Re: A new bug in csrss.exe ??

From: Dmitry Streblechenko (dmitry@dimastr.com)
Date: 11/14/02 

From: "Dmitry Streblechenko" <dmitry@dimastr.com>
Date: Thu, 14 Nov 2002 15:35:39 -0700

Messenger service has nothing to do with the Messanger the application. If you
don't need the messenger service, go to Service in Control Panel, stop the
Windows Messenger service and set its startup type to manual.

Dmitry Streblechenko (MVP)
http://www.dimastr.com/
OutlookSpy - Outlook, CDO
and MAPI Developer Tool

"H. Debs" <no@spam.com> wrote in message news:ubtJjXCjCHA.1804@tkmsftngp12...
> This is the 3rd or 4th time I see a dialog box pop up on my Win2000 SP3
> system, with an ADVERTISEMENT! Looking at the Task Manager, I discover that
> the thread responsible for this new process is csrss.exe. The window title
> and process are called "Messenger service" or something similar, and the
> text in this dialog box window is a well known SPAM advertisement for
> "University Diplomas" which I'm sure everyone has received by email at some
> point, especially if they have a hotmail account.
>
> This is *not* a regular IE popup. The dialog box has the regular close [X]
> button, and an "OK" button only. No icons. I think I was always connected to
> the internet when I got this message (about 4 times in the past month).
>
> I have up to date versions of Norton Antivirus 2002 and ZoneAlarm Pro
> running, configured for maximum security. I also frequently update and run
> AdAware and I'm positive there's no Spyware nor virus on my system.
>
> I read a bit about csrss.exe and it appears to handle text displays in
> consoles (dos boxes), so how can this dialog box be related to it?
>
> Regarding the window title "Messenger service", I never have the windows
> Messenger application running (removed it from the startup programs a long
> time ago), and do not have any account with Messenger, and never even set it
> up or used it.
> But I do have a hotmail account. However, I'm not logged into my hotmail
> account when this occurs, nor is Outlook Express running at the time this
> happens (I've configured it to fetch my hotmail email), so I shouldn't be
> logged in. So can this be a Microsoft Messenger abuse or vulnerability? Or
> just a ruse?
>
> Anyone seen this problem before, or knows how I can kill it?
>
>