Messanger Services... SPAM

Unfortunatly I am a victim of Messanger Services SPAM. The kind company who managed to target me is called ByeByeAds. If you wish to find out about their new scam, go to their webpage at ByeByeAds This company simply makes you pay to get rid of their spam!!

Anyway, I'm not here to discuss this indervidual company, I'm trying to find a solution to this form of spam. I've done some quick research and i've found many companines will soon be using the Messanger Services for spam. If you are a victim, you're really going to no about it. It has to be the most annoying form of spam i've come across!

I've found various solutions to this, but none of which i'm willing to use. Solutions like, disabled the messanger services, The messanger services is a handy services I dont want to disable it because of some money hungry company! If I disabled the services anything that wishes to use this services will log a error message in my system event log. Software such as anti virus software uses the messanger services to send you notices and alerts! so, whats the point in having a virus applications if your going to block the alerts! There are various applications that use the messanger services, which makes disabling it a defernate no no.

Other sources say we should configure our firewalls to block netbios and RPC, I'm sure i recall a post floating around saying that we shouldnt block RPC, so again, a un-vaild solution.

One possible soultion I have quoted bellow:

Quote:

---

This particular spam engine starts with a connection to port 135 rather than the NetBIOS ports (137-139 and 445) and then connects to a port above 1024 but future spam engines could use the NetBIOS ports as well.

---

It looks like the other solutions are not acceptable, but what i'm wondering is, is it okay to block port 135?

Some specs that you may need to know
OS: windows xp
Firewall: zone alarm (up to date)

If anyone can help, it will be very appreciated. And If it is simply solved by blocking ports could someone please explain how to do this using Zone alarm, as I have never had to do this before.

Thanks

Have you tried adaware?

another free software is PepiMK Search & Destroy and according to PCWorld, it is better to use both. I have been a user of ad-aware for a while and have always liked it. I haven't tried PepiMK as of yet.

Are you referring to MSN messenger if os which version, as there a few addon packs out there to allow you to block stuff like this.

Or do you mean the internal Messenger service under Windows XP if so then just stop and restart the service, that just fixed the problem on a friends computer and has been fine for a week now !

hope this helps

Thanks for the quick replys.
Yes I have done a full scan using the latest adaware. And i've also cleared all cookies, temporty internet files, temp folders and my history.

Geepod, I am not refering to msn messanger. It is the internal messanger. You say stop it, and then restart it..? intresting, How will stopping the services, and then starting it again solve the problem?

Also i've downloaded all the current security updates for XP pro from the the microsoft windows update facility. But, I do not use SP1.

Quote:

---

It looks like the other solutions are not acceptable, but what i'm wondering is, is it okay to block port 135?

---

Absolutley! I'd also block 137-139 and 445 as they are the NetBIOS ports...
If you are not aware of all the info someone can get about your PC from netbios... time to read up a bit.

Rioter has done a nice tutorial on netbios hacking right here.
Here is his other one for netbios with linux.. though thats not what you need... just intersting to see it from both sides.

Quote:

---

Or do you mean the internal Messenger service under Windows XP if so then just stop and restart the service, that just fixed the problem on a friends computer and has been fine for a week now !

---

I think he was talking about the messenger service too... He should no doubt stop this service, or block it at the firewall if he really needs it. But... if you stop it, I would not restart it... I would disable it. Restarting it will not stop the messages from coming in..

stopping and restarting the service will purge the message cache allegedly.

Alhtough MS would tell you to use SP1 as is always a good idea if you have a problem, also look at your scheduling service to see if any net send messages are scheduled etc, if its NT then if i remember rightly you can view it at cmsd prompt by typing AT.

Thanks for the replys!

As i've said, i'd really like to aviod having to disable the Service messanger as it is required by some applications.

Thanks for listing the ports to block phishphreek80, Could anyone give me a quick step to step guide on hwo to block these ports on zone alarm, I've had a quick look but I cant seem to find anything :mad: i'm more than likley just over looking somthing.

In the mean time i'll restart my Services messanger, I'll keep you posted.

Thanks
:)

I used to get the pop-ups, but I cannot recall how I got rid of them. I thought it was ad-aware. Do you update your version of ad-aware? Even the free version of 6.0 has an update feature.

(may be a stupid question, but I have to check).

as far as i am aware zone alarm does not allow you to specify specific ports for blocking, maybe the pro version does but i dont think so ?

try stopping and restarting the service though !

Yeh geepod, From what I can see you cant block ports.
After reading that tut about netbios I really hope that zone alarm blocks ports 135, 137-139 and 445.... But if this pop up is coming from port 135... then it doesnt block port 135, figers crossed it has 137-139 and 445 covered!!!

I have stopped the Messanger Services and restarted it Geepod. Thanks.

Quote:

---

(may be a stupid question, but I have to check).

---

lol, I only downloaded adaware today, so natrually I never thought about updating it, But thanks, cos there was a update available!! And it did indeed detect somthing new in my registery.

So now i have restarted my Messanger Services, and used a more upto date adaware. All going well the problem might just be solved! I should have done each step bit by bit, so I could pin point which method actually works. But its a bit too late for that now, never mind.
I'll keep you posted if i receive the pop up again.

Thanks people :)

sounds to me like at some point you have either added this web site to the "trusted" zone thus the 137/139 NetBIOS calls are allowed in. Try looking there.

I have very few applications that are trusted. I prefer to always click yes, then I no exactly when applications require the internet. The only programs that are allowed access without my permission are applications that I use all the time. 99% of my applications are all set to ask me before I use them. I dont think that this is my problem tiger shark. But thanks for the suggestion.

The windows XP firewall thingy(whatever it is) will block those for you as well.

-Maestr0

Xeron:

Since you seem to be familiar with the messenger service and it's uses then I would hazard a guess that you use it. That being the case, at some time in the past you probably got a message from Zone Alarm saying that "X" was trying to connect by it. At which point you probably told it "OK" and "Remember"..... Therein lies your problem.... You allowed it 'cos you want to be able to use some of it's features. Unfortunately, you are allowing the spammer to use it too.

This is one reason I don't like personal software firewall's. I may have a small home network and want to enable certain functionality between them but it is very easy to make a simple mistake and allow anyone access to the same service. Go off to CompUSA or wherever and plonk down the $60 or so on a linksys or similar. Then you will block the spammer's attempts to connect at that firewall and can still use all the functionality of the NetBIOS service with your other machines behind it.

Unfortunatly Adaware and resetting the messenger services hasnt managed to block the spam.
I've looked around zone alarm Tiger Shark and I dont think its the fact that the spam is trusted.
I've got 44 programs in the program control pannel and I only allow 9 of them programs to access the internet without asking for my permision. I no exactly what the 9 programs are for, and none of them are new. As I said I dont often check the box which states dont ask me again.
And To be honest Tiger Shark i'm very un-familiar with the Messanger Services. I've only come accross it today. I dont use the services, but I still think stopping the services is in appropiate. If a program I use did require it, and i've disabled it, i could find my self in a bad situation. I cant justify blocking a services because of a scamming company.

Thanks again for all the help... anyone got any other sugestions??

Just disable the Windows Messenger, if a program really needs it, you can still restart the service. (I don't know such a program though.)

Stoopiong the messenger service will have no dire effects at all. unless of course you use it specifically for net send etc or whatever. If at a later date just restart it it will at lesat solve the problem short term until you can find a more permanent fix.

Trust me that stopping the service will cause no harm.

Trillian is better anyway : )

My 2 cents. Use a better software firewall that allows you create custom rules. Not to mention ZA sucks anyway. Buy Outpost or Sygate and you can customize all you want. Otherwise I believe the free version of Outpost will do, too.

Good luck.

Ok,
After doing a little bit of research and talking to various people, like many of you have said, just turn of the services. From what I can see there is no reason not to turn off the serivce now I have looked into the matter further.
As I said:

Quote:

---

i'm very un-familiar with the Messanger Services. I've only come accross it today.

---

I was just being a bit cautious, as I was un sure about the service. Last night I turned off the service, and as expected the problem is solved. I'm sure that any application or software that would use this service would be somthing pritty crappy.

I'd like to thank everyone for their help :D

But now I think I should quickly explain how you can turn off the messanger service with XP just incase other people have this problem and they are unsure on the area.

Firstly you need to go into your adminstrative tools. This can be found in the control pannel. To open your control pannel click on [start] > [settings] > [control pannel] Or, if you dont have this layout you can go to [start] > [run] > and type the word "control" (without the speech marks)

Now click on the administrative tools Icon, you then want to click on the Services Icon. When the services window has loaded, scroll down the list untill you see a service called messanger. Double click on the service. Under the general tab set the "Start up type" to manual using the drop down list, and set the "Service Status" to "stopped" by clicking the "stop" button.

Finally click on Apply. All messages from this services will now be blocked. You can test this by opening the command promt and typing "net send 127.0.0.1 hello" if it fails you've successfully disabled the service. You may also want to turn the service back on so that you can play with the service to learn new things. "net help" may also be usefull to you in the command promt.

I hope that helps if you occur the problem.

Thanks again people.

just a side comment, it deals more with the byebyeads.com page more than anything..

they said that it allows hackers to infect your computer with a virus that is untraceable by current anti-virus software....

Aren't <just about> ALL new virii undectable by "current" AV software until you update your defs?

some people suck. and this company is one of them. it's like the whole Spamming people to tell them how to get rid of spam.
bah

you can turn off the messanger service. go to control pannels --> admin tools --> services and it will show a list select messenger and deactivate it, and set it so it wont start up automaticly.