Messenger PLUS - Upgrade - WARNING

[Blackspear]

My work PC popped up and asked if I wanted to allow an update to the NEW version of Messenger PLUS, I said yes, and that's when it downloaded, changed my home page, placed several icons on my desktop, and in my favorites folder, added a toolbar to Internet Explorer that could not be removed etc etc....

Be warned, the program may have been good for over a year, it is now a MONGREL!!!!

[Pieter_Arntz]

Hi Blackspear,

It sounds like you have been "lopped"
Info: http://www.doxdesk.com/parasite/lop.html
Did you get any prompts to ask if you wanted to install the sponsor software at all?

If you need any help removing it, let me know.

Regards,

Pieter

[Blackspear]

That's exactly what it was, as part of my removal process I ran Spybot S&D, it picked up multiples of C2Lop.

I was just working on th PC as per normal, when suddenly was asked did I want to upgrade to latest version of Messenger PLUS. Having used PLUS for over a year, I didn't see a problem, then the MONGREL infected my system.... Grrrrrrrrrrr. Half an hour later, having deleted Messenger Plus, several unwanted programs that had just installed themselves, reset Explorer to default settings, ran Spybot and also deleted Messenger 6.0, I finally had my PC back to normal. What a pig!!!!

Cheers

[Pieter_Arntz]

quoting: Blackspear link=board=21;threadid=15653;start=0#msg97413 date=1067606433]
What a pig!!!!

Agreed. And then we are not even talking about how ugly that toolbar is.

Good to hear you were able to get rid of it.

Regards,

Pieter

[Blackspear]

Hi Pieter, unfortunately it still keeps popping back up, we have removed everything we can find through Regcleaner, run Spybot S&D, when I reboot the machine and 1st click on IE, up pops the toolbar.

Your help would be greatly appreciated.

Cheers

[Pieter_Arntz]

Hi Blackspear,

I will need to see your HijackThis log.
Please go to http://www.tomcoyote.org/hjt/, and download 'Hijack This!'.
Unzip, doubleclick HijackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log" button.
Press that, save the log as a .txt file, and copy and paste its contents into your next post.

Most of what it lists will be harmless, so do not fix anything yet.

Regards,

Pieter

[Blackspear]

Logfile of HijackThis v1.97.3
Scan saved at 11:02:18 AM, on 5/11/2003
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\3M\PSN2Lite\Psn2Lite.exe
C:\Program Files\Karen's Replicator\PTReplicator.exe
C:\Program Files\OpenOffice.org1.0.1\program\soffice.exe
C:\PROGRA~1\3M\PSN2Lite\PSNGive.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\pcuser\LOCALS~1\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearchnow.com/searchbar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://mysearchnow.com/searchbar.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearchnow.com/searchbar.html
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {769bd0a9-b52a-434f-8ff4-be36eb7708db} - C:\DOCUME~1\pcuser\APPLIC~1\fsheandrth.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: hmzzeevlldr - {e7850a40-9c67-4f99-abb1-f4ea04b16e70} - C:\DOCUME~1\pcuser\APPLIC~1\fsheandrth.dll
O4 - HKLM\..\Run: [NOD32POP3] "C:\Program Files\Eset\pop3scan.exe" /uninstall
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [nod32kui] C:\Program Files\Eset\nod32kui.exe /WAITSERVICE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: OpenOffice.org 1.1.0.lnk = C:\Program Files\OpenOffice.org1.0.1\program\quickstart.exe
O4 - Startup: Replicator.LNK = C:\Program Files\Karen's Replicator\PTReplicator.exe
O4 - Global Startup: Post-it® Software Notes Lite.lnk = C:\Program Files\3M\PSN2Lite\Psn2Lite.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ Lite (HKLM)
O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O10 - Broken Internet access because of LSP provider 'imon.dll' missing
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://203.166.82.178:81/activex/AxisCamControl.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37878.8793634259
O16 - DPF: {BF5E26B7-7087-4C2D-B0BA-0098F7CBED6B} (LiveX(5.3.0.1) Control) - http://avbne.ath.cx/cab/Live.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[Pieter_Arntz]

Hi Blackspear,

Check the items listed below in HijackThis, close all windows except HijackThis and click Fix checked:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearchnow.com/searchbar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://mysearchnow.com/searchbar.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearchnow.com/searchbar.html

O2 - BHO: (no name) - {769bd0a9-b52a-434f-8ff4-be36eb7708db} - C:\DOCUME~1\pcuser\APPLIC~1\fsheandrth.dll

O3 - Toolbar: hmzzeevlldr - {e7850a40-9c67-4f99-abb1-f4ea04b16e70} - C:\DOCUME~1\pcuser\APPLIC~1\fsheandrth.dll

Then reboot and enjoy the missing toolbar.
Also check your favorites. Some extra folders may have been added.

Regards,

Pieter

[Blackspear]

Thanks Pieter, I saw those, but wanted to see what you came up with...

Cheers

hello here, I was really in trouble with my msn messenger plus so I've started to look for something about it and have found this forum.
Could you help me please?
I'd like to remove evrything that comed up after the Plus installation (and the really ugly and useless blue toolbar on IE, too).
I've read the posts and downloaded the Hijack This, and now I'm going to scan my computer.
All I can do by myself is to remove the really enormous number of icons on my desktop and not wanted preferred links that was added.
How can I get sure that all spyware, etc will be removed?
In few words: what have I to do to get my computer as before?
Thanks a lot!!!

[snowbound]

Hi proximo

Welcome to Wilders.

Since u have already Downloaded HijackThis just follow step#1 in these instructions,

http://www.wilderssecurity.com/showthread.php?t=15913

then post your log in the Hijack cleaning forums with a full description of your problem and one of the experts with help u remove any Malware found.


snowbound

[Kryptonate]

Originally Posted by Blackspear

My work PC popped up and asked if I wanted to allow an update to the NEW version of Messenger PLUS, I said yes, and that's when it downloaded, changed my home page, placed several icons on my desktop, and in my favorites folder, added a toolbar to Internet Explorer that could not be removed etc etc....

Be warned, the program may have been good for over a year, it is now a MONGREL!!!!

If you update Plus! trough the update popup you'll get a question asking you whether you want to install the sponsorprogram or not. The same thing is shown when you install Plus! the normal way.

Please do NOT use Ad-aware, Spybot S&D or any other program to remove Plus! or the sponsorprogram. Instead please follow the steps from the official Messenger Plus! forum. If you have any questions you can ask it on the Plus! forum, we will be glad to help you .

[Detox]

I'm very sorry Kryptonate; but you will find it hard to sell the bible to the devil himself.

Our experts here have been dealing with LOP spyware for years, and they have done VERY well at it. There is no point in attempting to tell us how "Messenger Plus doesn't really do what it's been doing all these years" or how bad the tools which have been made for the community (and constantly improved by popular demand) are "bad" or useless.

[Kryptonate]

how do you mean "Messenger Plus! doesn't really do what it's been doing all these years"? Plus! is improving with every update, next week Plus!3 will be released.
The sponsor is indeed LOP but the sponsorprogram is especially made for Patchou (the creator of Plus!) and does not contain a trojan or any other malicious code in it. AVG said a while ago it contained a trojan, true, but AVG has apologised for it already and the new updates don't say it anylonger.

If you say it contains spyware because your experts say it, then you have to think about the fact that experts can be wrong too. They're not gods who know everything. I'm not insulting or questioning the expertise of these experts, it's just a fact.

[Detox]

I mean that the record of your "software" speaks for itself. I have seen an enormous amount of people come to these very forums over the years asking for help getting rid of these parasites which they did not intend to install. Excuses about some fine print in a EULA on a program which is usually installed due to a young person being mislead to believe it is actually related to Windows and/or Microsoft Messenger simply do not excuse the practice. Besides, if this program was so "up and up" why would you need to type a code for uninstallation?