近來許多的pop up 廣告利用Windows 2000 及 Windows XP 內的 Messenger Service 的功能大量傳送廣告，造成學校方面的困擾，以下提供一些方式讓您解決這些問題及追縱來源的電腦網路IP位址：
 
如何追縱來源電腦的IP位址：
How to trace who is sending the message
當您在 WinPopup 收到廣告訊息時，請立即於dos模式的視窗下，執行“arp –a”的指令
您可以看到來源電腦的 IP address 及 physical address。
接下來，使用指令“ping –a <IP of the source computer>” 以找出發送廣告訊息的電腦名稱。
注意：請於接到訊息之後，立即執行“arp –a”指令。 TCP/IP 連線的歷史資料會由cache中被定時清除
此外，您也可以使用防火牆的功能追縱來源電腦的位址。

Messenger Service Window That Contains an Internet Advertisement Appears

The information in this article applies to:
  • Microsoft Windows XP Professional
  • Microsoft Windows XP Home Edition
  • Microsoft Windows 2000 Advanced Server
  • Microsoft Windows 2000 Server
  • Microsoft Windows 2000 Professional
  • Microsoft MSN Messenger 4.5
  • Microsoft MSN Messenger 4.6
  • Microsoft MSN Messenger 5.0
  • Microsoft Windows Messenger 4.0
  • Microsoft Windows Messenger 4.5
  • Microsoft Windows Messenger 4.6
  • Microsoft Windows Messenger 4.7
This article was previously published under Q330904

SYMPTOMS

A Messenger service window that contains an Internet advertisement appears. The text in the advertisement is similar to the following text:
Messenger Service
Message from source to your_computer_name.ISP_name on date time
Message Text
These messages are also called "messenger spam."

CAUSE

This issue occurs if you are sent anet send message by someone who is using the Messenger service in Windows. The Messenger service is a Windows service that transmits net send messages and messages that are sent through the Alerter service between client computers and servers. For example, the Messenger service can be used by network administrators to send administrative alerts to network users. The Messenger service can also be used by Windows and other software programs. For example, Windows may use it to inform you when a print job is completed or when you lose power to your computer and switch to a uninterruptible power supply (UPS). Your antivirus program may use the Messenger service to send you notifications. The Messenger service is not related to your Web browser, e-mail program, Windows Messenger, or MSN Messenger. This issue may occur if the following conditions exist:
  • The Messenger service is started.
  • The Remote Procedure Call service is started.
  • Inbound NetBIOS (NetBIOS over TCP/IP) and UDP broadcast traffic is turned on for your Internet connection.

RESOLUTION

To resolve this issue, install or turn on a firewall that blocks inbound NetBIOS and UDP broadcast traffic. The method that you use to resolve this issue depends on your operating system and how you connect to the Internet. The following sections provide examples of several different configurations and possible methods of resolution.

You Connect to the Internet Directly

If you use a single computer that is connected to the Internet directly (by using a cable modem, a DSL modem, or a dial-up modem, for example), install a firewall and block inbound NetBIOS and UDPbroadcast traffic on your computer.

You Are Running Windows XP

If you are running Windows XP and connect to the Internet directly (by using a cable modem, a DSL modem, or a dial-up modem, for example), install Windows XP Service Pack 1 (SP1) and turn on Internet Connection Firewall (ICF). For additional information about how to obtain Windows XP SP1, click the following article number to view the article in the Microsoft Knowledge Base:

322389 How to Obtain the Latest Windows XP Service Pack

For additional information about how to turn on ICF, click the following article number to view the article in the Microsoft Knowledge Base:

283673 HOW TO: Enable or Disable Internet Connection Firewall in Windows XP

You Are Running Windows 2000

If you are running Windows 2000 and connect to the Internet directly (by using a cable modem, a DSL modem, or a dial-up modem, for example), obtain and install a third-party firewall product that blocks inbound NetBIOS and UDP broadcast traffic. For additional information about firewalls, visit the following Microsoft Web site:

http://www.microsoft.com/security/articles/firewall.asp

You Connect to the Internet Through a Small Network That You Manage

If your network uses connection sharing to provide Internet access to multiple computers, install or enable the firewall only on the shared Internet connection.

You Are Running Windows XP with ICS

If you use Internet Connection Sharing (ICS) in Windows XP to provide Internet access to multiple computers, install Windows XP SP1 on the ICS host computer and turn on ICF only on the ICS host computer.

You Are Running Windows with a Hardware Internet Connection Sharing Device

If you use a router or other hardware device to provide Internet access to multiple computers, configure the connection sharing device to block inbound NetBIOS and UDP broadcast traffic. Contact the manufacturer of your third-party connection sharing device for more information.

You Connect to the Internet Though a Network That You Do Not Manage

If you connect to the Internet by using a corporate network or if your Internet service provider (ISP) uses a firewall, ask the network administrator to configure the firewall to block inbound NetBIOS and UDP traffic. Contact your network administrator or ISP for more information.

WORKAROUND

To work around this issue, turn off the Messenger service. To do so, follow these steps:
  1. Click Start, and then click Control Panel (or point to Settings, and then click Control Panel).
  2. Double-click Administrative Tools.
  3. Double-click Services.
  4. Double-click Messenger.
  5. In the Startup type list, click Disabled.
  6. Click Stop, and then click OK.
Note If the Messenger service is stopped, messages from the Alerter service (notifications from your antivirus software, for example) are not transmitted. If the Messenger service is turned off, any services that explicitly depend on the Messenger service do not start, and an error message is logged in the System event log. For this reason, Microsoft recommends that you install a firewall and configure it to block NetBIOS and RPC traffic instead of turning off the Messenger service.

MORE INFORMATION

The Messenger service uses UDP ports 135, 137, and 138; TCP ports 135, 139, and 445; and an ephemeral (that is, short-lived) port number greater than 1024.

In addition to preventing net send messages, a firewall can also protect your computer from other malicious attacks over the Internet. These attacks can be designed to perform the following tasks:
  • Access your private information
  • Distribute software illegally by appropriating space on your hard disk
For additional information about this issue, visit the following Microsoft Web site:

http://www.microsoft.com/WindowsXP/pro/using/howto/communicate/version45/stopspam.asp

Last Reviewed: 1/31/2003
Keywords: kbprb KB330904
 

Stopping Advertisements with Messenger Service Titles

When you are connected to the Internet, a new window may open on your computer screen containing an advertisement. The windows are labeled Messenger Service in the title bar. However, these messages, which are sometimes called "messenger spam," are not related to Windows Messenger, MSNR Messenger or such instant messaging services. Disabling your instant messaging services will not stop this form of advertisement.

f1
Figure 1. Example of "messenger spam"

These advertisements are sent via the Messenger Service, which is designed for use by system administrators in Windows server-client networks. System administrators use the messenger service to send messages that notify you of conditions on or give status about your network. However, some advertisers have started using this service to send their information via the Internet.

The way you can stop messenger spam depends on whether your computer is part of a corporate network.


If you have Windows XP with Service Pack 1 installed, turn on Internet Connection Firewall.
Note: You can tell if your computer is running Windows XP with Service Pack 1 by clicking Start, right-clicking My Computer, and clicking Properties. The details under "System" show which version of the operating system you have.

To enable Internet Connection Firewall

  1. Click Start, click Control Panel, click Network and Internet Connections, and then click Network Connections.
  2. Right-click the connection on which you would like to use ICF, and then click Properties.
  3. On the Advanced tab, select Protect my computer and network by limiting or preventing access to this computer from the Internet, and then click OK.

f2

To install Windows XP Service Pack 1 from Windows Update


    1. Click Start, point to All Programs, and then click Windows Update.You must upgrade to Service Pack 1 to fully block messenger spam.

    2. Follow the instructions for turning on the firewall for Windows XP with Service Pack 1 above.


Note You can also disable the Messenger Service in Windows XP. When you disable the messenger service, it is no longer available for receiving legitimate messages, such as administrative alerts and notifications from antivirus programs. Be sure to talk with your system administrator before taking this action if your computer is part of a corporate network.

For more information on the origins of messenger spam and how to handle it, read this Knowledge Base article 330904.