According to Microsoft MVP's, it does stop it. They claim, the pops are being sent by people who exploit the messenger service. The messenger service is used to send messages between users of a network, run event viewer, etc., on the XP system. The ICF, if set up, will prevent uninvited access through this service, by blocking the port to anyone that you have not specifically granted access to. If Poser needed access, and I knew the port settings, I could grant access by setting it up in ICF. Musicat if you have some specific experiences with this, I'd hope you would share them so I can pass on that information to the MVP's and get their take on it. The only "tweak" I'm aware of, is to "disable" the messenger service, but by doing so you lose some functionality you may need/want. My rule of thumb is to never disable any feature the OS may use to carry out it's functions. Doing so can sometimes carry undesired effects. Thanks for the Zone Alarm tip Wadus, I'll jot that down as a fallback approach. Do you use XP?