Win2K Messenger Service.

  • Thread starter Thread starter BaKaR
  • Start date Start date
B

BaKaR

Hi!

OS: Win2K Server.

How to clear (kill) MSGs (popups) produced by Windows Messenger Service ?

I tryed to kill service, clear alert counters but no luck.

Any ideas ?
 
Yes, but i need Messenger Service to run. This is the Production server so it needs notifying.

Still, i dont know what to do if i get like 10000001 msgs. I stop the messenger service, alerter, etc. but still, those msgs are
comming, from where ? another server ? What if server is notifying itself ? Where are those msgs stored ? How to delete them ? Queue
? Hell :)
 
You need a firewall. 'Messenger spam', is not in itself harmful, but is
symptomatic of a larger problem - your computer has ports open from the
Internet.

You can disable the Messenger service, but that is unwise as a solution as
you'll still have the underlying problem that caused you to get the messages
in the first place - consider the messages a useful warning that you have no
protection from the Internet. This is all too important now, given the
recent rash of RPC worms....

For a standalone machine, see www.sygate.com for a free personal firewall,
or if using Windows XP, you can enable the built-in internet connection
firewall (ICF).

See http://securityadmin.info/faq.htm for more info. Also,
http://www.mvps.org/winhelp2002/nopopups.htm is a good resource - although
for browser popups, you might want to consider http://toolbar.google.com -
it works like a champ and is also handy for searching.
 
Yes, but i need Messenger Service to run. This is the Production server so it needs notifying.

Still, i dont know what to do if i get like 10000001 msgs. I stop the messenger service, alerter, etc. but still, those msgs are
comming, from where ? another server ? What if server is notifying itself ? Where are those msgs stored ? How to delete them ? Queue
? Hell :)
Click to expand...

Yes, but you didn't read that page very carefully did you? There are two
choices one is to disable messenger and the other is to get a firewall,
install Zonealarm and leave the Messenger service enabled.

Regards

Bill
 
Greetings --

Does the title bar of these pop-ups read "Messenger Service?"

This type of spam has become quite common over the past several
months, and unintentionally serves as a valid security "alert." It
demonstrates that you haven't been taking sufficient precautions while
connected to the Internet. Your data probably hasn't been compromised
by these specific advertisements, but if you're open to this exploit,
you may well be open to other threats, such as the Blaster Worm that
recently swept cross the Internet. Install and use a decent,
properly configured firewall. (Merely disabling the messenger
service, as some people recommend, only hides the symptom, and does
little or nothing to truly secure your machine.) And ignoring or just
"putting up with" the security gap represented by these messages is
particularly foolish.

Messenger Service of Windows
http://support.microsoft.com/default.aspx?scid=KB;en-us;168893

Messenger Service Window That Contains an Internet Advertisement
Appears
http://support.microsoft.com/?id=330904

Stopping Advertisements with Messenger Service Titles
http://www.microsoft.com/windowsxp/pro/using/howto/communicate/stopspam.asp

Blocking Ads, Parasites, and Hijackers with a Hosts File
http://www.mvps.org/winhelp2002/hosts.htm

Whichever firewall you decide upon, be sure to ensure
UDP ports 135, 137, and 138 and TCP ports 135, 139, and 445 are _all_
blocked. You may also disable Inbound NetBIOS (NetBIOS over TCP/IP).
You'll have to follow the instructions from firewall's manufacturer
for the specific steps.

You can test your firewall at:

Symantec Security Check
http://security.symantec.com/ssc/vr_main.asp?langid=ie&venid=sym&plfid=23&pkj=GPVHGBYNCJEIMXQKCDT

Security Scan - Sygate Online Services
http://www.sygatetech.com/

Oh, and be especially wary of people who advise you to do nothing
more than disable the messenger service. Disabling the messenger
service, by itself, is a "head in the sand" approach to computer
security. The real problem is _not_ the messenger service pop-ups;
they're actually providing a useful, if annoying, service by acting as
a security alert. The true problem is the unsecured computer, and
you've been advised to merely turn off the warnings. How is this
helpful?


Bruce Chambers
--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH
 
Hi!

Im the same guy, just from home :)

Ok, i saw all of your posts, but hell ppl! i dont have problems with
"outside" spam or something :)

This is big corporate - production server.

In example: if i ran ntbackup and it halts - because no DLT tape - it will
send numerous (every 2 seconds) "messenger service" titled bars, popups to
ITSelf!

If im not there in the moment, or noone in the Administration can see that,
there will be like few hours, every two seconds popups.

So, if i go and click them all, ill have to click like 9000 times (30 * 300
: every two seconds == 30 times in the minute * take 5 hours * 60 minutes ==
300).

Now, im interested in how to clear that popup messenger service msgs
queue/pool/buffer - i cant find where they are stored.

I know how they are generated, still cant delete them.

+ there is much traffic between servers, virus alerts, backup alarts, spam
alerts, all kind of alerts, across 20+ servers.

All those Msgs are VALID! and needed, im just coriuos how to delete them
without clicking 9000 times in the row and no rebooting.


Thank You,
 
Hi!

Im the same guy, just from home :)

Ok, i saw all of your posts, but hell ppl! i dont have problems with
"outside" spam or something :)
Click to expand...

Then why didn't you say that in the first place.
This is big corporate - production server.

In example: if i ran ntbackup and it halts - because no DLT tape - it will
send numerous (every 2 seconds) "messenger service" titled bars, popups to
ITSelf!
Click to expand...

If you don't need those messages then stop the backup software from
producing them.
If im not there in the moment, or noone in the Administration can see that,
there will be like few hours, every two seconds popups.

So, if i go and click them all, ill have to click like 9000 times (30 * 300
: every two seconds == 30 times in the minute * take 5 hours * 60 minutes ==
300).

Now, im interested in how to clear that popup messenger service msgs
queue/pool/buffer - i cant find where they are stored.

I know how they are generated, still cant delete them.

+ there is much traffic between servers, virus alerts, backup alarts, spam
alerts, all kind of alerts, across 20+ servers.

All those Msgs are VALID! and needed, im just coriuos how to delete them
without clicking 9000 times in the row and no rebooting.

Thank You,
Click to expand...

AFAIK, there is nowhere to delete the 'queue' of messages they are sent as
single messages and display as they arrive. If you want to get rid of
specific messages there are two things I can suggest: first, make sure you
only have valid messages displayed; second, use something like Buzoff that
will get rid of pop-up windows.

Perhaps someone else will have a more useful answer for you.

Regards

Bill
 
I think if you hold ctrl (or shift) while clicking a button in a dialog with the same name it will automatically push that button in ALL windows of the same name.
 
Eep² said:
I think if you hold ctrl (or shift) while clicking a button in a dialog with the same name it will automatically push that button in ALL windows of the same name.
Click to expand...

Damn!!! If that's true, that would be MIGHTY handy to know!
 
ya, still, i dont understand how is thats not possible to clean all that queue up of those popups messenger service msgs ...
 
BaKaR said:
ya, still, i dont understand how is thats not possible to clean all that queue up of those popups messenger service msgs ...
Click to expand...

Did you try stopping and restarting the messenger service? Maybe that
will kill "queued" messages.
 
Yes sure :)
Didnt help, nor Messenger service, Alerter, Perf Logs and Alerts, dunno what else to chk ..
 
A temporary workaround I have been using in this situation is to
download "TweakUI" from microsoft, and configure the X-Mouse settings
to Autoraise when activating with a delay of 0 ms. Then simply
position the mouse over the dialog and hold down the enter key. As
long as your keyboard repeat rate is longer than 0 ms, the next dialog
will be ready for the next keyboard event. Voila. You should then scan
your event log for any important events that might have been buried in
the haystack...
 
Back
Top