security bulletin patch/scam?

Jeff Strouse · Post by **Jeff Strouse** » 29 Feb 2004 12:54 pm

Lately, I've been getting a pop-up of what 'appears to be' an official microsoft security bulletin MS03-043, telling me my system is at risk for a "Buffer Overrun in Messenger Service Could Allow Code Execution". When I click OK, it directs me to this website http://www.windows-patch.info/ that wants to charge me $20 bucks to download this patch.

Is this a scam?

b0b · Post by **b0b** » 29 Feb 2004 4:14 pm

Yep. Use Microsoft's "Windows Update" service. It's free and it traps all known buffer overruns.

------------------
<img align=left src="http://picturehost.net/b0b/ManzBob2.jpg" border="0"><small> Bobby Lee</small>
-b0b- <small> quasar@b0b.com </small>
System Administrator

David Cobb · Post by **David Cobb** » 29 Feb 2004 5:20 pm

There is a scam running around, it looks much like an authentic Microsoft patch, but it's infected with a virus or trojan.
Go to Microsoft if you need a patch rather than downloading something sent to you by email.

Jeff Strouse · Post by **Jeff Strouse** » 29 Feb 2004 9:24 pm

Thanks guys, I'm downloading updates as we speak. How would I get rid of that official looking pop-up (looks like it's part of Windows) that keeps prompting me to buy the phoney patch? I ran SpyBot and Norton Anti Virus, but I'm still getting the pop-up. Is this a form of hijacking (which I have been a victim of before)?

Which brings me to another topic...What can one do for protection against this kind of stuff? I'm using the Windows built in firewall, Norton Anit-Virus Prof Edt, and "Stop-the-pop". Is there a program out there which will protect me from all kinds of potential comnputer threats, without causing it's own form of user limitations in the system?

Jeff Agnew · Post by **Jeff Agnew** » 1 Mar 2004 4:14 am

It's because you're running the Messenger service (not MSN Messenger, BTW). Turn it off. Unless you're on a corporate LAN you have no need for this MS "feature".

The scam company found you by doing a simple port scan of your address block, which showed the open port.

You didn't specify which OS you're using but here's how to disable Messenger in XP.

Jeff Strouse · Post by **Jeff Strouse** » 2 Mar 2004 4:56 pm

Thanks for all the great info, guys!