[957] in winnt
Re: Questionable Pop UP
daemon@ATHENA.MIT.EDU (Barbara Santorella)
Wed Oct 16 09:13:48 2002
Message-ID: <3DAD651C.8C237930@mit.edu>
Date: Wed, 16 Oct 2002 09:09:48 -0400
From: Barbara Santorella <bsantore@MIT.EDU>
MIME-Version: 1.0
To: Kerem B Limon <kerem.limon@mit.edu>
CC: ntpartners@mit.edu
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Thank you Kerem and Craig. I have disabled the Messenger service on my
machine and will likely do so on my other machines. Neither Kerem's
message nor the article from The Register mentions any security threats,
only nuisances, but it feels like it's only a matter of time . . .
Kerem B Limon wrote:
>
> (Jon Hunt might already have commented on this elsewhere, and I assume he
> will as soon as he sees your notes.) We have run into spam distributed
> using the Messenger service (the service that enables those pop-ups), and
> WinAthena, for example, has already disabled this service on their
> workstations unless the local admin overrides it for some reason.
>
> From the discussion there, so far we have identified the following legit
> uses of the NetBIOS Messenger service:
>
> >We have now identified 3 types of software that use the NetBIOS Messenger
> >service for legitimate purposes. These are:
> >
> >- some "desktop" UPS units use the Messenger service to notify users when
> >there has been a power failure and the computer is using the UPS. More
> >expensive UPS units do not use this service for notification. (identified by
> >MIT)
> >
> >- some older printers send notifications about paper jams, empty paper bins,
> >and low toner, via the Messenger service. Newer printers tend to use SNMP or
> >other mechanism for this notification. (identified by Microsoft)
> >
> >- the VirusScan alter service (identified by Kerem)
>
> If you are not dependent on any of these (and the last one is really for
> sending notices to an Admin console for VirusScan, not individual
> machines), I'd suggest disabling the Messenger service, as few other apps
> use it anyway.
>
> If you need details on how to do this, let us know and Jon or I could give
> details.
>
> Kerem
>
> At 2002-10-16 08:30 Wednesday, Barbara Santorella wrote:
>
> > Hello all,
> >
> > I have had a questionable pop up appear on several of my computers. A
> > window pops up on the screen that appears from Windows "Messenger
> > Service" it states that the message is from WEBPOPUP06 and is addressed
> > to the actual computer name. It then goes on encouraging the recipient
> > to call a phone number to purchase a diploma. Has anyone seen this?
> >Do
> > I need to be concerned from a security standpoint? I have a .jpg of
> >the
> > message, if anyone is inerested. I did not want to send an attachment
> > to the whole list.
> >
> > Barbara Santorella
> > Windows Administrator
> > MIT Bates
