Messanger Services... SPAM

[Xeron]

Unfortunatly I am a victim of Messanger Services SPAM. The kind company who managed to target me is called ByeByeAds. If you wish to find out about their new scam, go to their webpage at ByeByeAds This company simply makes you pay to get rid of their spam!!

Anyway, I'm not here to discuss this indervidual company, I'm trying to find a solution to this form of spam. I've done some quick research and i've found many companines will soon be using the Messanger Services for spam. If you are a victim, you're really going to no about it. It has to be the most annoying form of spam i've come across!

I've found various solutions to this, but none of which i'm willing to use. Solutions like, disabled the messanger services, The messanger services is a handy services I dont want to disable it because of some money hungry company! If I disabled the services anything that wishes to use this services will log a error message in my system event log. Software such as anti virus software uses the messanger services to send you notices and alerts! so, whats the point in having a virus applications if your going to block the alerts! There are various applications that use the messanger services, which makes disabling it a defernate no no.

Other sources say we should configure our firewalls to block netbios and RPC, I'm sure i recall a post floating around saying that we shouldnt block RPC, so again, a un-vaild solution.

One possible soultion I have quoted bellow:

This particular spam engine starts with a connection to port 135 rather than the NetBIOS ports (137-139 and 445) and then connects to a port above 1024 but future spam engines could use the NetBIOS ports as well.

It looks like the other solutions are not acceptable, but what i'm wondering is, is it okay to block port 135?

Some specs that you may need to know
OS: windows xp
Firewall: zone alarm (up to date)

If anyone can help, it will be very appreciated. And If it is simply solved by blocking ports could someone please explain how to do this using Zone alarm, as I have never had to do this before.

Thanks

[Info Tech Geek]

Have you tried adaware?

another free software is PepiMK Search & Destroy and according to PCWorld, it is better to use both. I have been a user of ad-aware for a while and have always liked it. I haven't tried PepiMK as of yet.

[geepod]

Are you referring to MSN messenger if os which version, as there a few addon packs out there to allow you to block stuff like this.

Or do you mean the internal Messenger service under Windows XP if so then just stop and restart the service, that just fixed the problem on a friends computer and has been fine for a week now !

hope this helps

[Xeron]

Thanks for the quick replys.
Yes I have done a full scan using the latest adaware. And i've also cleared all cookies, temporty internet files, temp folders and my history.

Geepod, I am not refering to msn messanger. It is the internal messanger. You say stop it, and then restart it..? intresting, How will stopping the services, and then starting it again solve the problem?

Also i've downloaded all the current security updates for XP pro from the the microsoft windows update facility. But, I do not use SP1.

[phishphreek]

It looks like the other solutions are not acceptable, but what i'm wondering is, is it okay to block port 135?

Absolutley! I'd also block 137-139 and 445 as they are the NetBIOS ports...
If you are not aware of all the info someone can get about your PC from netbios... time to read up a bit.

Rioter has done a nice tutorial on netbios hacking right here.
Here is his other one for netbios with linux.. though thats not what you need... just intersting to see it from both sides.

Or do you mean the internal Messenger service under Windows XP if so then just stop and restart the service, that just fixed the problem on a friends computer and has been fine for a week now !

I think he was talking about the messenger service too... He should no doubt stop this service, or block it at the firewall if he really needs it. But... if you stop it, I would not restart it... I would disable it. Restarting it will not stop the messages from coming in..

[geepod]

stopping and restarting the service will purge the message cache allegedly.

Alhtough MS would tell you to use SP1 as is always a good idea if you have a problem, also look at your scheduling service to see if any net send messages are scheduled etc, if its NT then if i remember rightly you can view it at cmsd prompt by typing AT.

[Xeron]

Thanks for the replys!

As i've said, i'd really like to aviod having to disable the Service messanger as it is required by some applications.

Thanks for listing the ports to block phishphreek80, Could anyone give me a quick step to step guide on hwo to block these ports on zone alarm, I've had a quick look but I cant seem to find anything i'm more than likley just over looking somthing.

In the mean time i'll restart my Services messanger, I'll keep you posted.

Thanks

[Info Tech Geek]

I used to get the pop-ups, but I cannot recall how I got rid of them. I thought it was ad-aware. Do you update your version of ad-aware? Even the free version of 6.0 has an update feature.

(may be a stupid question, but I have to check).

[geepod]

as far as i am aware zone alarm does not allow you to specify specific ports for blocking, maybe the pro version does but i dont think so ?

try stopping and restarting the service though !

[Xeron]

Yeh geepod, From what I can see you cant block ports.
After reading that tut about netbios I really hope that zone alarm blocks ports 135, 137-139 and 445.... But if this pop up is coming from port 135... then it doesnt block port 135, figers crossed it has 137-139 and 445 covered!!!

I have stopped the Messanger Services and restarted it Geepod. Thanks.

(may be a stupid question, but I have to check).

lol, I only downloaded adaware today, so natrually I never thought about updating it, But thanks, cos there was a update available!! And it did indeed detect somthing new in my registery.

So now i have restarted my Messanger Services, and used a more upto date adaware. All going well the problem might just be solved! I should have done each step bit by bit, so I could pin point which method actually works. But its a bit too late for that now, never mind.
I'll keep you posted if i receive the pop up again.

Thanks people