Pop-up plague headed "Messenger service".

  Awestruck 19:38 30 Jul 2005

My friend’s Windows 2000 computer is plagued with two pop-ups. They both start with “Messenger service” and one continues as follows:
Message from Security Monitor to windows user…Important Windows security bulletin
It warns about a buffer overrun and a virus infection. Then it instructs to access the web at click here.

The second pop-up says:- “Stop! Windows requires immediate attention. Windows has found 47 critical system errors” it then instructs to download a registry repair from click here

Naturally we close these as they are obvious fakes and most probably dangerous.

Spybot andAdAware cannot find the cause. I do not want to use a pop-up stopper as this only deals with the symptoms. Does any one out there know the registry entries and file names which start these pop-ups?

  VoG II 19:40 30 Jul 2005

Disable Mesenger Service click here

  woodchip 19:46 30 Jul 2005

Windows 2000

1. Click Start-> Settings-> Control Panel-> Administrative Tools->Services

2. Scroll down and highlight "Messenger"

3. Right-click the highlighted line and choose Properties.

4. Click the STOP button.

5. Select Disable or Manual in the Startup Type scroll bar

6. Click OK

  Awestruck 09:59 31 Jul 2005

Many thanks for your replies. I was aware of the solutions you so kindly provided but I really wanted to know some background to these pests. Sorry I did not express myself clearly. How do these get on to the conmputer and what does the pest insert into the registry and what files does it deposit in the computer. I would prefer to get rid of the pest rather than stop it operating. Hope I don't appear too pernickity.


  VoG II 10:01 31 Jul 2005
  dogbreath1 10:36 31 Jul 2005

click here for details as to what it is, how it is abused by spammers and of a way of disabling it's misuse without totally shutting it down. click here to test a pc's vulnerability to the Windows Messenger exploit.
click here for the good news that Microsoft are to disable this service by default.
click here to read about this services' security vulnerability as regards the spreading of malicious code. You asked what registry changes are made and what files are deposited. That would depend upon the payload of the virus.
However the messages you received will probably just be spam.

  splinternet 18:48 27 Aug 2005

I tried the link provided by VoG ("Shootthemessenger") but I'm still getting pop-up's, e.g. click here which suggests these pop-up's are using something other than Windows Messenger Service. Anything else I can try?

  VoG II 18:52 27 Aug 2005

Windows XP SP2 has an effective pop-up blocker for Internet Explorer. So does the Google Toolbar click here

  splinternet 20:58 27 Aug 2005

I'm already on XP SP2 - is the pop-up blocker automatically built-in or do I have to invoke it? Not sure I want to go Google - I'm content with Yahoo (call me staid and old-fashioned).

  woodchip 21:01 27 Aug 2005

Pop-up blocker in Control Panel Internt Options

  splinternet 23:26 27 Aug 2005

I've got pop-up blocker set but with medium filter, guess I should set this to high?

This thread is now locked and can not be replied to.

Elsewhere on IDG sites

WPA2 Hack Latest News: How Secure is your Wi-Fi?

Photoshop CC 2018 released with new Curvature Pen and better brush tools

Best kids apps for iPhone & iPad

Comment utiliser Twitter ?