RSSPesky Messenger Service Disabled in Windows XP SP2
By David Worthington | Published October 29, 2003, 6:21 AM
Late last week, America Online acknowledged it taken the drastic and unprecedented step of programming its software to silently turn off a Windows service so that it could stem the tide of spam and security vulnerabilities facing its subscribers.
The Windows Messenger service, enabled by default, allegorically leaves the door wide open for pop-up ads to pester Windows XP and 2000 users, while leaving them at risk of security exploits. Now, Microsoft has weighed in and says it will turn off the service in Windows XP.
Anyone who has seen little gray dialog boxes appear out of nowhere during a Windows session is familiar with the Messenger service whether they know what it is called or not. The Messenger service is an administrative feature rarely used outside the realm of corporate networks, and is not related to the better known Windows Messenger real time communication application.
Advertisers have been misusing the service to the ire of their unwitting victims.
Earlier this month, it was also revealed that the Messenger service contained a flaw, which could lead to a privilege elevation on machines targeted by hackers.
After providing customers with a resource page as well as a tool to eliminate the ads, AOL decided that enough was enough - despite entering into murky legal territory. By making the adjustments to Windows itself, some online pundits have pointed out that AOL has potentially violated the Computer Fraud and Abuse Act.
Redmond has decided to take a more drastic measure in order to clean up its own mess. At its Professional Developers Conference in Los Angeles, Microsoft's Neil Charney told the crowd of developers that the obscure service was destined to be turned off in Windows XP Service Pack 2.
To shelter itself from the hailstorm of criticism surrounding well publicized holes in its products, Microsoft has reaffirmed its commitment to security by changing the way it releases fixes, develops code, educates customers and discloses patches.
START-
CONTROL PANNEL-
PERFORMANCE AND MAINTENANCE-
ADMINISTRATIVE TOOLS-
SERVICES-
Scroll down till you see Messenger. Double click on Messenger, then you will see four box's click stop. Then just above you will see start up type. Click the drop down box and select disabled. Then click apply then ok.
As for people running a search maybe they will come to this page ?
Score: 0
|You can fix this yourself before Springboard. From a command prompt or from Start->Run, type:
net stop messenger && sc config messenger start= demand
This will stop the messenger service and then prevent it from starting again by changing its service setting to manual start.
This is NOT the same as Windows Messenger or MSN Messenger.
Score: 0
|Most people i know call it windows Messenger so dont be harsh on them.
Score: 0
|I'm not trying to be harsh, I'm trying to clarify something that I feel most news sources have muddled. Perhaps this is a problem with the way Microsoft marketing has called two different things by very similar names, but I felt that it was important enough to distinguish.
Either way, the solution for turning the service off that I suggested is, I believe, the simplest and quickest method -- how can someone screw up copy and paste? I had hoped that someone would have commented on that instead.
Score: 0
|Anyone with a firewall is unaffected by this thing anyhow. Not to mention anyone who has not disabled it does not deserve it to be done, all you have to do is type in a few simple search phrases in any search engine and you can find the directions on how to turn it off...if you are too stupid to do that then you should not be operating anything with electricity in the first place. The problem with people is that they want everything done for them instead of LEARNING something, that will be the downfall of software, IE AOL. It amazes me that people would use a computer riddled with pop ups and never question why and then proceed to fix the problem. I went to use a friends computer once and when I opened up his web browser I got about 6 pop ups at once and his home page was some off the wall crap...I would rather not use a computer than put up with that, what the hell is wrong with people.
Score: 0
|The "IE" in my comment was not refering to the browser
Score: 0
|Just use "i.e." next time. That's the correct way.
Score: 0
|Dammit why did you tell us that?? I wanted to LEARN what you meant by IE! :D
Really though, some people just don't KNOW what is causing the popups. They don't go into forums to hear the "talk" about the messenger service. They are new to the problems with being exposed to the internet. I had a friend who was getting the popups (when he first got dsl) and he was totally frustrated with where they were coming from. I told him how to turn off the service and quickly pointed him in the direction of a good software firewall. Now he understands what can be done and wants to learn more.
Score: 0
|So this is how AOL is reducing the amount of popups on their service as claimed in some of their ads I saw on TV.
Score: 0
|AOL should have warned users, but they were smart to do this. I'm glad to hear that Microsoft is planning to turn the bloody thing off. That should have been the default position from the start, because very few people use it, and they can always turn it on.
I'd recommend Gibson Research's little program, ShootTheMessenger, which turns it off without having to go through Control Panel and a lot of mickey mouse tabs to get there. It also makes it easy to turn back on in the remote chance that you want to use it.
I recommend Gibson's other little security programs as well. They don't use any memory and they make it easy to turn off various settings that MS never should have left open in the first place.
Score: 0
|Is disabling the messenger serivce as easy as running msconfig and unchecking the messenger option under processes? Or is there anything else that must be done?
Score: 0
|Don't use MSCONFIG, it will make you reboot your computer. Use the services function under Admin tools, or just type services.msc in the run command.
Score: 0
|Don't disable this via msconfig. In the run dialog box, type services.msc and in the right window pane look for the messenger service. First click "stop" then in the drop down selection there pick disable. That should do it and is the preferred way to do it.
Score: 0
|um, it asks you if you want to. you can always click no.
Score: 0
|That's the wrong messenger service you're talking about. You are talking about turning off Windows Messenger, which provides notification API hooks in XP. What you want to turn off is the Messenger Service listed in the services control panel.
The best way to do this is to type into a command prompt, or from run: "net stop messenger && sc config messenger start= demand"
This command line will stop the messenger service and prevent it from starting in the future.
Score: 0
|AOL's messing around with settings unrelated to their application is flat out wrong. They already splatter their customer's machines with gratitious AOL links and shortcuts so this is just a small step worse, but it's a critically important step worse.
The Messenger service may indeed not be used by most folks, and it may indeed a source of irritation when abused by spammers, and yes AOL may get the occasional complaint about this from their PlaySkool Internet users, but that doesn't mean the service is theirs to turn off or that no one else uses it.
Part of my ire is not just the reckless assumption AOL makes but that as a systems administrator this'll be one more thing to add to my plate (and one more reason to disdain AOL). In my supported sites, and in many other corporations, we use Messenger to broadcast alerts to our users, like "Server Bob off in 5 Min". Many of our applications also use it, tools like backup applications sending "Server Bob Backup completed 03:15". No, it's not the best tool, and we can replace it with another, but it's a standard one thats been in place for years and integrated into our processes.
Yes, some of our folks have AOL installed on their PCs and laptops. Some of them even have it there with corporate blessing, have made legitimate business cases for it. However now I'll have to go and identify all of those folks and regularly run tools to ensure that they too receive Messenger broadcasts while we decide if to continue to use Messenger or replace it with something else.
If AOL had simply put in a check box smoewhere, "Tick here to disable the Windows Messenger Service, clcik here for more information on Windows Messenger service and how it's not the competing IM service of similar name" then it'd be fine. But no, they're surriptiously changing a setting on machies they've no business touching and thats wrong.
AOL has been trying to break into Corporate America for awhile now, offering in-house chat services, road warrier options, well with this they've gotten themselves on every CIO's*** list; good going.
In the meantime any bets on how much the first lawsuit will be for when this little change breaks something at a large site and they seek to recoup costs? Note to AOL: Next time run boneheaded ideas like this past Legal, and keep in mind it doesn't matter what your EULA sez some judge will still make a call this was unreasonable.
Score: 0
|TOTALLY agree. While I do not use the messenger service, in fact I've been disabling in on the latest rollouts, I do not want AOL doing anything to my users' machines that aren't specifically related to AOL.
Score: 0
|"However now I'll have to go and identify all of those folks and regularly run tools to ensure that they too receive Messenger broadcasts"
Can't you force the Messenger service enabled using Group Policy? Or does AOL disable it every time it starts (as opposed to at installation time)?
Score: 0
|AOL does pop a message to the user that it has detected the messenger service is active and then if they choose "yes fix it for me." Then AOL runs the fix.
Score: 0
|Any questions on America Online? please e-mail me at dannyboi@nycap.rr.com (AOL TECH).
Score: 0
|I have a question.
Why does AOL exist ?
Score: 0
|Finally someone put a bullet on these advertises' stupid head.
What AOL did was right, and MS is going to fix their mistake as well.
Gotta love it!
Score: 0
|