Kill The Messenger (Service)

Why the Messenger Service Still Poses a Risk

Most computer users focus on the applications they open: browsers, email clients, office suites. Behind the scenes, however, dozens of background programs - Windows services - run automatically. These services perform vital system tasks like printing, logging, and network communication. One of those services, the old Messenger Service, was designed for a very specific purpose: let a network administrator send a pop‑up warning to all logged‑in users. The message appears in a small window, but the user cannot reply. It is not an instant‑messaging platform.

Because the Messenger Service sits on top of the Windows network stack, it opens a listening socket on port 135, a well‑known RPC endpoint. A remote program can connect to that socket and instruct the service to display any text it wants. Spammers discovered that this could be abused to flood a user’s screen with unsolicited advertisements. Once a machine’s Messenger Service is reachable over the internet, a single line of code can force dozens of pop‑ups to appear whenever the user logs in or wakes from sleep. The pop‑ups are not linked to the current website; they appear regardless of what the user is doing.

In the early days of Windows, Microsoft enabled the service by default on every installation, assuming that the feature would only be used by corporate networks. That assumption was wrong. By the time Windows XP Service Pack 2 came out, Microsoft realized the risk and turned the Messenger Service off automatically. But for older operating systems - Windows 2000, NT, 95/98/Me - the service remained enabled until a user chose to disable it. Attackers can still find hundreds of thousands of vulnerable machines on the internet. A single compromised computer can act as a command‑and‑control point, sending spam messages to dozens of others in a botnet.

Firewalls play a key role in blocking the Messenger Service. Most firewall products, whether built into the OS or third‑party, block inbound traffic on port 135 by default. If you run a corporate firewall, the rule will prevent the service from receiving remote commands. If you’re using a personal firewall or a router that exposes the computer directly to the internet, you should explicitly block that port. Open the firewall configuration, locate the rule set for inbound TCP, and either delete or disable any entry that allows connections to port 135. Afterward, restart the computer to ensure the rule takes effect.

Users of Windows 2000 can disable the Messenger Service manually. Launch the Run dialog from the Start menu, type services.msc, and press Enter. The Services window will appear. Scroll to Messenger, right‑click it, and choose Properties. In the Properties dialog, click Stop to halt the service immediately. Then set the Startup type drop‑down to Disabled so it never starts again. Finally, click OK to apply the changes. This process is identical on Windows NT, though the Services snap‑in lives under Administrative Tools in the Control Panel.