Messenger PLUS - Upgrade - WARNING

Discussion in 'privacy problems' started by Blackspear, Oct 31, 2003.

Thread Status:
Not open for further replies.
  1. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    My work PC popped up and asked if I wanted to allow an update to the NEW version of Messenger PLUS, I said yes, and that's when it downloaded, changed my home page, placed several icons on my desktop, and in my favorites folder, added a toolbar to Internet Explorer that could not be removed etc etc....

    Be warned, the program may have been good for over a year, it is now a MONGREL!!!!

    :doubt: :doubt: :doubt:
     
  2. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,331
    Location:
    Netherlands
    Hi Blackspear,

    It sounds like you have been "lopped"
    Info: http://www.doxdesk.com/parasite/lop.html
    Did you get any prompts to ask if you wanted to install the sponsor software at all?

    If you need any help removing it, let me know.

    Regards,

    Pieter
     
  3. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    That's exactly what it was, as part of my removal process I ran Spybot S&D, it picked up multiples of C2Lop.

    I was just working on th PC as per normal, when suddenly was asked did I want to upgrade to latest version of Messenger PLUS. Having used PLUS for over a year, I didn't see a problem, then the MONGREL infected my system.... Grrrrrrrrrrr. Half an hour later, having deleted Messenger Plus, several unwanted programs that had just installed themselves, reset Explorer to default settings, ran Spybot and also deleted Messenger 6.0, I finally had my PC back to normal. What a pig!!!!

    Cheers :D
     
  4. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,331
    Location:
    Netherlands
    Agreed. And then we are not even talking about how ugly that toolbar is. :D

    Good to hear you were able to get rid of it.

    Regards,

    Pieter
     
  5. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    Hi Pieter, unfortunately it still keeps popping back up, we have removed everything we can find through Regcleaner, run Spybot S&D, when I reboot the machine and 1st click on IE, up pops the toolbar.

    Your help would be greatly appreciated.

    Cheers :D
     
  6. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,331
    Location:
    Netherlands
    Hi Blackspear,

    I will need to see your HijackThis log.
    Please go to http://www.tomcoyote.org/hjt/, and download 'Hijack This!'.
    Unzip, doubleclick HijackThis.exe, and hit "Scan".

    When the scan is finished, the "Scan" button will change into a "Save Log" button.
    Press that, save the log as a .txt file, and copy and paste its contents into your next post.

    Most of what it lists will be harmless, so do not fix anything yet.

    Regards,

    Pieter
     
  7. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    Logfile of HijackThis v1.97.3
    Scan saved at 11:02:18 AM, on 5/11/2003
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Eset\nod32krn.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\hkcmd.exe
    C:\Program Files\Eset\nod32kui.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\3M\PSN2Lite\Psn2Lite.exe
    C:\Program Files\Karen's Replicator\PTReplicator.exe
    C:\Program Files\OpenOffice.org1.0.1\program\soffice.exe
    C:\PROGRA~1\3M\PSN2Lite\PSNGive.exe
    C:\Program Files\Outlook Express\msimn.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\DOCUME~1\pcuser\LOCALS~1\Temp\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearchnow.com/searchbar.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://mysearchnow.com/searchbar.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearchnow.com/searchbar.html
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {769bd0a9-b52a-434f-8ff4-be36eb7708db} - C:\DOCUME~1\pcuser\APPLIC~1\fsheandrth.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: hmzzeevlldr - {e7850a40-9c67-4f99-abb1-f4ea04b16e70} - C:\DOCUME~1\pcuser\APPLIC~1\fsheandrth.dll
    O4 - HKLM\..\Run: [NOD32POP3] "C:\Program Files\Eset\pop3scan.exe" /uninstall
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"
    O4 - HKLM\..\Run: [nod32kui] C:\Program Files\Eset\nod32kui.exe /WAITSERVICE
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - Startup: OpenOffice.org 1.1.0.lnk = C:\Program Files\OpenOffice.org1.0.1\program\quickstart.exe
    O4 - Startup: Replicator.LNK = C:\Program Files\Karen's Replicator\PTReplicator.exe
    O4 - Global Startup: Post-it® Software Notes Lite.lnk = C:\Program Files\3M\PSN2Lite\Psn2Lite.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: ICQ Lite (HKLM)
    O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Messenger (HKLM)
    O10 - Broken Internet access because of LSP provider 'imon.dll' missing
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab
    O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://203.166.82.178:81/activex/AxisCamControl.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37878.8793634259
    O16 - DPF: {BF5E26B7-7087-4C2D-B0BA-0098F7CBED6B} (LiveX(5.3.0.1) Control) - http://avbne.ath.cx/cab/Live.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
     
  8. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,331
    Location:
    Netherlands
    Hi Blackspear,

    Check the items listed below in HijackThis, close all windows except HijackThis and click Fix checked:

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearchnow.com/searchbar.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://mysearchnow.com/searchbar.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearchnow.com/searchbar.html

    O2 - BHO: (no name) - {769bd0a9-b52a-434f-8ff4-be36eb7708db} - C:\DOCUME~1\pcuser\APPLIC~1\fsheandrth.dll

    O3 - Toolbar: hmzzeevlldr - {e7850a40-9c67-4f99-abb1-f4ea04b16e70} - C:\DOCUME~1\pcuser\APPLIC~1\fsheandrth.dll

    Then reboot and enjoy the missing toolbar. ;)
    Also check your favorites. Some extra folders may have been added.

    Regards,

    Pieter
     
  9. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    Thanks Pieter, I saw those, but wanted to see what you came up with...

    Cheers :D :D :D
     
  10. proximo

    proximo Guest

    hello here, I was really in trouble with my msn messenger plus so I've started to look for something about it and have found this forum.
    Could you help me please?
    I'd like to remove evrything that comed up after the Plus installation (and the really ugly and useless blue toolbar on IE, too).
    I've read the posts and downloaded the Hijack This, and now I'm going to scan my computer.
    All I can do by myself is to remove the really enormous number of icons on my desktop and not wanted preferred links that was added.
    How can I get sure that all spyware, etc will be removed?
    In few words: what have I to do to get my computer as before?
    Thanks a lot!!!
     
  11. snowbound

    snowbound Retired Moderator

    Joined:
    Feb 18, 2003
    Posts:
    8,723
    Location:
    The Big Smoke
    Hi proximo :)

    Welcome to Wilders.

    Since u have already Downloaded HijackThis just follow step#1 in these instructions,

    https://www.wilderssecurity.com/showthread.php?t=15913

    then post your log in the Hijack cleaning forums with a full description of your problem and one of the experts with help u remove any Malware found.


    snowbound
     
  12. Kryptonate

    Kryptonate Registered Member

    Joined:
    May 3, 2004
    Posts:
    2
    If you update Plus! trough the update popup you'll get a question asking you whether you want to install the sponsorprogram or not. The same thing is shown when you install Plus! the normal way.

    Please do NOT use Ad-aware, Spybot S&D or any other program to remove Plus! or the sponsorprogram. Instead please follow the steps from the official Messenger Plus! forum. If you have any questions you can ask it on the Plus! forum, we will be glad to help you :).
     
  13. Detox

    Detox Retired Moderator

    Joined:
    Feb 9, 2002
    Posts:
    8,507
    Location:
    Texas, USA
    I'm very sorry Kryptonate; but you will find it hard to sell the bible to the devil himself.

    Our experts here have been dealing with LOP spyware for years, and they have done VERY well at it. There is no point in attempting to tell us how "Messenger Plus doesn't really do what it's been doing all these years" or how bad the tools which have been made for the community (and constantly improved by popular demand) are "bad" or useless.
     
  14. Kryptonate

    Kryptonate Registered Member

    Joined:
    May 3, 2004
    Posts:
    2
    how do you mean "Messenger Plus! doesn't really do what it's been doing all these years"? Plus! is improving with every update, next week Plus!3 will be released.
    The sponsor is indeed LOP but the sponsorprogram is especially made for Patchou (the creator of Plus!) and does not contain a trojan or any other malicious code in it. AVG said a while ago it contained a trojan, true, but AVG has apologised for it already and the new updates don't say it anylonger.

    If you say it contains spyware because your experts say it, then you have to think about the fact that experts can be wrong too. They're not gods who know everything. I'm not insulting or questioning the expertise of these experts, it's just a fact.
     
  15. Detox

    Detox Retired Moderator

    Joined:
    Feb 9, 2002
    Posts:
    8,507
    Location:
    Texas, USA
    I mean that the record of your "software" speaks for itself. I have seen an enormous amount of people come to these very forums over the years asking for help getting rid of these parasites which they did not intend to install. Excuses about some fine print in a EULA on a program which is usually installed due to a young person being mislead to believe it is actually related to Windows and/or Microsoft Messenger simply do not excuse the practice. Besides, if this program was so "up and up" why would you need to type a code for uninstallation?
     
Thread Status:
Not open for further replies.