Posted 6:46 AM by Jian Shuo

SPAM IS A BIG HEADACHE FOR EVERY ONE ON THE NET.

"The activities of a small number of people are becoming a bigger problem for the Internet." via Fight Spam on the Internet

Recently, I found another form of spam, which is becoming more and more popular: NET SEND SPAM.

What is NET SEND SPAM?

It works this way: on any networked Windows computer, anyone can type the following command in command line window:

NET SEND 127.0.0.1 Hello

A message box will appear with the greeting word "Hello". Looks interesting, isn¡¯t it? However, if you change the IP address to any other valid IP address and change Hello to your advertisement, the IP address owner will receive it. Moreover, a simple script can send the same message to thousands of IP addresses, or millions of, if the sender wants.

Still sounds interesting? Not at all! I don't want this to inspire anyone to do it. Never do it and never give it a try. I am the angry person here who is fighting back with this kind of spam - NET SEND SPAM.

Net send spam under spotlight

Now Mr. Yan, who owns http://bestyan.vip.sina.com has come on board of the Net Send Spammers. Every two or three days, this guy will send Windows message to my networked computer in my home. I may be working or reading news or composing a weblog - no matter what I am doing - chances are, a gray dialog box pops up and says:

Message from ZMZ to 211.161.107.*** on 2002-9-22 23:28:40

XXXXXXXXXXXXXXXXX http://bestyan.vip.sina.com XXXXXXXX

(Note: XXXXX is garbage characters that I cannot read on my computer)

It is annoying. It made me angry after I received six of such messages. I am almost mad after I receive more than ten of such messages. However, Mr. Yan seems to be a very good evangelist for his web site and does not care too much about my feelings. Later, I found he does not care about the feels of thousands of people. Keep reading to know how many people were affected...

Finally, after six invitations, I decided to visit this web site.

Visit the site

It is a normal personal web page. The owner seems to be fond of poems. It lets me feel not THAT bad since it is not a commercial site.

This guy has a guestbook too. I checked it, and found there are some one already yelling there for the spam they received. Some people said:

Please stop prompting your site using this kind of spam message

Some said:

I am in Korea. I cannot read the characters you sent to me, but I can see the web site address. I am feeling angry since you sent this message to me

I also posted a long message (half screen long? Maybe) to describe the feeling when I receive this message and asked him not to do that. In my post, I also quoted Mark Bernstein's suggestions on bloggers:

Though you write with passion about things that matter greatly, always remember that it¡¯s a big world, filled with people and stories. Don¡¯t expect the world to stop and listen

It worked. Within five minutes, my post was deleted from the guestbook, along with other negative posts.

To be honest, I was really shocked when I see people doing this:creating a web site; send messages to thousands of people, millions of, maybe; force them to read; DELETE posts on his personal guestbook when he doesn't like.

I posted for the second time. This time, I added a note:

This message is deleted by our honored web owner, just as others who protests for his spam. I believe this message will be deleted again, just want those who saw this to know what happened.

What I expected is true. It is deleted within six hours.

Now, on bestyan's guest book, there are still 21 entries. I found the webmaster will delete anything negitive and leave those compliments. It is bad. Really bad.

I know I can stop any message like this by stop the Messenger service in my computer. But I'd like to be involved in further spam and see how it evolves and how bad it will be.

Would you suggest what we can do to fight against NET SEND SPAM? Write your comments here.

Update

• Stopping Net Send Spam Nov 7, 2002


• Fighting Back for NET SEND SPAM Nov 20, 2002

Windows needs to write a new toggle to the net messenger that only allows net send messages from others people on the network. That way, it can still be used for real networjk announcements/emergencies (network going down in 5 minutes, building on fire, etc) but not for spam. Just a thought. Something like "net messenger localonly"
Posted by: Robert Slater on November 6, 2002 12:54 AM

Brian McWilliams, a nice reporter at Wired.com has written an article called "Spam Masquerades as Admin Alerts" one month ago on "Net Send Spam".

On the private email discussion with him, he pointed me to a URL that blocks the Messenger Ad.

I checked the web site and don't want to pay for the money.

My reason is that it is OK for most people to turn the Messenger Service off without much problem. Corperate users may have been protected by firewall so they won't receive this kind of Ad. Even if the firewall is not well configured, to add a filter in firewall is much cheaper that to buy everyone the software. Those who are most affected are home users. They connect to Internet via broadband, DSL, dial-up. For them, the administrator won't send any message like "network going down in 5 minutes", "building on fire" to them. They don't use printer this way too. So simply turn off the Messenger service.

On Windows 2000 or XP, Start -> Run -> "Services.msc" -> Messenger -> Disable.

Let me know if any of you have better solutions.
Posted by: Jian Shuo Wang on November 6, 2002 09:39 AM

Not a better, per say, solution than Jian Shuo Wang's but another simple and free solution for home users to shut down the messenger service is to open a command prompt Start -> Run -> cmd.exe then type the following "net stop messenger" after which you'll see "messenger service is stopping".

To start it again for any reason open the command prompt again and type "net start messenger"

This is the equivalent of what Jian Shuo Wang's suggestion.

I have had alot of customers call me regarding the abuse of this feature hopefully MS fixes it soon, i like one of the ideas on this page, i think the messenger service should only have ever been for local network machines.
Posted by: Docslax on November 18, 2002 01:35 AM

Docslax,

Thanks for your information about the alternative way to disable Messenger service. I have added your comment into my steps on here
Posted by: Jian Shuo Wang on November 19, 2002 02:32 PM

OK, so this takes a few mins and probably only works on XP but it's a start.

On your dial up connection you have an internet connections firewall tab.

click this and block access to port 18 on both tcp and udp.

This will allow local admin alerts but block internet alerts.

No need to buy additional software just use what microsoft supplies.

Regards

Rich
Posted by: Rich Tolley on November 21, 2002 09:11 PM

Rich,

Good point. Enabling a firewall is definitely a good way to protect. I have addressed this in my later article here

It is interesting that you metioned port 18 for UDP and TCP. Would you please explain why we need to disable port 18? Based on my knowledge, the spam is using port 35, 37 and 39 instead of 18. Thanks for sharing.
Posted by: Jian Shuo Wang on November 22, 2002 10:17 AM

I have seen everything now. We have people that do not like eMail advertising and now they do not like a simple pop-up! Didn't they teach you in school to CLICK YOUR DELETE Key or that little x that is in the top right hand corner of the pop-up.

So, what do you do when you go to your mail-box outside of your home? Do you beat up the postman when he delivers a piece of junk mail or do you go to court because you received the latest sales flyer from Radio Shack or maybe you call ABC and NBC when your favorite movie is on TV and here comes a commercial. I think not! This whole Spam Issue makes me sick and you should be ashamed of yourself.

Let people advetise...there is nothing wrong with it...it is how you got your website on one of the top search engine pages....OH!, Maybe you forgot that!!!

Apparently you have way to much time on your hands to even think about putting others down for achieving more out of life.

It is simple....There are lot's of people on the Internet that are trying very hard to earn a secondary source of income while other people do absolutely nothing to help themselves to earn more money throughout the year.

If you are going to keep complaining about SPAM,

which NET SEND is NOT...DAHH!....at least have some common sense solutions to it all.

Please Remember to bring a SHOT-GUN with you the next time you are driving in a city and you see a sign on a building that is advertising that particular business and then take perfect aim and blow a whole in it. This way you can go to jail for a while and leave hard working people alone.

Get the point!

PS...How long will you leave this message on your board?
Posted by: Marketer on December 20, 2002 02:17 PM

Full text of my reply can be found here

Thanks to all who posted. I was being plauged by messanger service webpopup. Seeing these dialoge boxes pop-up from out of nowhere gave me quite a scare. I thought my PC had been pooched by some bad shareware. After reading through the posts I realized it was just some lammer and company invading my personal space.

Was wondering... If I have the IP of the lame-ass University who sent this out could I then Spam them back?
Posted by: InXS on December 23, 2002 11:10 PM

Hello "Net Send" Fans...LOL,

It seems as though the Host of this site: Jian Shuo Wang, seems to think that I was a maybe a bit brash in my PRO - Net Send Letter that was posted on December 20th.

Jian's Reply:

It is true that I, and most of us, accept commercial on TV. Although nobody turned on TV just for commercial, we can accept it since it is still reasonable for the advertiser to pay for the movie. We see the movie since someone paid. It is the same for junk mail in my mailbox - I mean post-mail box.

END COMMENT

Contrary to popular belief, the Program to run a Net-Send Advertising Campaign is expensive to purchase and it is even more expensive to purchase a campaign of this nature through a third party to let them send it out for you.

So, in comment to your thoughts. This is in fact PAID ADVERTISEMENT! The cost of the program, set-up time, ad-trackers, auto-responders, and ultimately the time factor and band-width the system uses. I could really go on for a while

on the subject of (who is paying for what) but I will be nice and refrain from getting political here.

Additional thoughts: When I turn on my computer and log in through Internet Explorer or Aol or Compuserve, I ALWAYS have to delete all of the pop-up ADS that screem across my screen the first 15 seconds of signing on. I am sure this also happens to you and millions of others each day.

Question? Do you send complaints and threats to those ISP companies or do you just accept it? The answer is that you accept it becuse it is now considered normal...just like TV Commercials, just like Junk Post-Office snail-mail Delivery, just like UGLY Bill Boards on the outside of a traditional Business.

We must all learn to recognize that the Internet is now becoming a Traditional Business and will be here till the end of time.

People griped about ads going to their eMail Boxes and now we have a new definition for the word "SPAM" instead of luncheon meat. We also have another called "UCE" or Unsolicited Commercial EMAIL. The GOVERNMENT has stepped in and said that EMAIL ADVERTISING is not a good thing. There is no standard of Law nor any common law over this subject. It is simply the bigger ISP's that are scaring the little program owners with threats of blocking their servers out.

It makes me laugh when somebody that lives in Califronia threatens to call the Law on somebody that lives in Cambodia or China. It is so ignorant to think that they would have a leg to stand on! Headlines: "Man in Califronia Brings Suit to Old Woman in Cambodia that send him an email selling her recipe for Chocolate Chip Cookies" Tell me this is not what is actually happening, it is true and it is truly funny to think about.

Come on people. This is not anything more than paid advertising, we just want a fair shake from the Internet Cooperate Giants that control the Internet with their HIGH - Out of our price range,

advertising prices.

Online advertising is getting very expensive and most of it makes claims that simply do not work at all.

The next time you receive a little pop-up window from one of the net-send users, please take a moment to check out what they have to offer and just consider it a commercial break from what-ever you are doing.

Also, there are a bunch of places on the Internet that you can download a tiny little program that will prevent you from ever receiving another ad of this nature again.

I hope that I was able to maybe shed some light on this subject and enable you to look through the eyes of an Online Marketer who earns just over $3,000 per month Online. This is my small income to support six children of which three are being adopted by my beautiful wife and myself.

Have a Blessed New Year!

POP-UP...LOL

Posted by: Marketer on December 27, 2002 11:45 AM