Messenger Service Spam -
End It Now!

How Did The Message Get Here?

Every Windows XP (and 2000) machine has a "service" running behind the scenes called the "Messenger" service. This is a normal part of the operating system that is used by network administrators like myself to send messages to other users on a company network. (NB- Since the release of Windows XP SP2 this service not running by default.)

For example if I want to ask a user to shut down their PC I could open a command prompt and type the request using the "net send" command. The following image shows the command being sent to a user on my internal network at the IP address 192.168.254.37

On the users PC they get the message delivered as a standard Windows dialogue box:

As you can see this is a very handy feature for administrating networks! I have been able to accomplish this because the "Messenger" service allows the "net send" function to communicate across networks.

Is This Limited To Net Send Commands?

No... Another function can use the "Messenger" service to communicate across networks and these messages are called "Alerter's". If you have ever received a message from your UPS (Uninterruptible Power Supply) that it has passed a self test, or went onto battery for a moment due to a spike in the power supply - then you have received an "Alerter" message.

So How Is This Used By Spammers?

Firstly it is worth pointing out that this is NOT a problem related in any way to the Windows Messenger or MSN, clients (as many people seem to believe...)

What the spammers are doing is scanning thousands of IP addresses (the unique number your ISP gives to your PC whilst you are on the Internet) and checking to see if any of the PC's are open on UDP ports 135, 137 and 138 - TCP ports 135, 139 and 445.

When the spammers software detects your PC is running the "Messenger" service on these ports you get sent the Messenger Service Spam..

Can I Stop The Messenger Service Spam?

Yes... Here are the Instructions:

Instructions:

Go to the START menu,  Select Run and type in services.msc and click OK.

Now a new window will appear with lots of "services" on the right hand side...

Scroll down and find the Messenger service, select it, right click it and choose properties.

.

Under Startup Type select Manual. (or Disabled)

Then click the Stop button.

Then click the Apply button.

Then click the OK button.

Messenger Service Spam can no longer be received on your machine....

However you will now no longer receive legitimate net send or alerter messages either, but for most folk this is not going to be a problem. If you are using a NAT router to access the Internet then you will be immune to these Messenger Service Spam popups as they can only be received by public IP addresses and NOT the private IP addresses that NAT routers use for internal networks.

Likewise if you are using Windows XP Internet Connection Sharing (ICS) only the "gateway" PC should get the Messenger Service Spam popups as the other PC will be getting private IP addresses from the ICS service... (Just in case you are wondering private IP addresses usually look something like: 192.168.xxx.xxx)

Also installing a personal "Firewall" on your PC will offer you protection too!

Support Is At Hand...

I have written a more detailed step by step article which you can download and follow offline. I appreciate some folks reading this article will want to have more screenshots of what to do in which order.... Simply RIGHT CLICK and then choose Save when the box appears. Then save the PDF file called "Messenger Service" to your hard drive.

(If you do not have Windows Media Player already installed then stay connected to the Internet when you play this file and your current Windows Media Player will connect to Microsoft and download it for you.)

The DVD XPack instantly adds DVD playback to
Windows Media Player 9 & 10. It Installs the
same theatre-quality video and audio decoders
proven by over 45 million users of WinDVD -
the world's leading software DVD player.

Why? - Because:

It's FAST, cheap and Microsoft approved!

www.watch-dvds-in-wmp.com

I have been using this plug-in for several years now
and have never had a problem.