"The feature can be used to notify a user when a printer job fails," said Lawrence Baldwin, president of myNetWatchman.com, a company that monitors incidents on the Internet through a network of sensors set up by volunteers. "It was never the intention to let someone halfway across the world send messages that pop up on your screen."

DirectAdvertiser.com, a U.S.-based firm registered in Romania, has created an application that lets users send advertisements via the messenger channel to anyone whose computer is set up to receive messenger-service notes. The program costs $700 and has, in two months, already sold more than 200 copies, company founder Zoltan Kovacs said in an interview.

"You always get some people who don't like the product," Kovacs said, referring to the moderate amount of critical mail he has received. "But many more are interested in the product."

Kovacs stressed in the interview and on his Web site that the application is not for sending spam. However, a testimonial on the Web site says, "If you've been a bulk e-mailer like myself, you owe it to yourself to try DirectAdvertiser."

"This is just going to be a whole other delivery vehicle for spam," Baldwin said, adding that the fact the service is turned on by default is another indication that Windows security has a way to go. "But welcome to Microsoft," he said.