Black Viper
Black Viper

Messenger

 

General Information

This service provides the ability to send messages between clients and servers. This service does not need to be running under normal “home” conditions. It is also advisable to make this service go away to avoid the possibility of “net send” messages hitting your computer from the internet. After the installation of Service Pack 2, this service is set from Automatic to Disabled by default. This has nothing to do with MSN Messenger, nor is it “WinPopUp.”

To test for this security vulnerability, at the command prompt, (run: cmd.exe) type:

net send 127.0.0.1 hi

If you get a popup “hi” message, you should disable the Messenger service.
If you get an error stating, “The message alias could not be found on the network,” you are safe.

If, for whatever reason, you need the Messenger service running but wish not to have spam popups active, you can disable the particular ports at your firewall. The Messenger service uses UDP ports 135, 137, and 138; TCP ports 135, 139, and 445.

Windows XP Pro x64

Default Description

Transmits net send and Alerter service messages between clients and servers. This service is not related to Windows Messenger. If this service is stopped, Alerter messages will not be transmitted. If this service is disabled, any services that explicitly depend on it will fail to start.

Additional Information

None at this time.

Default Startup Type

OS SP0 SP1 SP2
XP Pro x64 ? ? Disabled

Service Names

Service Name (registry): Messenger
Display Name: Messenger

Default Path and Command Line Options

C:\WINDOWS\system32\svchost.exe -k netsvcs

Log On As

Account: Local System Account

Dependencies

What service Messenger needs to function properly:

What other service require Messenger to function properly:

  • None

Windows XP

Default Description

Transmits net send and Alerter service messages between clients and servers. This service is not related to Windows Messenger. If this service is stopped, Alerter messages will not be transmitted. If this service is disabled, any services that explicitly depend on it will fail to start.

Additional Information

None at this time.

Default Startup Type

OS SP0 SP1 SP2 SP3
XP Home ? ? Disabled Disabled
XP MCE 2005 ? ? Disabled Disabled
XP Pro ? ? Disabled Disabled
XP Tablet PC 2005 ? ? Disabled Disabled

Service Names

Service Name (registry): Messenger
Display Name: Messenger

Default Path and Command Line Options

C:\WINDOWS\system32\svchost.exe -k netsvcs

Log On As

Account: Local System Account

Dependencies

What service Messenger needs to function properly:

What other service require Messenger to function properly:

  • None (H, M, P, T)

Additional Reading

None at this time.