| « prev next » |
Update: Looking for what is golarger? See this entry. Feb 28, 2003
I talked about NET SEND spam in my previous blog. After that, I found this page become the first item in Google for net send spam. Many visitors hit this page via Google. I believe I share the responsibility to publish something that is helpful for the visitors to prevent this kind of spam.
Messenger service is dangerous
If you keep your Messenger service running, anyone can send you a message and it will pop up on your screen. Even the simplest program ever can drive you mad. Create a file named "NetSendSpam.bat" with the following three lines.
:sendspam
net send 127.0.0.1 How are you
goto sendspamIt keeps sending the same message to you again and again. You will face endless message box stating "How are you." - Please do not try this script to anybody except yourself. To send spam is as easy as picking up a stone and breaking the store window, but everyone in this world should realize their responsibility and don't abuse others.
Easiest way - turn off Messenger service
The easist way to stop receiving this kind of message is to turn off Windows Messenger service. If you are running Windows XP, following these steps:
Update The equivalant method
Thanks to Docslax for pointing this out. There is another equivalant way to do this in Windows.
To start it again for any reason open the command prompt again (Start -> Run -> cmd.exe) and type "net start messenger"
Now you can be assured that your world will become silent. No one can send you NET SEND SPAM again.
But wait, that is all
Please note: some alert services and system services like printing, rely on this service to function.
However, as I understand, there are two kinds of people using computers ?those in company or those at home. I believe most people surfer from NET SEND SPAM is home users connecting to DSL or Dial-up. For cooperate users, they need printers and file sharing functions, but they are more likely to be protected by corporate firewall. So my suggestion is, anyone who surfers from NET SEND SPAM to turn off the service using the step listed above.
You can also fight back
If you are using Windows XP or you have personal firewall product, it is even better to enable them. But enabling a firewall, you not only eliminate the chance to be attached by spam, you can also get the IP address of the spammer and you can fight back. I will talk more about this in my future blog.
Resources
by Jian Shuo Wang on November 7, 2002 under Spam
Your info on Net Send spam has been most enlightening. How can an ISP block it from hitting any subscribers as a whole?
Posted by: k on January 9, 2003 9:04 PMI am trying to run "run" without using the start menu. Does any one have an idea how do do this.
Posted by: Nick on January 16, 2003 2:33 AMNot sure if this is silly answer for Nick. If you have Windows keyboard, press WIN + R will call out of the Run... dialog box.
Posted by: Jian Shuo Wang on January 16, 2003 10:41 AMThis net send messages were really getting annoying and even kicking me out of full screen programs all the time, thanks for the info they -really- helped!
Posted by: drek on January 20, 2003 11:56 AMThanks for the info. I had been running 'net stop messenger' manually for a while; now I know better! :)
Posted by: Ingrid Janse on January 24, 2003 2:54 AMShort, Simple, Precise - you have used you google.ranking very good ;) Thanks
Posted by: phroggar on January 30, 2003 2:44 AMShort, Simple, Precise - you have used you google.ranking very good ;) Thanks
Note: my real email is phq AT data-zone DOT de (Anti_Spam_Robot-Notation)
Posted by: phroggar on January 30, 2003 2:45 AMget sygate's free personal firewall and you can both block and backtrace those very annoying people and spam them yourself
Posted by: me on February 2, 2003 9:52 AMThank you, Do you what the legality is for this advertising method?
-Ryan
Its Really Unltimate Search Engine Google.com I like i got lot of info from Gooooooooooooogle.
thank u very much for google service
Finally I can stop these annoying popups. Thanks!!!
Posted by: doctorderm on February 8, 2003 2:18 PMI mean, honestly... www.golarger.com should be the target of the next "Code Red"...
Posted by: James on February 14, 2003 2:25 AMSir,
This was an excellent information. I just want one more thing. Can you please tell how to get the IP of the culprit who spams with a different name.
I will be highly thankful.
net send, is a feature that should not be abused. I used to use it all the time on a network in the area to let people know when system upgrades and stuff would be taking place. We all have public ip addresses, and people object to having a firewall installed. [I don't blame them.] Advertisers and morons, listen up: SPAM DOESN'T WORK, IT'S JUST A WASTE OF EVERYBODY'S TIME AND BANDWIDTH.
Posted by: Brad Isbell on February 19, 2003 3:21 AMFeel free to sign up the email addys on this site to random mailing lists :)
The logo they have in the top right hand corner really made me mad.
Posted by: joe on February 23, 2003 6:56 AMThanks for the info. If you get the free trial hours AOL CDs in the mail, etc....send them to me to stop the pollution
Dani Funk
PO BOX 51971
Durham, NC 27717-1971
thankyou SO MUCH for this. I was really worried I had some sort of a virus - these popups were coming from nowhere. now I know it's just spam. all fixed now :)
just one thing I was wondering... do I have to do the cmd.exe thing every time I restart my comp or is it disabled forever now?
Posted by: kai on February 27, 2003 9:27 AMKai,
Using the method described under section "Easiest way - turn off Messenger service" ensures that it is disabled permenantly. Using the method under "Update The equivalant method" will require you to do so every time.
Posted by: Jian Shuo Wang on February 27, 2003 12:13 PMJames,
Hope you can see this comment again and notice the article I have posted about your golarger.com web site.
Posted by: Jian Shuo Wang on February 27, 2003 4:41 PM!!! FIGHT BACK FROM NET SEND SPAM !!!
It does pay to advise the ISP that the NET SEND SPAM is coming from....Please see this email I just recived :
Hello,
your report was registered, due disciplinary measures about our customer are on the way.
Meanwhile, please accept our apology for Your trouble.
Best regards.
================================================
Abuse Staff
Seat Pagine Gialle s.p.a.
http://tin.virgilio.it
Area Internet - abuse@tin.it
Consulta la guida sulla sicurezza alla pagina http://tin.virgilio.it/periniziare/guida/sicurezza.html
=================================================
heres another one who sends crap via netsend
dsl-loh250.dial.inet.fi [62.71.252.80]
You are a lifesaver.
God bless you.
Love from Saudi Arabia
i am looking on how to stop that spam, because i am running the site ultimate-health.co.uk which it targeted by this spam. it does harm my business a lot, i receive a lot of emails telling me that they (people you get or got that spam) are planning to sue me and my company. Could someone please help me on this matter. PLEASE.
if you have any informations please post them here. I am sorry but i don't give my name nor my email to be protective of my personal life, don't ne mad at me for that.
best regards
Posted by: me on March 6, 2003 7:56 AMplease stop the annoying messages. they are not right. please find another way of advertising. if i wanted your information, don't you think i would just look it up.
my children use my computer and i don't really want them seeing your petty advertisement.
just stop the popups please.
hey thanks for telling me how to loop the school will love the fun of the loop! :D
Posted by: Gene on March 8, 2003 1:06 AMYO thanks for the info. ima net send u a nice thank u card. peace.
Posted by: B Diddy on March 11, 2003 11:14 PMI just did what U discribed above, I really hope it's gonna work.
Anyhow... Thanks a lot !!
Good luck! I believe it must work since this operation is not as complicated as troubleshooting an "Illeagal Operation" error.
Posted by: Jian Shuo Wang on March 12, 2003 11:35 PMThank you so much, I have no idea why I started receiving this damn message, but now it will end. If you have any idea what is causing an IE browser to pop open with similar advertisements please let me know.
Posted by: Brett on March 13, 2003 10:37 AMBrett,
IE will not pop open these AD by itself. It must be someone who is sending the AD to you, just like spam email. It happens even when you close your IE.
Posted by: Jian Shuo Wang on March 13, 2003 9:05 PMway to go on the service, keep it up. google is all over sending people here and i bet there are many more people thankful for stopping net send spam
Posted by: KLN on March 20, 2003 6:31 AMHoo-ray
Net send was wrecking my games of counter strike
For info, in XP, you can get services from : control panel
then administrative tools
then services
Two questions:
I am a homeuser with win XP. I use Norton Internet Securities 2002 as well as a printer regulary.
If I turn off messenger service I am afraid that my printer does not work as well as Norton. Is this true?
Can I somehow configure Norton to take care of the net send spam???
Thanks for help
Mike
man... you can use ipconfig and list the past ip's that have been connected to
Posted by: chinee boy on April 4, 2003 9:42 AMMike, your printer should still work since the service is only used for network printers. You are using home computer, so the printer must be connected to the computer directly. So go ahead.
I am not sure about the Norton tools though.
Posted by: Jian Shuo Wang on April 4, 2003 11:32 AMyou know if you really wanted to kick the spammers in the ass, just go spamming messages on how to stop recieving these messages.
Posted by: b on April 5, 2003 10:52 AMyou know if you really wanted to kick the spammers in the ass, just go spamming messages on how to stop recieving these messages.
Posted by: b on April 5, 2003 10:52 AMTnx, for the info.
Really helpful, spams were driving me crazy, with "ORLANDO FLORIDA TIKET NUMBER 9090".
Keys:
Ticket 9090
Spam
Messenger
Unauthorized Subscription
tnx again
Regards Felipe.
j ai recu un message de vous mais je ne peut le lire car je suis francais
pourriez vous me l ecrire en francais
par avnace merci
j ai recu un message de vous mais je ne peut le lire car je suis francais
pourriez vous me l ecrire en francais
par avnace merci
Can anyone help to translate the above comment to English? I cannot understand the language - actually have no idea about which language it is.
Posted by: Jian Shuo Wang on April 8, 2003 8:42 PMHe got a message from someone but he couldn's read it, because he's from France. And he asks, if the person can translate it into his language.
Posted by: Sascha on April 8, 2003 11:59 PMREceived from AOL Today. How to disable these offensive messages: Give it a try.
Message:
Hi,
I am sorry to hear about this issue.
To be able for you to disable or get rid of this pop-up service, please follow the steps below on how to do this.
What are they?
The popups are a new form of spam sent from outsiders accessing your computer via the Windows Messenger Service. Messenger is loaded by default upon startup of Windows XP, 2000 or NT and must be manually installed on Windows 95 and 98.
Microsoft has been using this tool for years to send message between its clients and servers if problems should occur. Now spammers have found this to be a new spam tool for automatically sending untraceable spam.
Below are the complete steps on how to disable this pop-up message.
Click Start and then select Control Panel. Click Performance and Maintenance. Click Administrative Tools. Then double click Services Scroll down and highlight "Messenger". Right-click the highlighted line and choose Properties. Click the STOP button. Select Disable or Manual in the Startup Type scroll bar and click on OK.
I appreciate your patience regarding this matter.
Posted by: Hazel on April 9, 2003 10:54 PMThanx for the wonderful info! It has worked without any problems at all. It is these spammers that make web surfing a bad experience! Once again,Thank you!
Posted by: Rick on April 13, 2003 10:51 AMThx men, lol i got spammed for like 2 months, i did not know what to do till now, the problem is solved i think.
Posted by: Danny on April 21, 2003 3:25 AMNice that it helped you. Actually, a very simple step can help a lot of people - but how can I get this kind of message across and help them? Maybe the help can only be limited
Posted by: Jian Shuo Wang on April 25, 2003 12:06 AMIf computers are connected each other and i want to send cmd.exe message, how can i send message to all computers ? and spesific computers like 2 or 3 computers?
Posted by: Its not my name on April 25, 2003 9:42 PMUse "NET HELP SEND" for options NET SEND has to offer.
Posted by: Jian Shuo Wang on April 26, 2003 11:41 AMThanks for taking the time to make this site, those popups were really starting drive me mad... heh
Posted by: Lee Paton on June 8, 2003 10:30 PMI have developed a program that kills all of these.... You just need to goto the site and download :D
Posted by: travis949 on June 9, 2003 2:32 PMJust wanted to say thank you Jian, the pop-ups (which had been coming in at about one every minute) stopped right away when I followed your instructions...and it only took a minute to do. Woohoooo!
Posted by: Sean Dolan on June 9, 2003 3:30 PMHELP!!!
Over which Port are the messages (net send) are sended?
I have a Router and i cannot send messages to a friend of mine above the internet!
Before i had the router i could send it!
I think i only have to forward this port!
but which is it?
plz help me!
P.S. I dont want to spam with Net send!!
Its only for privat chat!!!!
thx, Abendmond
Posted by: Abendmond on June 22, 2003 5:51 AMyea i got a question for anyone that can answer. Is it possible to stop net sends without accessing the cmd program. I belong to a school with a computer network and we are blocked from manually accessing anything on the hard drive so i can not access cmd files. i can however create batch files so i was wondering if there was a way to do it through that. anyone?
Posted by: geoff on July 2, 2003 9:25 AMThe NET SEND commend does not use TCP port. It uses UDP port. It uses more than on port. Check http://www.chebucto.ns.ca/~rakerman/trojan-port-table.html for more information.
Posted by: Jian Shuo Wang on July 2, 2003 11:28 AMthanks so much! i have been recieving these annoying ads for about 2 months now and i was so frustrated when playing games, or talking or anything....they popped up like every 5 mins, literally....i thought it was a virus that wouldnt go away. i am soooooo happy i found this site, i could hug and kiss you! i really appreciate it, i feel like a new person again. surfing the web was getting to be a chore instead of fun because i was always so busy clicking ok to these stupid ads that popped up. thanks once again!
Posted by: shaun on July 21, 2003 11:37 PMNET SEND uses UDP port 135 to request a message. Then, 3007 / 3008 or various other ports are used to send the real Datagram.
Posted by: Willem on July 23, 2003 2:46 AMI just did a Google search on "Endads" since I was having the same problem most of the others were having. I had reported their site to aol and had tried removing files from my system folder-- Needless to say, your site appeared in my search---Thanks for the info.
p.s. I sent a link to your site to aol and asked them to check it out and make it known to other members.
Yes. Feel free to distribute the URL of this page to your friends to help more people to get out of the NET SEND SPAM nightmare.
Posted by: Jian Shuo Wang on July 23, 2003 2:14 PMYo i just reinstalled xp and heard bout the net send it tried the example on this webpage in bat ran it and .... nothing happend and i just installed xp!!!!! i don't know why everybody has this problem a friend of me has it on windows me but i don't have any shittin
Posted by: DODENNIS on July 24, 2003 9:39 PMthanks 4 info pop-ups constantly coming and annoying me hopefully this will end them. Spike
Posted by: spike on July 26, 2003 6:51 PMThanks for the tip hopefully I will be free of endads from now on.
Evelyne
I was just thinking, why not write a program that resides on the net send/net bios port, and once it detects an incoming, it sends hundreds of thousands of net spam messages back at the fastest possible rate. Have enough people with cables and dsl's and you could really put a major blow down.
Posted by: Dan on August 1, 2003 12:56 PMok..to end the spam it is really really easy to do, at least if you have windows xp. if you do, go to control panel, administrative tasks,then component service. scroll down to where it says messenger. double click on it and set it to disabled, and click the stop service button. this will disable the spam.
Posted by: anonomous on August 9, 2003 12:31 PMThanks for your info.
Net send spam makes me oh so angry. No more net send spam for me now, muhahahah!
Cheers!
Josh
u ppl r a godsend!!!
thank you for ur info, MAN did that pop get annoying wen ur in a cs game and it kiks u out to close it, and by the time u go back in ,uve lost your sound >.<
thanks to u all for your info and keep up the good work stopping thies jerkoffs~
- Tan
Posted by: Tan on August 14, 2003 11:41 AMWhere do I put this NetSendSpam.bat file? I would like to try it out.
Thanks,
D
Well. As long as you don't send out spam like this, I can tell you that you can put it into any directory and run NetSendSpam.bat from the directory - or just click it in Windows Explorer to run it.
Posted by: Jian Shuo Wang on August 20, 2003 3:11 PMthe info on how 2 stop messenger service helped me sooooo much, but there is one last thing i need help with.i have norton antivirus and its just like messenger service!!it wont stop popping up!!can u stop the norton antivirus popups without hurting norton antivirus or anything??thanks again for messenger service info.
Posted by: MKB on August 30, 2003 8:20 AMis it true that with the net command, you can remotely run net commands on other computers on the same netowrk?
Posted by: Miroku-sama on October 10, 2003 9:01 AMgreat help!!! thnx
rather than terminate the service, is it possible to find out the sender's IP or identification on a intranet?
i'm an IT technician at a school, some boys have been messing around with net send command which could be very annoying.
pls help, thnx again
brian
Posted by: brian on October 19, 2003 6:22 AMcan you stop sending me the popup spam that is advertising for this site, these are the only spam messages we find annoying. Thank you.
Posted by: steve on October 19, 2003 8:11 AMWell. Steve, you are the (maybe) 100 people who are too angry to read the article clearly before complaining.
Posted by: Jian Shuo Wang on October 19, 2003 11:54 AMThank youu fur posting theese message. Peeeple like youu are a godsend, yes? Youu protect our cheeldren, our future.... A nd don't forget to geet de lastest google toolbar that stops many popups.
I'll be baaack.
Arnold S.
Caleeforia governa
hey , i hav a serious problem ...
i use a corporate computer.
I want to stop this net send spam some times. but when i open services.msc, right click on "messenger" and stop it says "error 5 access denied"
does it have something to do with my user account privileges? being in a company idont have administrator privileges.
is there any possible bypass to this?
anyone.....?
You should not be the administrator of the computer. So you cannot do it. Ask your computer adimistrators to do it.
Posted by: Jian Shuo Wang on November 25, 2003 9:46 PMhi^^
i have a problem
i am using a linksys router,
but i can't net send to any computer
i am sure that all my computers are in the same workgroup
and i didn't turn off the net send service.
can help?
thanks a million!
Peterhuh, I am afraid I am not able to answer too technical questions here. I suggest you to ask at http://www.experts-exchange.com/
Posted by: Jian Shuo Wang on February 1, 2004 12:50 PMOn mike's question if you can't use Administrativer tools but can apply registry into your computer and using XP then create a file "anything".reg.
and inside the file paste this in:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Messenger]
"Start"=dword:00000004
This will disable messenger when you reboot your computer.
Posted by: James on February 20, 2004 8:57 PMExcellent tip, specially for some of us with kids using the computer all day.
Thanks.
If you simply go to run and type in teh console
net stop messenger
it will stop your messenger its far easier then what is stated above just thought i could help a lil bit!! :)
Posted by: bill on March 3, 2004 3:00 AMTwo things: 1) this won't affect you if you get a Mac (I know, flame bait, just ignore it if you;-) ), but 2)here are a few Microsoft articles to consider:
http://support.microsoft.com/default.aspx?scid=kb;en-us;330904
http://support.microsoft.com/default.aspx?scid=kb;en-us;168893
The first addresses the specific issue of messenger spam. The second gives a little detail on NET SEND. Hope this helps.
Posted by: seanmcg on April 13, 2004 9:54 PMHere's one for you - I've just received over 4000 net send messages, easy batch routine I would guess. The problem - how can I close all of them at once? So far the only answer is to disable the service and then resart the machine.
Any help would be greatly appreciated.
Posted by: Jim on May 28, 2004 1:14 AM2 those who don't like executing this on every system load:
create a *.bat file with
net stop messenger
string & put it into autoload.
btw, there IS a way to ban spamer's IP without stoping the whole messenger but I don't know it ... :(
Posted by: Glider on June 18, 2004 2:14 PMto ban spamer's IP : use a firewall and enter the undesired IP in the ban list.
but there is a lot of IP to ban ... good luck
Posted by: tarokhan on July 16, 2004 10:26 PMIf you want to spam on LAN, then do this.
Make a new textdocument, then write
net send * hello
%0
then save it as hello.bat!
Enjoy ^^
Posted by: Johan on October 10, 2004 9:32 PMi wanna know how come msn messenger 6.1 will not work for me on my computer? it wont let me get 7.0 so i can only use 6.1 but it says i have to get 7.0 or i wont be able to use msn messenger! and i dont know why can someone plz help me
Posted by: kayla on February 18, 2005 5:33 AMhow do you flood people using net send if any one knows could you please send it to me at benjamin_deal@hotmail.com.au
Posted by: Benjamin on March 23, 2005 2:41 PMhi im at school and there are some realy anoying people that are sending net messages and i wanted to know how to stop net messages but i cand change settings on the computer because it says access denied eg cmd net stop messenger it dont work is there anouther way.
Posted by: Shane on June 8, 2005 11:41 AMSir,
i would like to know how would i block the specific pc on my lan from sending me the
net send messages, whereas i would like to have other pcs allowed for sending me the message.
in short, i mean is it possible to block particular ip on LAN from sending net send.
Posted by: Drumil on October 25, 2005 7:26 PMhi i was wondering how to send messages to other computers in a computer lab using "run" from the start menu on windows. i know to type CMD then enter. then when it gets to the black screen. what do i type..isnt it net send _____
thanks
Posted by: marco on August 6, 2006 8:26 AMGreat this solution,
I had an annoying message popping up for "registrycleanerxp.com"
with messages like "ALERT from system to windows" and bullshit like that.
Jeezes Christ, windows is a really leaking junk, if it allows annonymous people sending pop-ups on desktops around the world !!
Thanx a lot for your posting
Posted by: heetie on May 11, 2007 8:36 PMhi,
Can anybody help me regarding following thing?
I use net send in my office..Now I want to block a particular IP in my machine who will not able to send me any messages.But others will able to...is it possible? Please reply.
how do i prevent my website from sending spam mail to his customers.
instead of the mail going to my clients inbox, it goes to spam inbox. how do i manage this.
Posted by: etukudo on August 23, 2008 10:31 AM