windows XP SP1, click the following article number to view the article in the Microsoft Knowledge Base:
329928 ICF Now Blocks Unsolicited Inbound Unicast, Multicast, and Broadcast Traffic
For additional information about how to obtain Windows XP SP1, click the following article number to view the article in the Microsoft Knowledge Base:
322389 How to Obtain the Latest Windows XP Service Pack
For additional information about how to turn on ICF, click the following article number to view the article in the Microsoft Knowledge Base:
283673 HOW TO: Enable or Disable Internet Connection Firewall in Windows XP
You Are Running Windows 2000
If you are running Windows 2000 and connect to the Internet directly (by using a cable modem, a DSL modem, or a dial-up modem, for example), obtain and install a third-party firewall product that blocks inbound NetBIOS and UDP broadcast traffic. For additional information about firewalls, visit the following Microsoft Web site:
http://www.microsoft.com/security/articles/firewall.asp
You Connect to the Internet Through a Small Network That You Manage
If your network uses connection sharing to provide Internet access to multiple computers, install or enable the firewall only on the shared Internet connection.
You Are Running Windows XP with ICS
If you use Internet Connection Sharing (ICS) in Windows XP to provide Internet access to multiple computers, install Windows XP SP1 on the ICS host computer and turn on ICF only on the ICS host computer.
You Are Running Windows with a Hardware Internet Connection Sharing Device
If you use a router or other hardware device to provide Internet access to multiple computers, configure the connection sharing device to block inbound NetBIOS and UDP broadcast traffic. Contact the manufacturer of your third-party connection sharing device for more information.
You Connect to the Internet Though a Network That You Do Not Manage
If you connect to the Internet by using a corporate network or if your Internet service provider (ISP) uses a firewall, ask the network administrator to configure the firewall to block inbound NetBIOS and UDP traffic. Contact your network administrator or ISP for more information.
WORKAROUND
To work around this issue, turn off the Messenger service. To do so, follow these steps:
Click Start, and then click Control Panel (or point to Settings, and then click Control Panel).
Double-click Administrative Tools.
Double-click Services.
Double-click Messenger.
In the Startup type list, click Disabled.
Click Stop, and then click OK.
Note If the Messenger service is stopped, messages from the Alerter service (notifications from your antivirus software, for example) are not transmitted. If the Messenger service is turned off, any services that explicitly depend on the Messenger service do not start, and an error message is logged in the System event log. For this reason, Microsoft recommends that you install a firewall and configure it to block NetBIOS and RPC traffic instead of turning off the Messenger service.
MORE INFORMATION
The Messenger service uses UDP ports 135, 137, and 138; TCP ports 135, 139, and 445; and an ephemeral (that is, short-lived) port number greater than 1024.
In addition to preventing net send messages, a firewall can also protect your computer from other malicious attacks over the Internet. These attacks can be designed to perform the following tasks:
Access your private information
Distribute software illegally by appropriating space on your hard disk
For additional information about this issue, visit the following Microsoft Web site:
http://www.microsoft.com/WindowsXP/pro/using/howto/communicate/version45/stopspam.asp
Last Reviewed: 3/17/2003
Keywords: kbprb KB330904
--------------
Getting Rid of Windows Messenger – Permanently
Reader JS writes: “Is it possible to get rid of Windows Messenger?
I am asking because this program is driving me crazy. I do not use Messenger and consequently I am not interested in this program connecting to the Internet. I have blocked access for Messenger in both ZoneAlarm and Norton Firewall. I now have lots of Advanced Alarms from ZoneAlarm that Messenger is trying to access the Internet using other programs as "parents". It is normally Generic Host Process for Win32 Services, but I have seen it also try to use one of the Update programs in Norton Firewall as parent! "
You may ask why I want to get rid of Messenger if I can just block it in ZoneAlarm and Norton? Well, Messenger tries to connect up to 400 times every time I open Outlook Express and/or Internet Explorer. It slows down my machine and connections and I am afraid it might find a way to connect despite being blocked. While writing this email to you off-line Messenger has tried to connect 163 times using Generic Host Process!”
The situation is bad, and it’s going to get worse. Wait till you see what Outlook 2003 tries to do with Messenger.
Normally I advise people to keep Messenger, just because it can be helpful at times. My books go into detail about setting up a Passport account, tying it to Messenger and a free Hotmail account, and keeping the whole kit ‘n kaboodle reasonably private, mostly by feeding the Microsoft Maw bogus names, addresses and the like.
If you want to get rid of Messenger entirely, though, I certainly sympathize. The easiest, fastest way I’ve found is to run a little program from Windows ace Doug Knox - here .
Download it, run it, and Messenger will never darken your door – or clog ZoneAlarm – again.
Disable/Remove Windows Messenger
Copyright 2002 - Doug Knox
This utility will allow you to disable Windows Messenger on per-user basis, or on a machine wide basis. Download the ZIP file and extract MessengerDisable.exe to your hard drive. You can either double click the EXE file, or create a shortcut to it, as you prefer. You can, optionally, use this utility to remove Windows Messenger from your machine. You may need Administrator level privileges to run this program.
To reinstall Windows Messenger for Windows XP, visit http://messenger.msn.com and download the latest version.
Download MessengerDisable here.
This page last updated 05/03/2003 19:41
All material © Doug Knox
http://www.dougknox.com/xp/utils/MessengerDisable.zip
