from the Langa list www.langa.com 2002-10-24
2) New Intrusive Ad Type
You may have seen the news: A company is selling a tool that makes it easy for aggressive advertisers to open a new kind of browser-less popup ad on your PC--- an ad that can appear whenever you're online, whether or not you're viewing a web site. (See http://mynetwatchman.com/kb/security/articles/popupspam/index.htm for the first examples of this spam found in the wild.)
The ads use a normally-valid function of Windows Messenger, which is part of the OS (not to be confused with "MSN Messenger," the IM/Chat toy). Messenger is a tool that normally allows, say, a business' network administrator to broadcast a message to everyone on a LAN; the message might be something like "Server going down for maintenance in 5 minutes. Please log off." Some other legitimate tools and services may also use Messenger to display information, too.
If you don't need Messenger at all, just disable it. It's not hard: http://www.hsc.fr/ressources/breves/min_srv_res_win.en.html )
But if not, all firewalls should let you block the ports that Messenger normally uses: Port 135 (TCP/UDP) and for a related but slightly different form of messaging--- ports 137 and 139. see http://mynetwatchman.com/kb/security/articles/popupspam/index.htm and http://mynetwatchman.com/kb/security/articles/popupspam/netsend.htm )
