- Messenger PLUS - kill it or keep it ?

[Moore]

hi again ;D ,

i have a small question about patchous messenger plus , sorry if this is the wrong section , but should it be removed from infected systems or not , as from the info i have seen it so far it installs lop spyware and its not recommended by a few highly respected people, e.g:
http://www.wilderssecurity.com/showthread.php?t=7487

but i see many people with it in their hijackthis logs and many times they are given the all clear , i have so far been advising infected people at my forums to get rid of it as i havent seen any clear indications that it is safe , although i wouldnt touch it ever myself , so i cant say for sure what its really like ..

i know some people that do like to use it and do not want to remove it :o , and i try not to give bad advice but im not perfect 8) :

ok heres something from one of our forum members Sahu, that blocked it using protowall :

{QUOTE-> The appearance of C2 Media folder containing setup.exe in my Program Files folder has bugged me for a little while. I didn't install anything with such a name, so I had no idea where it came from. My intention has been to look into it, but being so into other things (and considering it didn't seem to be doing anything), I hadn't quite got round to it. Well today (whilst busy doing nothing), Protowall flashed. I took a peek at the log.

2004/04/19 22:29:34 [<-] BLOCKED [!] - Destination is C2 Media Ltd HURRICANE-CE1076-331 (NET-66-220-17-0-1 (66.220.17.175) [protocol: TCP / destport: 80]

For a change, this one was easy. A simple search on Google, led me to THIS (http://www.doxdesk.com/parasite/lop.html)

{QUOTE-> Also bundled with software downloads from edonkey.com (note: the real 'eDonkey' software site is at edonkey2000.com), fake 'cracks' or key generators from software-piracy sites, and Patchou's MSN Messenger Plus. <-QUOTE}

So I immediately went to uninstall Patchou's MSN Messenger Plus Version 2. This doesn't immediately remove the program, as I discoverd, but in fact creates a .bat file in your user account temp folder, designed to run on next boot. I didn't bother waiting, and opened the .bat file in notepad. There it contained basic lines for the removal of Messenger Plus, but also lines for the removal of C2 Media. I'm sure you can guess I executed the bat file immediately. So thanks to Protowall for the block which pushed me to investigate and get rid of this trash.

And a warning to others. Even if you choose not to install 'supporting' executables during install of Messenger Plus, it's still going to be put on your system and still going to connect to the net! (Or at least, it will try to.) <-QUOTE}

so can someone please give me some more advice with this garbage ? ;D

thanks to anyone that replies.

[Pieter_Arntz]

Hi Moore,

If you want the easy way to get rid of all the spyware that came with MessengerPlus, then uninstalling it will remove everything that came with it.

The application itself is harmless though and that is why I ususally leave it alone. The problem with that recently seems to be, that upgrading the application will renew all the bundled spyware.

Regards,

Pieter

[Moore]

thanks Pieter. ;D

in your opinion would i be better to direct people to uninstall it completely , or just remove the spyware itself manually ?

and for those that intend to keep it installed but dont want the bundled spyware , would the only other option be blocking all C2 media ip adresses , [ as long as they have a firewall that is ] and avoid updates ? :-\

[Kryptonate]

Hi, I'm from the official Messenger Plus! support forum and I can assure you that Plus! does NOT contain any spyware or what so ever. It installs a searchbar in IE and changes your homepage. It does NOT install spyware or adware. If you want to get rid of the sponsorprogram (that was especially designed for Patchou, so it's not the sponsorprogram you can find on the sponsors homepage):
1. close down msn messenger completely (be sure the icon in your taskbar is gone)
2. go to Start
3. Run
4. type "control panel" (without the quotes)
5. go to Add/Remove Software
6. Double click on "Messenger Plus!2" and you'll get the option to uninstall it.
You'll get the question if you want to keep your preferences. You can answer "Yes" without a problem, this has nothing to do with the sponsorprogram.
7. Then you'll get a sponsorscreen asking you to fill in the code that's displayed (this is to be sure that a person is doing the uninstall and not a prorgram).
8. Press UNINSTALL
9. Follow the steps
10. Restart your computer

If you want Plus! back, let the setup work and choose "I refuse, do not install the sponsorprogram". Now you only get Plus! and no sponsors.

If you update trough Plus! you are asked again if you want to install the sponsorprogram.

[Pieter_Arntz]

Thank you Kryptonate,

Moore,

Does that answer your question?
The advise would be "Uninstall and then reinstall, but read the EULA this time" ;)

Regards,

Pieter

[Choli]

Hello, I'm aslo from the official Messenger Plus! forums. I want to add some thing to what Kryptonate said: Before uninstalling, you have to close all your opened Internet Explorer windows. This is very important for the sponsor being unsintalled properly.

For more info, read http://msgplus.mybboard.com/showthread.php?tid=21598 and feel free to come to our forums to ask for support.

Choli.

[Moore]

yes , thanks for the replies , im glad i asked . ;D

thanks for the link to the forum , it will come in handy im sure for all the people that are tricked into getting infected by the LOP.com garbage.

I was thinking of this excellent post below when I claimed it was carrying spyware.

if I an find the link I will post it too.. I think its from the spywareinfo newsletter.

{QUOTE-> Messenger Plus is MALWARE!

--------------------------------------------------------------------------------

Here's a news article from spywareinfo.com to prove it:

Messenger Plus Bundling Lop.com

Many of you may have heard of a program called Patchou's "Messenger Plus". I used it myself once, before I discovered Trillian. Similar to the many front end programs for Internet Explorer (Avant browser, MyIE2, etc), Messenger Plus adds a user interface to Microsoft's MSN Messenger that contains extra features.

Patchou has brought in C2Media as a sponsor and is now bundling their lop.com software into Messenger Plus. For those of you who have never heard of it, lop.com software is classified as a trojan by antivirus vendors and as a browser hijacker by antispyware vendors. You can find plenty of information about it by doing a Google search for lop.com. Just be warned - some of the language used by lop victims will melt your monitor.

No single parasite has caused as many support threads at our message boards as lop.com (although Xupiter comes close). Ad-aware, Spybot, and all other spyware removal programs target several older variants of lop.com. It now comes in a version that is nearly impossible to detect automatically. It uses randomly named files, randomly generated CLSID identifiers, and uses activex installation methods that let them update all of their installers at once.

Before this change, the number of lop.com complaints actually had gone down because it was so easy to remove and could even be blocked beforehand. Since C2Media introduced these new versions that mutate randomly, the number of infections has become larger than ever. The only sure way to be rid of it is to ask for help at the SWI support forums.

Patchou, the developer of Messenger Plus, has issued a statement regarding the complaints he's been receiving due to his new "sponsor". To all of the people who are saying that they won't use his program because of lop.com, he has this to say, "I don't want to be rude but if you boycot version 2.10.36, you're an idiot."

<sarcasm>
Rude? Well gee, what could possibly be "rude" about being called an "idiot" for refusing to install software that sets off trojan alarms in antivirus programs?
</sarcasm>

Whether it makes you an idiot or not, I strongly recommend that everyone stay as far away from Patchou's Messenger Plus as possible. If you have installed it already and now have lop.com's software all over your system, uninstalling Messenger Plus supposedly will also remove lop. If that doesn't work, then please read this FAQ and follow the instructions. We are very experienced at removing this thing and can easily walk you through it. <-QUOTE}


thanks to everyone for the help , i hate being confused , 8)

Messenger PLUS! should be avoided at all costs and is clearly a supporter of spyware with no care towards its victims.

[CookieRevised]

Hi there ;)

I'm also from the official Messenger Plus! support forum and I wanna add some things to the explaination of Kryptonate (hi kryptonate :P)... for maybe futur reference or so...

These are facts, no matter what (respected) people on other forums say:

1) The setup procedure involves the question if you wanna install the sponsor or not (see screenshot in Kryptonate's post). This screen will ALWAYS be shown, in any circumstance! And Plus will NOT install the sponsor if you selected "don't install sponsor"... It is programmed that way...

2) Of course the setupfile you download for Messenger Plus, does contain the setupfile of the sponsor. Some anti-adware programs will fall over this. But, like said in above point, this setupprogram won't run (heck it won't even unpack) if you select "don't install the sponsor".

3) Also, when you choose to update Messenger Plus!, it downloads the same update just like you would download. It is exactly the same file! There is no seperate "update"-file. After this is downloaded, this file is started. There is no difference between updating thru Plus! and downloading and running the setup yourself. This means again that the sponsor agreement will be shown.

4) The sponsor IS adware and IS from the company LOP. Most people and anti-adware/spyware programs know this company. The only thing they forget (and what is badly programmed into the anti-adware/spyware tools) is that the sponsorprogram from Messenger Plus is a package especially made for Messenger Plus. It doesn't contain any spyware (which is a huge difference with adware btw) and the only thing it contains is a searchbar and adware popups. These popups will not contain any adult-material (again a request from Patchou) because Messenger Plus is of course also used by underage people.

5) Some anti-virus programs (like AVG) trigger a virus warning if they find this sponsor. Of course, needless to say that those routines for checking virusses in those programs are very dodgy, triggering a virus warning for a very reduced adware.... dodgy if you ask me...

6) People do complain that the sponsor agreement looks like an EULA. Well, two things. First, the sponsor agreement IS an agreement, just like an EULA. Furthermore, there are no options checked by default...
Second, even if it was an EULA, an EULA is meant to be read before you install software (even if it is just the title and the first few lines). It is a very bad habbit of those complaining people that they don't read the things they supposed to be reading. So the screen isn't dodgy at all.

7) Removing the sponsor with tools like ad-aware is a bad idea. In fact, tools like ad-aware mess many things up, not only in Messenger Plus!, but for other (adware) programs also. It is the logical way to remove a sponsor by uninstalling the software. Ad-aware, Spybot S&D, etc... aren't the holy grale ;) They are usefull tools, if you use them usefull...

8) People also complain that uninstalling Messenger Plus! doesn't remove the sponsor. They forget that they first destroyed the uninstall procedure with such tools as ad-aware... And even if they didn't used tools like ad-aware, they still say it doesn't work. Well, you need to follow instructions of course. One of those instructions are: "close your browser before you continue" and many people blundly ignore this eventhough it is a logical step, as the toolbar in your browser can't be deleted when it is running.



* So, to conclude, if you don't want the optional adware sponsor, answer "don't agree" in the Sponsor Agreement.
* If you accidently installed the sponsor and want to remove it, then uninstall Messenger Plus! again and follow the instructions. (you can then install Plus! again without the sponsor if you like of course).
* If you did try to remove the sponsor with tools like ad-aware, then you need to fix the uninstaller again. Do this by installing Plus! again WITH the sponsor. After this you can uninstall Plus! again to completely remove the sponsor from your system.

(ofcourse installing and uninstalling means following the instructions and doing everything like you logicaly would (closing the programs first, using add/remove programs, rebooting, etc...))


I hope this helps ;)

[CookieRevised]

Small note on that report "Messenger Plus is malware".

The person who wrote that didn't schecked his sources and didn't bother to search and state the facts. He twisted everything around so he could make his point. For example the quote from Patchou "blah blah... you're an idiot" is taken totaly out of context. On the official Plus forums there was a thread about this post long ago. And also with the links from where this quote was taken from. It was very quickly clear that this person simply didn't wanna state true facts and deliberty (damn my english :p) twisted the truth to get his point across...

[nadirah]

Please DO NOT download messenger plus. Stop downloading anything from patchou. Patchou is a bad guy who supports spyware.You won't get away with your crime , <snipped- Pieter> patchou.

[Kryptonate]

{QUOTE-> Please DO NOT download messenger plus. Stop downloading anything from patchou. Patchou is a bad guy who supports spyware.You won't get away with your crime , <snipped- Pieter> patchou. <-QUOTE}
have you actually READ all the above posts? Cookie, Choli and me use Plus! for over a long time now and we never had any problems what so ever with the sponsorprogram. Millions of people are using this software, so if it indeed had spyware or whatsoever no one would use it. Think before you say something, especially if it's not true.

btw: hi Cookie ;D

[Moore]

I think the only option is to kill it. you cant trust them one bit. :lurking:

http://www.spywarewarrior.com/viewtopic.php?t=2413

[CookieRevised]

Moore, you really didn't understand 1 bit what we have posted didn't you?

I'm atm not in the mood to reply on each thing posted there. But about the first things I do gonna reply:

{QUOTE-> Also installs Ad Intelligence
http://www.msgpluszone.com/forums/misc.php?action=help&hid=10 <-QUOTE}1) That website has no affiliances with msgplus
2) What exactly installs Ad Intelligence?????? There is nothing there that has anything to do with "Ad Intelligence"....

{QUOTE-> msgpluszone.com:66.98.252.17 (Support forum for msgplus)
What really links them also is the ending of the EULA: For general support please email support@lop.com. For comments or concerns about a website that is promoting this software please email affiliates@wrn.net with all pertinent information <-QUOTE}1) Again, msgpluszone is NOT the official support forum (although it sits on the same server... so what?)
2) That EULA is NOT from msgpluszone and has NOTHING to do with it

{QUOTE-> Additional Reading:
http://www.geeknewz.com/board/index.php?showtopic=1413 <-QUOTE}That whole threads is handled in our above posts...

{QUOTE-> BTW: have you heard of whistle software? so far that baby is transmitting more than my Transponder offeroptimizer does. They even make you enter your email and zip to install because it is a socalled weather type software. Been seeing my fake email being sent to 3rd party ad servers during transmissions to day. <-QUOTE}That's even more "BS"... I don't know what this guy has been smoking, but filling in your email and zip to install???? Is he even talking about Plus! and the sponsor????? Apparently he thinks he is though....

etc... etc...


Also, Moore... What is this all about on http://forums.maddoktor2.com/index.php?showtopic=505:
{QUOTE-> I was seeking further information on this program , while helping my forum members clear out their hijacks and the forum moderators of Messenger Plus swooped on this post of mine at Wilders.org and they claimed the sponsor program was easily avoidable: <-QUOTE}We not only claimed it, IT IS SO....

{QUOTE-> Still they get hundreds of complaints a week according to Patchou <-QUOTE}hundreds? where did that come from? tbh, we get 1,5 complaints every week out of the thousands that install Plus! every week. And that is are true figures. And "according to Patchou"???? Where on earth did he say that?

And then you dare to accuse Patchou for telling lies and doing devious things and such???? People like you, Moore (and the so called "expert" webhelper), should learn first a bit more about computers, adware, spyware, etc. Or at least first install some "mailicious" software and test it, before telling things about it....

[Bubba]

Hey CookieRevised,

I'm sure it goes without saying....that anytime C2Media or Lop.com is mentioned....those of us that have spent many hours helping victims clean up there PC's kind of cringe.

The argument that...."although many people know LOP.com as an agressive 'spyware' company, the package that comes bundled with Messenger Plus! is nothing like that"....makes me about as warm and fuzzy as someone saying....'Oh, this version of CoolWebSearch only changes your Homepage to about:blank'

While I understand the need to make a living....individuals like Patchou must understand they are part of the problem not part of the solution. I mean....just because it only shows a "very small piece of adware"....what's to say C2Media want come back to Patchou and ask for more ?

[CookieRevised]

Ah, glad to someone with decent questions, concearns and remarks ;)

{QUOTE-> I'm sure it goes without saying....that anytime C2Media or Lop.com is mentioned....those of us that have spent many hours helping victims clean up there PC's kind of cringe. <-QUOTE}yes, true. And I'm one of them (maybe you don't believe it, but I truly am). I still cringe whenever C2Media or Lop.com is mentioned or installed on my PC. But as I also know that the package that comes with plus! can't be compared with the normal well known stuff, I have nothing against the one that comes with Plus!

{QUOTE-> The argument that...."although many people know LOP.com as an agressive 'spyware' company, the package that comes bundled with Messenger Plus! is nothing like that"....makes me about as warm and fuzzy as someone saying....'Oh, this version of CoolWebSearch only changes your Homepage to about:blank' <-QUOTE}I understand, (so does Patchou and anyone else of the Plus! community btw). I had to find it out myself before I believed it. And I can assure you that it is nothing like the true spyware stuff that Lop is associated with. Although, that some things in the sponsor are still a bit dodgy (the namechanging for example) it is very very harmless and can be uninstalled very easly (unlike his spyware big brothers from Lop).

But, don't take my word for it though. Try it out yourself on a secured test-machine. Install Plus! with the sponsor (monitor the activities if you like) and then unsinstall plus!. You'll see that it will be that easy to remove ;)

{QUOTE-> While I understand the need to make a living....individuals like Patchou must understand they are part of the problem not part of the solution. <-QUOTE}He never claims to be part of the solution. Far from it. The moment he finds another company which offers the same deal (money vs. light adware package) or he finds another way of a steady income, he will be the first to change it. Because he also knows the problems and bad rep that it has.

Also, during the years, he made everything possible to make the user clear that the user can opt out of the sponsor very easly.

He's not the devil that everybody makes of him you know ;) In fact he's a very normal human being like you and me...

{QUOTE-> I mean....just because it only shows a "very small piece of adware"....what's to say C2Media want come back to Patchou and ask for more ? <-QUOTE}True. And they did try. But Patchou refused every time. He is very strict when it comes to "his" sponsor and in those matters. This again only shows that he does care I think...

Also, it is true that people will find still some issues with the sponsor. But that's why it is optional. And not like in so many other software products bundled within and even hidden. And it strikes me also that there is so much fuzz about something you can easly opt out to, while nobody talks about all the other softwares that come with truely hidden adware/spyware.

He and msgplus is almost the king-devil of spyware itself, if you read some stuff. Well, I guess if you are very open to your userbase (which is btw more then 5 million msn users) and are always open for suggestions, always updating things, let the user choose to "support" him or not, etc.... , that you are not welcome in this computerworld of today.....

[Hans 01]

{QUOTE-> .

Thanks, is this why my default page insists on going to M$ ?
If so, perhaps you M$ people can tell me how to get rid of that. But please, in the simplest possible instructions for a novice.

/ H

[no13]

Get older version GET OLDER VERSION
junk the v3 and take v2 from any site (google it)

The new one installs some adware even when you tell it not to, and its features are too good to lose.

[CookieRevised]

{QUOTE-> {QUOTE-> .

Thanks, is this why my default page insists on going to M$ ?
If so, perhaps you M$ people can tell me how to get rid of that. But please, in the simplest possible instructions for a novice.

/ H <-QUOTE}
IF it is the sponsor from Messenger Plus! (there are thousands of other things that can change it), then simply uninstall Plus! and follow the instructions given on screen. (like closing every browserwindow, entering the number, etc...).

Also, Messenger Plus!, nor we, have anything to do with Microsoft.


{QUOTE-> Get older version GET OLDER VERSION
junk the v3 and take v2 from any site (google it)

The new one installs some adware even when you tell it not to, and its features are too good to lose. <-QUOTE}Oh please...
There is NOTHING changed in the sponsorsetup. If you choose "no, don't install the sponsor", then there is NOTHING installed...

IS IT THAT HARD TO UNDERSTAND?

Furthermore, there are some bugs in Messenger Plus! v2 itself. Also v2 lacks A LOT of features, etc...

So, don't post if you don't know about what you're talking about!

[no13]

{QUOTE->

Oh please...
There is NOTHING changed in the sponsorsetup. If you choose "no, don't install the sponsor", then there is NOTHING installed...

IS IT THAT HARD TO UNDERSTAND?

Furthermore, there are some bugs in Messenger Plus! v2 itself. Also v2 lacks A LOT of features, etc...

So, don't post if you don't know about what you're talking about! <-QUOTE}


Ok wise guy... Assuming u use MessPlusv3 installed "without" adware
go to c:\windows... find a *hidden* file called lbbho.dll and an obvious file called lbbho.inf......
Try to uninstall msg. plus... now look for the file again. BAMN. still there.
!Explain!


Edit : please take a few minutes of your *apparently* valuable time and visit : http://www.dtcc.edu/cs/rfc1855.html a good investment.

[dread]

BAMN I dont have them files did a search on whole harddrive and looked personally in c:\windows c:\windows\system c:\windows\system32. If you dont install sponser support Messenger Plus will not install anything. I like it and use thats why I have said something. I think they should remove the sponsor surport, but it does not install anything if you tell it not to install sponsor support.

[no13]

WARNING!!!!!!!!!!
the file <<msgplush.dll>> automatically binds itself to ALL OPEN PROGRAMS THAT ARE USING THE INTERNET.... why? I don't know...
maybe our dear CookieRevised can shed some light as to WHY on Earth is this file binding to all others.
<FLAME ON>
Stop hurling abuses at everyone... u even abused AVG antivirus and the intelligence of its programmers. Not a good idea, sir.
<FLAME OFF>

[no13]

{QUOTE-> BAMN I dont have them files did a search on whole harddrive and looked personally in c:\windows c:\windows\system c:\windows\system32. If you dont install sponser support Messenger Plus will not install anything. I like it and use thats why I have said something. I think they should remove the sponsor surport, but it does not install anything if you tell it not to install sponsor support. <-QUOTE}

C:\windows a hidden file here... lbbho.dll ... doesn't ever show up in searches and I think is marked as a *system* file... so you'll have to enable both "view hidden files" and "view protected OS files" from
Windows explorer > Tools > Folder Options > view
Also disable "hide extensions of known filetypes"
<<Note: exact option names are different>>

[dread]

I know this and have all of that enabled and search can find the files, its in under More advance options Search system folders and Search hidden files and folders I have dotted in folder options under view Show hiddent files and folders,hide extensions of known file types unchecked and Hide protected operating system files unchecked etc... I dont have them 2 files, messsenger plus does not install anything if you tell it not to install sponsor support. I can show screen shots if you like.Im not a computer newbie and know how to find and show them hidden and system etc... files

[no13]

pardon moi monsieur, did not mean to offend you. I just assumed you had not checked for *system* files (I 'd neglected to mention it earlier)
Maybe u didn't get that abominable file. But you MUST be noticing how msgplush.dll binds itself to all thise prog.s. (I used BlackICE, by the way)

[dread]

You didnt np. Sorry if came off like that. I was just saying. I do have that file (msgplush.dll) though in C:\Program Files\Messenger Plus! 3. I have no earthly idea what is for though. Maybe someone from Messenger Plus can say what that is for. But I say what I said in them other post. Messenger Plus will not install any spy/adware if you tell it not to install sponsor support. I have been using since version 2. I messed up one time and didnt read that part, maybe they should make that screen really really big, and got that crap on my computer. And every since then I have remembered to make sure I didnt install sponsor support and Messenger Plus has never ever gave me any spy/adware as long as told it not to install sponsor support.

[invisiblegnome]

i installed messenger plus a while back without looking at the installation guide and i messed up my pc with the sponsorship package but if you just click dont agree when it asks for you to install the sponsorship then messenger plus does not install any spyware whatsoever.

TIP : watch when you install it next time

[Bubba]

{QUOTE-> WARNING!!!!!!!!!!
the file <<msgplush.dll>> automatically binds itself to ALL OPEN PROGRAMS THAT ARE USING THE INTERNET.... why? I don't know... <-QUOTE}How deep your wanting to get will be determined by what it will take to make you feel all fuzzy and warm when it comes to msgplush.dll. I'll start by saying....that particular Dll uses the GlobalHook function and is used for it's auto-update feature. Now....if you have info you'd like to share of why you feel a WARNING needs to be issued for a function that is not uncommon....especially for third party software....Please share this info.

[no13]

Dear Mod
what I'm warning about is.... THE FILE ATTACHES ITSELF TO ALL AVAILABLE PROGRAMS.
Can anyone to explain why?
I used BlacICE and it went crazy with dialogs on EVERY single open program...from yahoo messenger to Genius to mozilla and for good measure... all three firewalls (which I'm running concurrently without any errors).

[Bubba]

Besides BlackICE....are you using anything else to determine that it...."ATTACHES ITSELF TO ALL AVAILABLE PROGRAMS" ?

I'll also use the word process instead of program in my description....since a process is what a dll attaches itself to.

I can understand your Firewalls monitoring your processes AND it's associated hooked modules. However....I defer on commenting about Genius or mozilla ....because I'm curious to know what your using to determine that those two programs are being GloballyHooked with msgplush.dll

Please understand....this is simply a discussion and a very good one at that. What I would like to happen is we discuss it with openness, intelligently....without personal attacks.

One of things you might want to check into is what GlobalHook(in this case MessengerPlusGlobalHook) or SetGlobalHook means....and why some modules attach themselves to a number of processes.
----------------------------------------------------------------------

For kicks and grins....attached is a list of all my running processes and those in bold have msgplush.dll hooked to them.

\SystemRoot\System32\smss.exe
csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\CA\eTrust\Antivirus\InoRpc.exe
C:\Program Files\CA\eTrust\Antivirus\InoRT.exe
C:\Program Files\CA\eTrust\Antivirus\InoTask.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\ZONELABS\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\CA\eTrust\Antivirus\realmon.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\wisptis.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
Spybot - Search && Destroy process list report, 9/29/ 11:26:53 AM

[no13]

BlckICE gives a message when you start a prog (or it starts up) and has a library/dll attached that wasn't there before. That's how I know. I also have Iarsn Taskinfo (but I'm feeling too lazy for a MsgPlus reinstall right now, I'll post within 24 hours).
But it DOES attach to all progs, b'coz even Yahoo messenger's been observed with the same BlackIce prompt.
[i'm sorry, i'm still calling these programs instead of processes... still stuck on DOS programming you know... It'll be 6 months before I can even think about network programming :)]
And i can see that your ZoneAlarm AND Explorer.EXE have been hooked...dunno if that's proper behaviour. :lurking:

Quicknote: is Explorer.EXE s'posed to be different from explorer.exe (black ice was giving message for "Explorer.EXE" ... screenshot when i went for
Run > "c:\windows")
Also, this message pops up when I'm about to launch a new app (methinks it's due to spybot resident... but I'm not sure)


Edit: About personal attacks, i don't mind polite jabs, but I agree... insulting someone's intelligence is really the stupidest thing possible, especially on a forum where ppl. come to get help. Which is partly why I quite like the recommendations of rfc 1855.

[Patchou]

Haaa... not this ridiculous post from sywareinfo again? I think you guys tend to amplify things a little too much.

First, let me start by sayign that if you're a proud user of something as powerful as BlackICE, you shouldn't even even post what youjsut posted. BlackICE is a useful tool only for peopelwho really knowwhat they're doing with it. It's because of that kind of post that some people get afgraid of installing my software, and for no erason, only because someone pretending to know everythign that's going on on his system with his 3 firewalls and two sysm monitoring agents claim that the actionsof Plus! are the actions of a spyware.

GlobalHooking is a technique that is provided by the Windows API since Windows 3.1 (at least). It's not something only used by spywares, it's used by many mouse/keyboard drivers, antivirus, etc, etc... GlboalHooking is just asking to Windows to be notified everytime a process tries to create a new window. Your DLL is then loaded in the process and you're free to do what you want in there. Any program using GlobalHooking that is done properly won't have any impact on your system... Messenger Plus! just gets the class name of the newly created window and checks if it belongs to Messenger. If so, then it initialises its stuff, if not, theprocess will never hear of Plus! again. However, Windows keep the DLL loaded inthe process for efficiency reasons, that's why you see it everywhere. And anyway, why would I care to voluntarly attach myself to every process in the system? not even adware programs would care to do this! do you really think that I've been building a list of every process everybody is running for the last 3 years? I don't knowhow you compiled your listof processes but if you just used a "normal" debugger such as Visual Studio, you would find that Plus! doesn't chose its processes, it just gets loaded by Windows everytime a process creates a window. If you don't believe me, just create a dialog-based program yourself, launch it, and check if your debugger.

I'd also like to point out that even people who dovery bad posts about my sponsor never claim that Plus! itself is a spyware. Before saying that kind ofthing, you should check the facts,and not claim that you found some mysterious non existing files on your system after installation, tried to trick the uninstaller or monitored every single bitof information going in and out of your system because if you did so, you wouldn't do such accusations.

As for the sponsor itself, it is true that it's not the kind of package you get with othersoftware like P2P programs. It changes your home page (you chagne change it back), displays a couple of popups and adds a search bar (a real one) to your IE. It's not exactly like installer some porn dialer, sending your personal files to giant servers and asking you if you want to look at free xxx previews while you're chating with your friends. More importantly, the sponsor can be uninstalled completely in a breeze. If you don't believe me, why don't you try using all your nice tools to check it out?

The internet would be a better place if it was not for all these people claiming things that never existed. A good example is the news post from spywareinfo.. you're still quoting it despite the fact that this is one of the most ridiculous thing I've ever seen. It doesn't quote me right and talk about me like if I was the child of the devil, only because I wanted to live my life continuing to develop my software. I don't even see that kind of posts for things like Kazaa (which installs 10 times what my sponsor installs, without a way to go back).

So, once again, try to think about the meaning of the data you collect before posting it on forums like this, and go take a look at the MSDN Library while you're at it. And sorry if this post sounded liek I was attacking you no13, I wasn't. I understand that you want toknow more about the problem but the thread started with flames and blind accusations. Now, everytime someone's gonna find this topic on your forum, he's just gonna read thefirst page, clsoe IE and unisntall Plus! without knowing the end of the story. That's how you get quotes out of context like in the spywareinfo post. I hope I'll have convinced you to at least take a new fresh look into the problem because really, the only thing Plus! does is add a couple of features in MSN Messenger. Anything related to advertisement is in the sponsor program and Plus! has no part whatsoever in it.

Peace,
Patchou

Edit: in order to avoid further discussion about wether or not Plus! is spying on your system I attached the full non-edited code of my global hook function. Feel free to match it with the assembly code in the DLL, this part of the software rarely changes anyway :).

[no13]

Mr. Patchou
You are entitled to your own opinion as I am to mine. I hold your work in the highest regards... Messenger Plus! does include a lot of features that make everyone's life easier.
But it does not become of you to insult people so brazenly. If you will note carefully, I have not said messenger plus was spyware... I merely would like to know WHY is it that msgplush.dll attaches/hooks itself to every available process that uses the network.
Also, I have yet to mention spywareinfo (a source trusted by many people)... you have implicitly assumed that I have "borrowed" material from that site.
If you will note carefully... I have also yet to claim expertise or even basic knowledge of network program.
As for Kazaa... there is no solution for kazaa that I know of... I found it to cause irreparable damage to my Kerio and BlackICE firewalls and I removed every trace of it.
Regards
no13.

[Patchou]

Hi no13,

as I said, it was nothing personal. The spywareinfo thing was posted by Moore at the beginning of the thread (and I can tell you that since they wrote this article a year ago, I have much less trust in anything else they publish).

Now,as for the global hook, I posted the code that should confirm my says to you :). Hooking has nothind to do with networking, actually, Plus! doesn't even creates a proxy for Messenger. There's no correlation between network access and Plus! being loaded. Youcan checkthe doc in the MSDN Library if you want. The DLLis simply loaded in every process that creates a window. Many network applications create hidden windows to manage their communications so I guess my DLLwill be loaded there too, but I'm not the one who choses in what process my DLL is loaded, Windows is the one.

I don't think I insulted you in any way in my last post. I'm just pointing out that you started your posts with big words in caps and references to files (like lbbho.dll) that I never heard about. This is hardly a way to open proper communication chanels to ask questions ;). And again, unfortunately, many people just look quickly in threads liks this one and all they'll get here is the impression that Plus! itself spies on your activities, that's why I'd prefer to get questions in the beginning of this kind of threads, not flames associated with suppositions.

Hope you understand my point,
Patchou

[no13]

No hard feelings m8.
Maybe I should reiterate that I'm a DOS programmer (a bad one at that)... what is gnawing at my soul is....
why is that particular file attaching itself? You say its windows' choice, but I haven't seen that in other apps... do you have other examples of this behaviour in other software (because a malicious programmer can easily use this, much like rpcss.

You should investigate that... otherwise, it may turn into a pretty bad situation (can't elaborate - I dunno ANY windows programming... sorry :) )

About lbbho.dll... well, I saw a correlation b/w your product and that file... maybe you should check by making a clean download off your site and installing messenger plus on a clean system (I've known instances where hackers deliberately touched only one file after intruding into a system... possibly your site may have come under attack - and your product would give any hacker mass reach)
As you may know from rfc 1855, capitalisation is equivalent of shouting... this file was very badly behaved (and I concede it could just easily have come from another source) and it was in the flow of the discussion - this file seemed to be installed with messenger plus v3 in spite of choosing NOT to install companion advertising programs.
So now you know why I did what I did back there. :)

[CookieRevised]

{QUOTE-> As you may know from rfc 1855, capitalisation is equivalent of shouting... <-QUOTE}only if the capitalisation is done for a whole sentence. Capitalising words has nothing todo with shouting, but with highlighting. Just like the use of bold or the underscore is:

eg.
* THIS IS SHOUTING AT YOU!!!!!!!!!
* This sentence isn't shouting at all, but only HIGHLIGHTS an important word.
* More _highlighting_ (but less obvious) can be done by the use of _underscores_.
* A very strong highlight would be the use of underlining or typing something in bold to catch the attention...


PS: and that is also why I didn't flame you in my posts, the capitalisations are not shouts, flames or whatever. Those are highlights of important words... ;)

[no13]

Jus' makin' a point, signor... { you did read RFC 1855, didn't you..}

[Patchou]

Na... really, I can assure you 100% that my software doesn't install this file, anything I install goes to the Messenger Plus! directory (except for the sponsor setup which goes to the C2Media directory).

As for global hooking, I assure you that this technique is used by many software, however, you find it generally more in things like drivers or antivirus. Again, I encourage you to check the MSDN Library about SetWindowsHookEx(), I'm using a CBT hook.

The DLL is loaded by Windows everytime a process creates a window, then it's up to my DLL todecide what to do and as you can see in my code, my DLL doesn't do anything if the process is not a Messenger one. I've been using this techniquefor more than 3 years in Plus! and I never got any security issue linked to it :).

[Moore]

Ok , glad to see you here Patchou to chat with us about this. :)

The thing that bothers me is why you would chose to damage your program by partnering with a dangerous spyware company like Lop in the first place , is the money really that good ?

If anyone doesnt know how the bad lop.com spyware garbage is , a quick google search will soon give you tons of pages of victims and spyware warnings to go through.

Perhaps you can comment on this as well Patchou.

Heres some information all potential messenger plus users should be made aware of dug up by the Webhelper , who does a great job warning us all about new spyware threats:


As I was going thru listings to generate a new file list, I found an enteresting thing about the messenger plus:

On the outside and the standard whois shows really nothing but it is the IP that gives them away.

msgplus.net:66.220.17.175, This is one of the NetRanges for C2Media aka lop.com.


{QUOTE-> MsgPlus lop com
Quebec
Quebec, Quebec H0H0H0
Canada
Registered through: GoDaddy.com
Domain Name: MSGPLUS.NET
Created on: 14-Dec-02
Expires on: 14-Dec-05
Last Updated on: 15-May-03
Administrative Contact:
P., Cyril cyrilpaciullo@hotmail.com
Domain servers in listed order:
NS1.RACKSHACK.NET
NS2.RACKSHACK.NET

IP:
msgplus.net:66.220.17.175
CustName: C2 Media Ltd
Address: P.O. Box 1113
City: Shalimar
StateProv: FL

C2Media NetRange: 66.220.17.0 - 66.220.17.255 <-QUOTE}

Also installs Ad Intelligence
http://www.msgpluszone.com/forums/misc.php?action=help&hid=10


{QUOTE-> Messenger Plus! comes with an optional sponsor program. Installing it will help keep your favorite MSN Messenger add-on alive. If you do not wish to support the developer, you are allowed to refuse and proceed without installing the sponsor. PLEASE READ THIS END USER LICENSE AGREEMENT AND PRIVACY POLICY CAREFULLY AND MAKE SURE YOU UNDERSTAND THEM. THIS IS A CONTRACT AND BY INDICATING YOUR ACCEPTANCE, YOU ACCEPT ALL THE TERMS AND CONDITIONS OF THIS END USER LICENSE AGREEMENT AND THE APPLICABLE PRIVACY POLICY AND WILL BE PERMITTED TO DOWNLOAD THE SOFTWARE. IF YOU DO NOT ACCEPT THE TERMS AND CONDITIONS OF THIS END USER LICENSE AGREEMENT AND THE PRIVACY POLICY, YOU WILL NOT BE PERMITTED TO DOWNLOAD THE SOFTWARE. End User License Agreement This End User License Agreement ("Agreement") governs use of C2 Media Ltd.'s ("C2") software product known as lop.com <-QUOTE}

msgpluszone.com:66.98.252.17 (Support forum for msgplus)
What really links them also is the ending of the EULA:

{QUOTE-> For general support please email support@lop.com. For comments or concerns about a website that is promoting this software please email affiliates@wrn.net with all pertinent information <-QUOTE}

wrn.net is the lop.com site for affiliate members.

Creators Profile:
http://msgplus.mybboard.com/member.php?action=profile&uid=10
patchou.com:66.98.198.21 (Creator of Msgplus)

So anyone who installs msgplus will get lopped!

Additional Reading:
http://www.geeknewz.com/board/index.php?showtopic=1413

{QUOTE-> For anyone who thinks that just because PACIULLO CYRIL the creator of MSPLUS is affiliated with lop.com in the install of their hijacking adware/malware, I got a hot flash for you all.

He is more than just using them as an affiliate, he is a legal corporate partner with lop.com.

THAT MEANS HE IS ALSO RESPONSIBLE FOR WHAT ALL THEY DO!

Secure Software Inc. when I last checked the Florida state corporation database listed only Alex Shamash and his parnter Jason Lucas But as of today it has a third partner listed.

Want to take a guess?

PACIULLO CYRIL

http://www.sunbiz.org/scripts/cordet.exe?a1=DETFIL&n1=P02000112500&n2=NAMFWD&n3=0000&n4=N&r1=&r2=&r3=&r4=SECURESOFTWARE&r5=

Officer/Director Detail

Name & Address Title

SHAMASH, ALEX
PO BOX 1113
SHALIMAR FL 32579 D

LUCAS, JASON
PO BOX 33O
SHALIMAR FL 32579 D

CYRIL, PACIULLO
105 PLACE DU COLLEGE #8
LONGUEUIL, QUEBEC 00 J4J-1-G3 CA D <-QUOTE}

I dont think I would go near any program that openly supports spyware , even if I did use MSN messenger , as that is like saying , "Hey its ok to hijack users computers"

.. but in the end people can always decide for themselves , as long as they dont forget not to install the sponsor program ..

An example of not selling out your users - We at Bluetack have been approached by various spyware companies to bundle their garbage into our programs , but we would never sell out our users and forum members in such a way.

In return our supporters keep us up and running month after month purely through their donations.

[nadirah]

Bottom line: Any program that attempts to install spyware, or have spyware bundled inside it, and the producer of the software is someone who supports/is a partner with any spyware company, the producer of the software MUST be held responsible for anything that goes wrong with the software.
Spyware can harm your computer, it can expose your privacy too. Your privacy is yours, not anybody else's.

I have tried Messenger Plus before, and believe me, in front of my very eyes, I found traces of C2 media LOP spyware on my computer installed by messenger plus. What's more, i had declined to have the spyware crap installed!
So, there's no denying the fact that messenger plus does install spyware on people's computers. Messenger Plus looks nice & good on the outside, but it looks like a piece of spyware garbage on the inside.

Messenger Plus- kill it or keep it? Kill it.

[Patchou]

Well, it's too bad to see the thread ending this way after all the good posts that were made recently. It seems that you have a lot of time on your hand to spend days searching for non-existent links between various independant things. You know, I could find you a lot of articles saying that the president of the United States is a clone, that aliens are controling the internet and that China never existed. It's not because you read it that it's true :).

C2Media (lop.com) is helping me host msgplus.net, I don't see how it could be bad. Also, of course we are business partners, I'm not a little hacker who wants to make a quick buck by installing some unwanted software on people's computers. Nevertheless, C2Media and myself are two distinctive companies, Messenger Plus! existed long before I started to bundle their package and that's the kind of thing you should verify before posting "you'll get lopped!". Just don't try to hard to find a conspiracy where there is none. Messenger Plus! is only a plugin for Messenger Plus!, not more, not less. As for the various sources you mention, most of them just try to justify their existence by making other's life miserable. At an objective point of view, C2Media (lop.com) is probably one of the best's adware company on the market today and that's exactly why I continue to do my business with them: because they can be trusted. The only thing that makes them looks bad is those tons of posts you find on the web: most of them are largely outdated and the others are just like your post: full of assumptions and quotes from other posts where the author did the same thing. Misinformation is probably much more available than real information nowadays on the internet and that's unfortunate.

It will probably be my last reply on this thread, everything that was interesting to say has already been said.

[Hollywood]

Sir. Your program "crashed my computer and I lost valuable documents that I had yet to back up." Paid tech big bucks for repairs. Computer was running fine after repairs but then my kids reinstalled messengerplus and problems began once again. Your lop.com spyware also conflicts with downloading the update "servicepack2." This causes computer crashes. You also do not provide user friendly fixes and links. You also use several different file names that are confusing when trying to delete your program. All of this is intentional as you do not want others to opt out as you lose money. Unless you wish to pay for my computer repairs, then I can't think of any reason as to why I, or anyone else, could recommend your program. Very dangerous and based on greed marketing.

[nadirah]

{QUOTE-> Sir. Your program "crashed my computer and I lost valuable documents that I had yet to back up." Paid tech big bucks for repairs. Computer was running fine after repairs but then my kids reinstalled messengerplus and problems began once again. Your lop.com spyware also conflicts with downloading the update "servicepack2." This causes computer crashes. You also do not provide user friendly fixes and links. You also use several different file names that are confusing when trying to delete your program. All of this is intentional as you do not want others to opt out as you lose money. Unless you wish to pay for my computer repairs, then I can't think of any reason as to why I, or anyone else, could recommend your program. Very dangerous and based on greed marketing. <-QUOTE}

Come on, ignore patchou and all his bloody messenger plus crap. If you have enough money to hire a lawyer then you should consider suing patchou directly in court.

[Bubba]

Hey Hollywood,

Any issues you have with Messenger Plus ! would best be handled via the Messenger Plus! Forums....and in particular their respective Help & Support Forum (http://msgplus.mybboard.com/forumdisplay.php?fid=12).

[maddawgz]

hymmmmm not sure really?? nice sounds ?.. but if ya miss that sponsor question? program..look out biggggggggggggggg Trouble?..weigh up the pro's adn con's...is it worth all that clap clap clap..and WOOOOOOOW ! lol ::)

[never again]

Messenger Plus also messed up my pc there is no way i would ever use it again. Lop is a nightmare....................................

[Kola]

Kill it, of course.

I discovered my daughters (aged 17 & 15) infected their computers with the
c2media malware via messenger plus and asked me to remove all the crap
that messed with their system. After loosing some time understanding the situation (I am a linux user and didnt know this messenger plus software), I was releived to see that uninstalling messager plus was the solution.

So, my reasoning:
[1] Patchou helps malware people live. So on moral grounds, we must all try to
get Patchou out of business.
[2] Messenger plus may be ok if you do not install the sponsor, BUT:
a) non techies (my daughters) will forget to do this on updates
b) Patchou may at any time change his mind and an update may infect you
c) C2Media of course can do what they want (use bugs/loopholes in MP?)
d) MP Plugins can be really dangerous.

And my conclusion:
You can use MP, but you must FORBID EVERYBODY YOU KNOW TO USE MESSENGER PLUS. This is a simple message people like will understand.

I also banned IPs of c2media & messenger plus in the router.

[ehab]

link plz

[Primrose]

{QUOTE-> link plz <-QUOTE}



How to remove Messenger Plus, with screen shots.

http://chooseknowledge.com/How-to-uninstall-Messenger-Plus.htm

[LinuxPenguin]

Look, patchou, ive been using your software for a long time, i do NOT ever agree to install sponsor programs, and yet one of my webwise (as in takes the precautions i do) friends still got the LOP BS off you.

Just for the record, im an experienced C++ programmer especially in the field of hooks, an awful lot of my apps use them (i specialise in automation), and I'd like to (altho i doubt you will agree) see the VerifyBannedApplication function you refer to. Id also like you to justify hooking in that way, it is an unusual method, indeed i have never used it. Personally I would link a hook directly into my app,there is no need whatsoever to attach a dll to running processes.

Please could you explain?

Anyone who is interested in helping me develop MessengerMinus (the alternative to plus but with more features and ABSOLUTELY NO SPYWARE [i hate it with a passion]), can pm me

{QUOTE->
//Be sure that this is not one of the banned application that uses the same window class
if(VerifyBannedApplication())
{
if((!g_wndSysTrayMsg || !g_wndSysTrayMsg->IsWindowHooked())
&& !CHookedWnd::IsWindowHooked(hwnd))
{
TRACE("QuickInitialize will be called from systray window hook");
QuickInitialize();
if(g_bQuickInitialized)
g_wndSysTrayMsg = new CSysTrayWnd(hwnd);
else
{
TRACE("*** ERROR: systray window can't be hooked");
}
}
}
<-QUOTE}

so that code for the function?

Anyone who can live with themself after what LOP did to my friends pc... Im still having to be sneaky to get rid of it, im having to write a program which performs a theoretically impossible task, how do you like that on your conscience patchou? How do you sleep at night? >:(

[forestflyer]

Thanks to all for your comments on MP. I am a complete non-tekkie who impulsively downloaded MP because I sometimes use Messenger with my niece in Australia who's 16 (about the age of most MP users from the looks of the official MP forum). So I had some little doubts before I loaded it, but ignored them, and of course I chose not to receive adware (!) (giving this option is preying on young people's ignorance, that seems clear, because who else but the young and uninformed would choose adware). Now I've got it on my extremely clean machine (Norton 03, AdAware, Spybot, Spyblaster), but after reading about this guy Patchou and his connections to this malware corp. in this forum and 2 others, I want out. His last post above seemed particularly lame and vague and convinced me that he is lying or holding back--he couldn't respond to the previous post and tells us he won't post anymore. So to my question: do the rest of you endorse the method for getting completely rid of all traces of C2media and lop.com spyware that is described above in message # 48. Seems risky. I want to do a clean remove--please advise. Thanks in advance.

[Detox]

See Primrose's post (http://www.wilderssecurity.com/showpost.php?p=346549&postcount=48) above for a good removal link ;)

[forestflyer]

~snip~ This is a caution to anyone thinking of installing his MP: I did not choose the option to participate in his silly game, this "sponsored program", and I find now that my home page has changed to "Quick", a search engine http://search.qsrch.com/ , instead of Google as I've had it set for over a year. Nothing like this has ever happened to my machine, ever, and it happens after I download this Messenger Plus? ~snip~

~Removed Personal Attacks~ please refrain from such ~ Blackspear

[forestflyer]

Detox, I saw that link from Primrose in message #48, and that's what I'm asking about specifically. As I read through it, the first step is:
1. re-Install Messenger Plus / msgplus / with the sponsor program, click next/accept to everything

This is counter-intuitive to me--it seems like it's opening up your machine to every bad thing. The writer doesn't explain his logic. It really seems strange--have you read it? Thanks.

~snip~ I googled combinations of Patchou Lop.com "Quick" and "new.net", the maker of the Quick search engine, and got many hits. Many mention Click.net. If any of you reading still doubt, read post #6 at http://www.pcbasic.com/showthread.p...2961#post102961

~snip~ Removed personal attack ~ please refrain from such ~ Blackspear

[Blackspear]

{QUOTE-> Detox, I saw that link from Primrose in message #48, and that's what I'm asking about specifically. As I read through it, the first step is:
1. re-Install Messenger Plus / msgplus / with the sponsor program, click next/accept to everything

This is counter-intuitive to me--it seems like it's opening up your machine to every bad thing. The writer doesn't explain his logic. It really seems strange--have you read it? Thanks. <-QUOTE}It may seem counter-intuitive, however this is the best method to remove this software (whatever you want to name it)

Cheers ;D

[forestflyer]

Thanks Blackspear, I tried it. You’ve been snipping my attacks on the dude. I understand. For the rest of the readers, the gist was that I don’t appreciate Mr. Patchou.

What a hole this person is. I mean that in the nicest way. I began to uninstall and I get a box which says: "Your uninstall files have been corrupted!" and then claims that I either manually deleted the sponsor files or that I have software that did so automatically, then this: "All complains (lit.) should be sent to the creators of the automatic advertisement removal software that was used." Is this guy an arrogant bleep or what? (where “bleep” does not necessarily constitute a personal attack.) Now I'll have his crap code clinging to my machine and he thinks that his cop-out is good enough? He has no business putting this dung out into the world if it is going to be messed up by an anti-spyware program which is commonly used. Let me say this nicely: Are you listening Mr. Patchou? What part of this do you not understand? How many hours of people's lives do you think you've wasted, as you’ve wasted mine tonight? You're living in delusion if you think it's anyone's fault but your own that your sponsor's files get "corrupted”. With all due respect for your very nice program (note compliment, Blackspear), you are making your living in a bad way, and you don't even see it--why not do the right thing and have people donate to keep your software alive. Sure, you won't make as much money, but you can be proud. I'd love to hear your answer, if you can give a b.s.-free one, which judging from your previous posts, may not happen. And perhaps learn how to spell, or click on the spell-checker button. I have restrained myself, and the worst I wrote were tame references to excrement which are in common use in semi-polite society.

[Blackspear]

Ok Forestflyer, I understand your frustration, and think enough venting has happened and it's time to now move on.

Have you managed to remove this software from your system, or do you require further assistance?

Cheers

Blackspear.

[Primrose]

Hey Forestflyer,

The reason you reinstall the plus thingie is because many people figure out right away that the Plus is the cause of their problem and they just uninstall it. That of course will NOT also uninstall the spyware/adaware package..so people are told to reinstall it and use that method.

But then there are some people who approach it differently and start running Adaware or some other antispy cleaning program ( and some even try to go in there and just start whacking the spyware/adaware stuff with manual tricks or renaming this and that etc) and none of those methods work..IN FACT they all make it so difficult to then even remove all of it..that then doing it the method suggested in that write up ( with this reinstall), does not work and the uninstall is corrupted.

SO if you really want help now this is what you do..

First do these steps

Guidelines for Posting in This Forum, READ THIS FIRST PLEASE


http://forum.gladiator-antivirus.com/index.php?showtopic=10517

Then post your hijackthis log in a new topic at this fourm


HELP! Think you are Infected?

http://forum.gladiator-antivirus.com/index.php?showforum=170


To use that forum you must first register at our Board.

And at that Gladiator Forum we will help you get rid of what you have problems with.

But reading your posts I suspect you also have crap on your PC that has nothing to do with Messenger Plus. We will help you with that also.

BTW you can rant at me all ya like..I never take it personal when people have frustrations with their OWN PC..but things get cleaned off lots faster if you keep you typing energy directed to the technical info we really need to help you rather than the rants.

[forestflyer]

Blackspear, I have done the steps. Things seem to be o.k. as far as I can see. But I will do the Hijack thing just to make sure. Thank you for your help.

I am confused, or maybe Primrose is. I have not been ranting at you in any way (I thanked you above for the tip), unless you are Patchou. I doubt that you are Patchou simply because you can spell. My apologies now if you are not him, but for now I have to assume you are this person Patchou because you say: "BTW you can rant at me all ya like..I never take it personal when people have frustrations with their OWN PC." Please Read the previous posts and clear this up.

So, Patchou, I will take these other steps Primrose outlined. But why, why should I have to? Think about it--you ought to design your software in a way that does not necessitate these steps and hassles for a non-geek computer user such as me. I am in elementary school in these matters, and I should have to waste my time doing what I 've had to do and learning about "Hijack" etc.? --what about my 80 year-old dad? This could happen to him and he wouldn't know where to begin. You are basically missing the point, which is you are the problem. You are stealing time from people, and you are arrogant about it. You have to make it so this doesn't happen, or not make it at all. At a minimum, you have to warn people in advance that AdAware will screw up an uninstall. Do you see this?

Now for your all-purpose cop-out that "But reading your posts I suspect you also have crap on your PC that has nothing to do with Messenger Plus. We will help you with that also." This is a crock--I have had zero, absolutely zero problems or symptoms on my PC in 2+ years due to my diligence and good luck (as I mentioned above), so how do you come to this conclusion? My homepage defaulted to Quick--your sponsor's (lop.com) product--after I installed MP and checked the box that I didn't want the sponsor's adware and whatever other crap they infect computers with. For the first time something got past the Norton that is installed on my machine. That's all you need to know--your methods are irresponsible and evil. You have no right to allow this to happen. Go redesign it. Get it ?

Primrose writes "The reason you reinstall the plus thingie is because many people figure out right away that the Plus is the cause of their problem and they just uninstall it." That's the way it should work--go redesign it. If Adaware or Spybot (which are both commonly used) screws up the uninstall, it's up to you, not them, to adapt, so that users aren't screwed. Do you understand this? Why don't you at least mention that these programs will mess up the uninstall before users uninstall MP? Jeeze. And ranting is useful if it finally gets through to the right person.

[Primrose]

You are a day late and a dollar short on the rant.. ;D but you surely could find the forum for the Messenger PLUS and give a ear full to Patchou. Here at wilders we just help people clean their PC's among other things..so what you have posted will only slow down others who are looking for the tech info to do the deed.

Have a great day. :)

BTW hmmm I wonder if Patchou is a gal . :D

BTW..you get the other crap..when the spyware/adaware package in the Messenger Plus is on your PC for any lenth of time..IT, in itself, then infects you with all kinds of other types of LOP and CWS..which are then really independent of the spyware/adware engine..and will not then be cleaned off when you do the uninstall method my link will help you with..so it is one of those things..the longer you wallow with that pig..the more mud you will get.

Thats all for me..in response to ya..good luck.

[forestflyer]

Please translate so I can understand. You aren't addressing my post. And if you read it through, you'll get that I'm not ranting at you, so cool your jets. But I will post it at MP. Rants are useful.

[Primrose]

{QUOTE-> Please translate so I can understand. You aren't addressing my post. And if you read it through, you'll get that I'm not ranting at you, so cool your jets. But I will post it at MP. Rants are useful. <-QUOTE}

;D ;D The translation is..I am not Patchie..and if you want any help with the hijacklog..come and see us..


http://forum.gladiator-antivirus.com/index.php?showuser=3255

[forestflyer]

Thank you for the above edit: " BTW..you get the other crap..when the spyware/adaware package in the Messenger Plus is on your PC for any lenth of time.."

I was afraid of that. So I will Hijack and then put the log on the other forum. But I also hope to get the chance to smack that hole (meant in the very nicest way) Patchou in some way, cuz he needs a smack as a public service. (personal attack on jerk self-deleted)

[Bubba]

Since both sides of the Messenger PLUS - kill it or keep it ? issue has been offered ample oportunity in the last year to comment to this thread....we'll leave this one for posterity and let a new one begin if need be at a later date.

This thread is now closed.

Regards,
Bubba

[Blackspear]

{QUOTE-> Blackspear, I have done the steps. Things seem to be o.k. as far as I can see. <-QUOTE}Good to see.


{QUOTE-> But I will do the Hijack thing just to make sure. <-QUOTE}A very good idea, this will confirm your system is clean.


{QUOTE-> Thank you for your help. <-QUOTE}My pleasure.

I have sent you a Private Message (PM).

Cheers ;D