Messenger Service CSRSS.exe? What causes POPUPS?

Hello everybody!
I am running a wired 3 computer network at home and have been having issues with POPUPS lately. I have high speed internet access and use a linksys 4 port router to connect all my machines. The first machin on the network has the best antivirus, port blocking and intrusion detection software but seems to get hit with the most POPUPS. I used popupstopper for awhile but realized that all it did was allow the popups and then close them for me. I have been researching this and looking all around in the registry where I find pleanty of spyware (all gone now) but can't find what is allowing the "Messenger Service" to send these ads to my desktop with or withour IE 6 running. I use Norton IS and AV, Webroots Spysweeper and am using PORTBLOCKER as a yep, you guessed it....port blocker. I see that CSRSS.EXE runs the messenger service but have been advised that it is not good to shut it down via Ctrl+Alt+delete. It is not in my startup and is not in my run/runonce etc areas of my registry. Can anyone tell me what I may do to find out where these are coming from? I've blocked the advertised sites in my browser but it still happens. Many thanks,
Harry

Does the popups go away after you reboot? Some websites create popups that will open other popups as you close a popup. This sometimes is cleaned when you reboot.

I've used Ad-Aware and Spybot which works most of the time.

Another problem is Messenger Service that you mentioned. Here is a site that talks about how to stop the problem, if this is the type you have.

www.financial-planning.com/wwwboard8/messages/6922.html

Aren't people fun?

Don't confuse the messenger service with MSN messenger. The messenger service is that ridiculous 'feature' microsoft built into windows which allows you to send a popup. Test it out like this.
Go into a dos window by typing cmd in run.
then type

net send 127.0.0.1 Hello World

You should get a popup saying Hello World.

Now to disable the service, click start > run and type services.msc
when it opens, scroll through the list of services till you find messenger service, double click it and stop the service, and set its startup mode to disabled.

You can visit www.blackviper.com for a list of other services you can disable.

If you found a lot of spyware, download Spybot or Adaware and let them clean you up.

I'll move this topic to the Windows and Dos forum in a couple of days where more people will see it as a lot of people have this problem. Don't forget to check there for replies.


Cheers,

Don't confuse the messenger service with MSN messenger. The messenger service is that ridiculous 'feature' microsoft built into windows which allows you to send a popup. Test it out like this.
Go into a dos window by typing cmd in run.
then type

No offence to you, but I actually like the 'Messenger service' I think it was/is a good idea. Comes in handy when your sending threats over the network. If people can't block some ports or click Services>>'Messenger'>>Manual>>Stop then that is their problem.

That was a great help and the followup link to BlackViper clarified this issue. I've spent too much time away from these things. It feels good to get involved with the insides of the tools we all use. THANKS!!!!
:idea:

nnbnbManip, I'm in total agreement with you there, nothing more fun than having a quick look through your firewall logs for a windows box voluntarily/involuntarily scanning you and sending them a net send message..

my point was, do you need it enabled by default ? Personally I like being told about everything my os is turning on, not having to find out later and then having to turn it off.

Then again I'm a bit of a maniac, I run with less services than most hardened firewall boxes.. everything goes off.. that damn resource hogging system restore and windows file protection are the first things I turn off on a clean install.

HarryLpage, glad I was able to help. You'll soon discover why people rave about this site www.alexa.com/data/details/reviews?q=fir...&url=firewall.cx

Cheers,