- Messenger PLUS - kill it or keep it ?

[Moore]

hi again ,

i have a small question about patchous messenger plus , sorry if this is the wrong section , but should it be removed from infected systems or not , as from the info i have seen it so far it installs lop spyware and its not recommended by a few highly respected people, e.g:
http://www.wilderssecurity.com/showthread.php?t=7487

but i see many people with it in their hijackthis logs and many times they are given the all clear , i have so far been advising infected people at my forums to get rid of it as i havent seen any clear indications that it is safe , although i wouldnt touch it ever myself , so i cant say for sure what its really like ..

i know some people that do like to use it and do not want to remove it , and i try not to give bad advice but im not perfect :

ok heres something from one of our forum members Sahu, that blocked it using protowall :

The appearance of C2 Media folder containing setup.exe in my Program Files folder has bugged me for a little while. I didn't install anything with such a name, so I had no idea where it came from. My intention has been to look into it, but being so into other things (and considering it didn't seem to be doing anything), I hadn't quite got round to it. Well today (whilst busy doing nothing), Protowall flashed. I took a peek at the log.

2004/04/19 22:29:34 [<-] BLOCKED [!] - Destination is C2 Media Ltd HURRICANE-CE1076-331 (NET-66-220-17-0-1 (66.220.17.175) [protocol: TCP / destport: 80]

For a change, this one was easy. A simple search on Google, led me to THIS

So I immediately went to uninstall Patchou's MSN Messenger Plus Version 2. This doesn't immediately remove the program, as I discoverd, but in fact creates a .bat file in your user account temp folder, designed to run on next boot. I didn't bother waiting, and opened the .bat file in notepad. There it contained basic lines for the removal of Messenger Plus, but also lines for the removal of C2 Media. I'm sure you can guess I executed the bat file immediately. So thanks to Protowall for the block which pushed me to investigate and get rid of this trash.

And a warning to others. Even if you choose not to install 'supporting' executables during install of Messenger Plus, it's still going to be put on your system and still going to connect to the net! (Or at least, it will try to.)

so can someone please give me some more advice with this garbage ?

thanks to anyone that replies.

[Pieter_Arntz]

Hi Moore,

If you want the easy way to get rid of all the spyware that came with MessengerPlus, then uninstalling it will remove everything that came with it.

The application itself is harmless though and that is why I ususally leave it alone. The problem with that recently seems to be, that upgrading the application will renew all the bundled spyware.

Regards,

Pieter

[Moore]

thanks Pieter.

in your opinion would i be better to direct people to uninstall it completely , or just remove the spyware itself manually ?

and for those that intend to keep it installed but dont want the bundled spyware , would the only other option be blocking all C2 media ip adresses , [ as long as they have a firewall that is ] and avoid updates ?

[Kryptonate]

Hi, I'm from the official Messenger Plus! support forum and I can assure you that Plus! does NOT contain any spyware or what so ever. It installs a searchbar in IE and changes your homepage. It does NOT install spyware or adware. If you want to get rid of the sponsorprogram (that was especially designed for Patchou, so it's not the sponsorprogram you can find on the sponsors homepage):
1. close down msn messenger completely (be sure the icon in your taskbar is gone)
2. go to Start
3. Run
4. type "control panel" (without the quotes)
5. go to Add/Remove Software
6. Double click on "Messenger Plus!2" and you'll get the option to uninstall it.
You'll get the question if you want to keep your preferences. You can answer "Yes" without a problem, this has nothing to do with the sponsorprogram.
7. Then you'll get a sponsorscreen asking you to fill in the code that's displayed (this is to be sure that a person is doing the uninstall and not a prorgram).
8. Press UNINSTALL
9. Follow the steps
10. Restart your computer

If you want Plus! back, let the setup work and choose "I refuse, do not install the sponsorprogram". Now you only get Plus! and no sponsors.

If you update trough Plus! you are asked again if you want to install the sponsorprogram.

[Pieter_Arntz]

Thank you Kryptonate,

Moore,

Does that answer your question?
The advise would be "Uninstall and then reinstall, but read the EULA this time"

Regards,

Pieter

Hello, I'm aslo from the official Messenger Plus! forums. I want to add some thing to what Kryptonate said: Before uninstalling, you have to close all your opened Internet Explorer windows. This is very important for the sponsor being unsintalled properly.

For more info, read http://msgplus.mybboard.com/showthread.php?tid=21598 and feel free to come to our forums to ask for support.

Choli.

[Moore]

yes , thanks for the replies , im glad i asked .

thanks for the link to the forum , it will come in handy im sure for all the people that are tricked into getting infected by the LOP.com garbage.

I was thinking of this excellent post below when I claimed it was carrying spyware.

if I an find the link I will post it too.. I think its from the spywareinfo newsletter.

Messenger Plus is MALWARE!

--------------------------------------------------------------------------------

Here's a news article from spywareinfo.com to prove it:

Messenger Plus Bundling Lop.com

Many of you may have heard of a program called Patchou's "Messenger Plus". I used it myself once, before I discovered Trillian. Similar to the many front end programs for Internet Explorer (Avant browser, MyIE2, etc), Messenger Plus adds a user interface to Microsoft's MSN Messenger that contains extra features.

Patchou has brought in C2Media as a sponsor and is now bundling their lop.com software into Messenger Plus. For those of you who have never heard of it, lop.com software is classified as a trojan by antivirus vendors and as a browser hijacker by antispyware vendors. You can find plenty of information about it by doing a Google search for lop.com. Just be warned - some of the language used by lop victims will melt your monitor.

No single parasite has caused as many support threads at our message boards as lop.com (although Xupiter comes close). Ad-aware, Spybot, and all other spyware removal programs target several older variants of lop.com. It now comes in a version that is nearly impossible to detect automatically. It uses randomly named files, randomly generated CLSID identifiers, and uses activex installation methods that let them update all of their installers at once.

Before this change, the number of lop.com complaints actually had gone down because it was so easy to remove and could even be blocked beforehand. Since C2Media introduced these new versions that mutate randomly, the number of infections has become larger than ever. The only sure way to be rid of it is to ask for help at the SWI support forums.

Patchou, the developer of Messenger Plus, has issued a statement regarding the complaints he's been receiving due to his new "sponsor". To all of the people who are saying that they won't use his program because of lop.com, he has this to say, "I don't want to be rude but if you boycot version 2.10.36, you're an idiot."

<sarcasm>
Rude? Well gee, what could possibly be "rude" about being called an "idiot" for refusing to install software that sets off trojan alarms in antivirus programs?
</sarcasm>

Whether it makes you an idiot or not, I strongly recommend that everyone stay as far away from Patchou's Messenger Plus as possible. If you have installed it already and now have lop.com's software all over your system, uninstalling Messenger Plus supposedly will also remove lop. If that doesn't work, then please read this FAQ and follow the instructions. We are very experienced at removing this thing and can easily walk you through it.

thanks to everyone for the help , i hate being confused ,

Messenger PLUS! should be avoided at all costs and is clearly a supporter of spyware with no care towards its victims.

Hi there

I'm also from the official Messenger Plus! support forum and I wanna add some things to the explaination of Kryptonate (hi kryptonate )... for maybe futur reference or so...

These are facts, no matter what (respected) people on other forums say:

1) The setup procedure involves the question if you wanna install the sponsor or not (see screenshot in Kryptonate's post). This screen will ALWAYS be shown, in any circumstance! And Plus will NOT install the sponsor if you selected "don't install sponsor"... It is programmed that way...

2) Of course the setupfile you download for Messenger Plus, does contain the setupfile of the sponsor. Some anti-adware programs will fall over this. But, like said in above point, this setupprogram won't run (heck it won't even unpack) if you select "don't install the sponsor".

3) Also, when you choose to update Messenger Plus!, it downloads the same update just like you would download. It is exactly the same file! There is no seperate "update"-file. After this is downloaded, this file is started. There is no difference between updating thru Plus! and downloading and running the setup yourself. This means again that the sponsor agreement will be shown.

4) The sponsor IS adware and IS from the company LOP. Most people and anti-adware/spyware programs know this company. The only thing they forget (and what is badly programmed into the anti-adware/spyware tools) is that the sponsorprogram from Messenger Plus is a package especially made for Messenger Plus. It doesn't contain any spyware (which is a huge difference with adware btw) and the only thing it contains is a searchbar and adware popups. These popups will not contain any adult-material (again a request from Patchou) because Messenger Plus is of course also used by underage people.

5) Some anti-virus programs (like AVG) trigger a virus warning if they find this sponsor. Of course, needless to say that those routines for checking virusses in those programs are very dodgy, triggering a virus warning for a very reduced adware.... dodgy if you ask me...

6) People do complain that the sponsor agreement looks like an EULA. Well, two things. First, the sponsor agreement IS an agreement, just like an EULA. Furthermore, there are no options checked by default...
Second, even if it was an EULA, an EULA is meant to be read before you install software (even if it is just the title and the first few lines). It is a very bad habbit of those complaining people that they don't read the things they supposed to be reading. So the screen isn't dodgy at all.

7) Removing the sponsor with tools like ad-aware is a bad idea. In fact, tools like ad-aware mess many things up, not only in Messenger Plus!, but for other (adware) programs also. It is the logical way to remove a sponsor by uninstalling the software. Ad-aware, Spybot S&D, etc... aren't the holy grale They are usefull tools, if you use them usefull...

People also complain that uninstalling Messenger Plus! doesn't remove the sponsor. They forget that they first destroyed the uninstall procedure with such tools as ad-aware... And even if they didn't used tools like ad-aware, they still say it doesn't work. Well, you need to follow instructions of course. One of those instructions are: "close your browser before you continue" and many people blundly ignore this eventhough it is a logical step, as the toolbar in your browser can't be deleted when it is running.



* So, to conclude, if you don't want the optional adware sponsor, answer "don't agree" in the Sponsor Agreement.
* If you accidently installed the sponsor and want to remove it, then uninstall Messenger Plus! again and follow the instructions. (you can then install Plus! again without the sponsor if you like of course).
* If you did try to remove the sponsor with tools like ad-aware, then you need to fix the uninstaller again. Do this by installing Plus! again WITH the sponsor. After this you can uninstall Plus! again to completely remove the sponsor from your system.

(ofcourse installing and uninstalling means following the instructions and doing everything like you logicaly would (closing the programs first, using add/remove programs, rebooting, etc...))


I hope this helps

Small note on that report "Messenger Plus is malware".

The person who wrote that didn't schecked his sources and didn't bother to search and state the facts. He twisted everything around so he could make his point. For example the quote from Patchou "blah blah... you're an idiot" is taken totaly out of context. On the official Plus forums there was a thread about this post long ago. And also with the links from where this quote was taken from. It was very quickly clear that this person simply didn't wanna state true facts and deliberty (damn my english :p) twisted the truth to get his point across...

[nadirah]

Please DO NOT download messenger plus. Stop downloading anything from patchou. Patchou is a bad guy who supports spyware.You won't get away with your crime , <snipped- Pieter> patchou.

[Kryptonate]

Originally Posted by nadirah

Please DO NOT download messenger plus. Stop downloading anything from patchou. Patchou is a bad guy who supports spyware.You won't get away with your crime , <snipped- Pieter> patchou.

have you actually READ all the above posts? Cookie, Choli and me use Plus! for over a long time now and we never had any problems what so ever with the sponsorprogram. Millions of people are using this software, so if it indeed had spyware or whatsoever no one would use it. Think before you say something, especially if it's not true.

btw: hi Cookie

[Moore]

I think the only option is to kill it. you cant trust them one bit.

http://www.spywarewarrior.com/viewtopic.php?t=2413

Moore, you really didn't understand 1 bit what we have posted didn't you?

I'm atm not in the mood to reply on each thing posted there. But about the first things I do gonna reply:

Also installs Ad Intelligence
http://www.msgpluszone.com/forums/mi...on=help&hid=10

1) That website has no affiliances with msgplus
2) What exactly installs Ad Intelligence There is nothing there that has anything to do with "Ad Intelligence"....

msgpluszone.com:66.98.252.17 (Support forum for msgplus)
What really links them also is the ending of the EULA: For general support please email support@lop.com. For comments or concerns about a website that is promoting this software please email affiliates@wrn.net with all pertinent information

1) Again, msgpluszone is NOT the official support forum (although it sits on the same server... so what?)
2) That EULA is NOT from msgpluszone and has NOTHING to do with it

Additional Reading:
http://www.geeknewz.com/board/index.php?showtopic=1413

That whole threads is handled in our above posts...

BTW: have you heard of whistle software? so far that baby is transmitting more than my Transponder offeroptimizer does. They even make you enter your email and zip to install because it is a socalled weather type software. Been seeing my fake email being sent to 3rd party ad servers during transmissions to day.

That's even more "BS"... I don't know what this guy has been smoking, but filling in your email and zip to install? Is he even talking about Plus! and the sponsor?? Apparently he thinks he is though....

etc... etc...


Also, Moore... What is this all about on http://forums.maddoktor2.com/index.php?showtopic=505:

I was seeking further information on this program , while helping my forum members clear out their hijacks and the forum moderators of Messenger Plus swooped on this post of mine at Wilders.org and they claimed the sponsor program was easily avoidable:

We not only claimed it, IT IS SO....

Still they get hundreds of complaints a week according to Patchou

hundreds? where did that come from? tbh, we get 1,5 complaints every week out of the thousands that install Plus! every week. And that is are true figures. And "according to Patchou"? Where on earth did he say that?

And then you dare to accuse Patchou for telling lies and doing devious things and such? People like you, Moore (and the so called "expert" webhelper), should learn first a bit more about computers, adware, spyware, etc. Or at least first install some "mailicious" software and test it, before telling things about it....

[Bubba]

Hey CookieRevised,

I'm sure it goes without saying....that anytime C2Media or Lop.com is mentioned....those of us that have spent many hours helping victims clean up there PC's kind of cringe.

The argument that...."although many people know LOP.com as an agressive 'spyware' company, the package that comes bundled with Messenger Plus! is nothing like that"....makes me about as warm and fuzzy as someone saying....'Oh, this version of CoolWebSearch only changes your Homepage to about:blank'

While I understand the need to make a living....individuals like Patchou must understand they are part of the problem not part of the solution. I mean....just because it only shows a "very small piece of adware"....what's to say C2Media want come back to Patchou and ask for more ?

Ah, glad to someone with decent questions, concearns and remarks

I'm sure it goes without saying....that anytime C2Media or Lop.com is mentioned....those of us that have spent many hours helping victims clean up there PC's kind of cringe.

yes, true. And I'm one of them (maybe you don't believe it, but I truly am). I still cringe whenever C2Media or Lop.com is mentioned or installed on my PC. But as I also know that the package that comes with plus! can't be compared with the normal well known stuff, I have nothing against the one that comes with Plus!

The argument that...."although many people know LOP.com as an agressive 'spyware' company, the package that comes bundled with Messenger Plus! is nothing like that"....makes me about as warm and fuzzy as someone saying....'Oh, this version of CoolWebSearch only changes your Homepage to about:blank'

I understand, (so does Patchou and anyone else of the Plus! community btw). I had to find it out myself before I believed it. And I can assure you that it is nothing like the true spyware stuff that Lop is associated with. Although, that some things in the sponsor are still a bit dodgy (the namechanging for example) it is very very harmless and can be uninstalled very easly (unlike his spyware big brothers from Lop).

But, don't take my word for it though. Try it out yourself on a secured test-machine. Install Plus! with the sponsor (monitor the activities if you like) and then unsinstall plus!. You'll see that it will be that easy to remove

While I understand the need to make a living....individuals like Patchou must understand they are part of the problem not part of the solution.

He never claims to be part of the solution. Far from it. The moment he finds another company which offers the same deal (money vs. light adware package) or he finds another way of a steady income, he will be the first to change it. Because he also knows the problems and bad rep that it has.

Also, during the years, he made everything possible to make the user clear that the user can opt out of the sponsor very easly.

He's not the devil that everybody makes of him you know In fact he's a very normal human being like you and me...

I mean....just because it only shows a "very small piece of adware"....what's to say C2Media want come back to Patchou and ask for more ?

True. And they did try. But Patchou refused every time. He is very strict when it comes to "his" sponsor and in those matters. This again only shows that he does care I think...

Also, it is true that people will find still some issues with the sponsor. But that's why it is optional. And not like in so many other software products bundled within and even hidden. And it strikes me also that there is so much fuzz about something you can easly opt out to, while nobody talks about all the other softwares that come with truely hidden adware/spyware.

He and msgplus is almost the king-devil of spyware itself, if you read some stuff. Well, I guess if you are very open to your userbase (which is btw more then 5 million msn users) and are always open for suggestions, always updating things, let the user choose to "support" him or not, etc.... , that you are not welcome in this computerworld of today.....

[Hans 01]

[quote= ..... It installs a searchbar in IE and changes your homepage....[/QUOTE].

Thanks, is this why my default page insists on going to M$ ?
If so, perhaps you M$ people can tell me how to get rid of that. But please, in the simplest possible instructions for a novice.

/ H

[no13]

Get older version GET OLDER VERSION
junk the v3 and take v2 from any site (google it)

The new one installs some adware even when you tell it not to, and its features are too good to lose.

[quote=Hans 01]

Originally Posted by ..... It installs a searchbar in IE and changes your homepage....[/QUOTE

.

Thanks, is this why my default page insists on going to M$ ?
If so, perhaps you M$ people can tell me how to get rid of that. But please, in the simplest possible instructions for a novice.

/ H

IF it is the sponsor from Messenger Plus! (there are thousands of other things that can change it), then simply uninstall Plus! and follow the instructions given on screen. (like closing every browserwindow, entering the number, etc...).

Also, Messenger Plus!, nor we, have anything to do with Microsoft.

Originally Posted by no13

Get older version GET OLDER VERSION
junk the v3 and take v2 from any site (google it)

The new one installs some adware even when you tell it not to, and its features are too good to lose.

Oh please...
There is NOTHING changed in the sponsorsetup. If you choose "no, don't install the sponsor", then there is NOTHING installed...

IS IT THAT HARD TO UNDERSTAND?

Furthermore, there are some bugs in Messenger Plus! v2 itself. Also v2 lacks A LOT of features, etc...

So, don't post if you don't know about what you're talking about!

[no13]

Originally Posted by CookieRevised

Oh please...
There is NOTHING changed in the sponsorsetup. If you choose "no, don't install the sponsor", then there is NOTHING installed...

IS IT THAT HARD TO UNDERSTAND?

Furthermore, there are some bugs in Messenger Plus! v2 itself. Also v2 lacks A LOT of features, etc...

So, don't post if you don't know about what you're talking about!

Ok wise guy... Assuming u use MessPlusv3 installed "without" adware
go to c:\windows... find a *hidden* file called lbbho.dll and an obvious file called lbbho.inf......
Try to uninstall msg. plus... now look for the file again. BAMN. still there.
!Explain!


Edit : please take a few minutes of your *apparently* valuable time and visit : http://www.dtcc.edu/cs/rfc1855.html a good investment.

[dread]

BAMN I dont have them files did a search on whole harddrive and looked personally in c:\windows c:\windows\system c:\windows\system32. If you dont install sponser support Messenger Plus will not install anything. I like it and use thats why I have said something. I think they should remove the sponsor surport, but it does not install anything if you tell it not to install sponsor support.

[no13]

WARNING!!!!!!!!!!
the file <<msgplush.dll>> automatically binds itself to ALL OPEN PROGRAMS THAT ARE USING THE INTERNET.... why? I don't know...
maybe our dear CookieRevised can shed some light as to WHY on Earth is this file binding to all others.
<FLAME ON>
Stop hurling abuses at everyone... u even abused AVG antivirus and the intelligence of its programmers. Not a good idea, sir.
<FLAME OFF>

[no13]

Originally Posted by dread

BAMN I dont have them files did a search on whole harddrive and looked personally in c:\windows c:\windows\system c:\windows\system32. If you dont install sponser support Messenger Plus will not install anything. I like it and use thats why I have said something. I think they should remove the sponsor surport, but it does not install anything if you tell it not to install sponsor support.

C:\windows a hidden file here... lbbho.dll ... doesn't ever show up in searches and I think is marked as a *system* file... so you'll have to enable both "view hidden files" and "view protected OS files" from
Windows explorer > Tools > Folder Options > view
Also disable "hide extensions of known filetypes"
<<Note: exact option names are different>>

[dread]

I know this and have all of that enabled and search can find the files, its in under More advance options Search system folders and Search hidden files and folders I have dotted in folder options under view Show hiddent files and folders,hide extensions of known file types unchecked and Hide protected operating system files unchecked etc... I dont have them 2 files, messsenger plus does not install anything if you tell it not to install sponsor support. I can show screen shots if you like.Im not a computer newbie and know how to find and show them hidden and system etc... files

[no13]

pardon moi monsieur, did not mean to offend you. I just assumed you had not checked for *system* files (I 'd neglected to mention it earlier)
Maybe u didn't get that abominable file. But you MUST be noticing how msgplush.dll binds itself to all thise prog.s. (I used BlackICE, by the way)

[dread]

You didnt np. Sorry if came off like that. I was just saying. I do have that file (msgplush.dll) though in C:\Program Files\Messenger Plus! 3. I have no earthly idea what is for though. Maybe someone from Messenger Plus can say what that is for. But I say what I said in them other post. Messenger Plus will not install any spy/adware if you tell it not to install sponsor support. I have been using since version 2. I messed up one time and didnt read that part, maybe they should make that screen really really big, and got that crap on my computer. And every since then I have remembered to make sure I didnt install sponsor support and Messenger Plus has never ever gave me any spy/adware as long as told it not to install sponsor support.