Shoutbox

Note about Trojan detection - Printable Version

-Shoutbox (https://shoutbox.menthix.net)
+-- Forum: MsgHelp Archive (/forumdisplay.php?fid=58)
+--- Forum: Announcements (/forumdisplay.php?fid=1)
+---- Forum: Announcements & News (/forumdisplay.php?fid=2)
+----- Forum: Archive (/forumdisplay.php?fid=27)
+------ Thread: Note about Trojan detection (/showthread.php?tid=16516)

Note about Trojan detection by Patchou on 10-10-2003 at 07:14 PM

Hello,

after many people reported a trojan was installing with Messenger Plus!, I started to worry. Any moderate/advanced user know very well that if a trojan was installed with my software, a lot of other signs would be present than an anti-virus warning (like firewall alerts). Nevertheless, this certainely doesn't give a good idea to users in general. I contacted the sponsor company, they did some research, and as I suspected, some anti-virus (none of the major companies though) wrongly detect a trojan called Trojan.Download.Swizz in one of the setup files that the sponsor unpacks in your temporary directory.

The antivirus companies have been contacted and will soon fix this bug. Meanwhile, the sponsor setup package will be modified to not include the wrongly accused file. It's really bad to think about the bad publicity this has given to Messenger Plus! over the past two monthes, thank you for your continuous support, it's in time like this that's it's mostly appreciated.

Patchou


RE: Note about Trojan detection by Mnjul on 10-10-2003 at 07:21 PM

We always know the sponsor doesn't contain any spyware or trojan because Patchou asked the company to lighten the package:)

My PC-Cillin doesn't point it out though...By the way, the "trojan"(it's not:\)'s Trendmicro's name is TROJ_SWIZZOR.A.


RE: Note about Trojan detection by Patchou on 10-10-2003 at 08:22 PM

Mnjul: sorry I edited your post. there's no need to post on mess.be about it, people will quickly read it and think that there was trojan and that it has been removed.. trust me, there's no need :)


RE: Note about Trojan detection by dotNorma on 10-10-2003 at 09:21 PM

Hmm... thats funny because I don't use any anti-virus program and I installed AVG a couple days ago and when i ran my first scan it deteced download.swiss :P I was a little worried but now i know its just a false alarm. Much needed post patchou ;)


RE: Note about Trojan detection by DarKnight on 10-10-2003 at 11:20 PM

I use Norton. (h)

And I know Patchou would never do anything bad to our PC systems. :(


RE: Note about Trojan detection by dotNorma on 10-10-2003 at 11:24 PM

Well in my scan it didnt say it was coming from plus or anything i just thought i downloaded a bad program like those old things on mess.be that infected my comp. I would never ever beleive it if it said a trojan was in plus! not even if i got paid :P


RE: Note about Trojan detection by Mnjul on 10-11-2003 at 01:17 AM

quote:
Originally posted by Patchou
Mnjul: sorry I edited your post. there's no need to post on mess.be about it, people will quickly read it and think that there was trojan and that it has been removed.. trust me, there's no need :)
Patchou it's very OK...because you didn't know if I am still at my computer (you don't have me on your list:P) and couldn't tell me to edit it.

Sorry for that:(

Blah, truth never changes;) Plus! is still the best Messenger add-on ever, and the sponsor is not harmful at all;)
RE: Note about Trojan detection by matty on 10-11-2003 at 05:32 AM

I shall reinstall it from the post that claimed he found a trojan and double check (as well installing the sponsor)
be back with more info

Scan complete, nothing found


RE: Note about Trojan detection by surfichris on 10-11-2003 at 07:05 AM

I'm still conducting those tests Patchou, so far i have seen no outbound traffic from the Virtual Machine except for when it gets its DHCP lease.

Anyway, ill report back to you :)


RE: Note about Trojan detection by Stigmata on 10-11-2003 at 08:12 AM

ive found nothing as well


RE: Note about Trojan detection by Choli on 10-11-2003 at 11:15 AM

:P Don't spend your time in looking for virus/trojans/etc... in Plus! You won't find anything ;)


RE: Note about Trojan detection by CookieRevised on 10-11-2003 at 12:10 PM

quote:
Originally posted by Choli
:P Don't spend your time in looking for virus/trojans/etc... in Plus! You won't find anything ;)
In Plus! no.... In the sponsor: yes... read this
http://shoutbox.menthix.net/showthread.php?tid=16...d=143309#pid143309

PS: although AVG reports a trojan, this doesn't mean it is a trojan.... I just report the facts.... We had a conversation about all this the other day on IRC.... Patchou also replied on this in a few threads.... Saying that you will not find anything before checking it first yourself is like..... well I shut up again....

quote:
Originally posted by Chris Boulton
I'm still conducting those tests Patchou, so far i have seen no outbound traffic from the Virtual Machine except for when it gets its DHCP lease.
Anyway, ill report back to you :)
Good to know though....

Whenever this situations is solved, I would be great to see a full report (how it's descovered, how to recreate the trojan-alert, reports on (non-)activity, replies from patchou, etc...) to redirect people to when they say there is a virus/trojan/whatever in Plus!...

RE: Note about Trojan detection by kao on 10-11-2003 at 08:18 PM

My Norton picks up nothing at all ^o)


RE: Note about Trojan detection by BooGhost on 10-11-2003 at 11:57 PM

quote:
Originally posted by Kao
My Norton picks up nothing at all ^o)
neither my McAfee, i think the problem is just with AVG.... or something like that
RE: Note about Trojan detection by Mr.Str@nge! on 10-14-2003 at 09:55 PM

At my WinXp-comp Norton doesn't tell me anything about a socald 'trojan'.

But at my WinME-comp Norton does. A sort of solution: disable a programm at startup: START > RUN > msconfig > Startup > And then uncheck a programm with a very strange name (several letters without any thought about the combination)
This helped me to get rid of the Norton 'virus/trojan' messages.


RE: Note about Trojan detection by roxanneu on 10-14-2003 at 10:25 PM

whew...that's a relief.  I received that message today, but nothing had changed on my machine, other than a Norton update!

Thanks,
-RMU


RE: Note about Trojan detection by Wabz on 10-15-2003 at 12:06 PM

Hmmmm  Like I'd ever believe Patchou would put a trjoan into plus


RE: Note about Trojan detection by carolinadrew on 10-15-2003 at 12:37 PM


The antivirus companies will NOT be fixing this bug because well, it isn't a bug.  Although the Messenger Plus program itself is clean, the bundled adware does not get uninstalled when you uninstall Messenger Plus.  In particular, a file name wcivbovm.exe is left behind in the Application Data folder and a setup.exe is left behind in a c2media folder.  Both of these are trojans because when ran they connect to another web site and download and install programs to the computer with absolutely no interaction from the user.  Among the things my users experience are pop up ads asking to play poker, menu toolbars, and data mining utilities.  The virus companies will not change their minds about this because this is by definition a trojan.  These sponsor programs have caused major headaches here.  I've notified Mcafee and Symantec of the issues and sent documentation so that this stuff stays classified as a virus.

Also, the installation of a Trojan from within a network will not necessarily trigger a firewall alert as stated.  The firewall is predominately used to control outside connections.  I realize that Patchou may not understand the depth of this ad software but since his program installed it, he should accept some of the responsiblity for not being thorough about what his sponsor programs install.

We have decided to completely remove Messenger Plus from all systems here as a result of these problems.  Its the most irresponsible thing I've ever seen done with a piece of free software.

Drew


RE: Note about Trojan detection by Choli on 10-15-2003 at 12:54 PM

quote:
Originally posted by carolinadrew
the bundled adware does not get uninstalled when you uninstall Messenger Plus
Did you reboot after uninstalling?
quote:
Originally posted by carolinadrew
Also, the installation of a Trojan from within a network will not necessarily trigger a firewall alert as stated.  The firewall is predominately used to control outside connections.
If you configure well your firewall, it'll notify you all the suspicious connections and will report all the connections that any trojan on your PC makes.
quote:
Originally posted by carolinadrew
I realize that Patchou may not understand the depth of this ad software but since his program installed it,
his program??? didn't you choose to install the sponsor?
quote:
Originally posted by carolinadrew
he should accept some of the responsiblity for not being thorough about what his sponsor programs install.
You did accept to install a program (sponsor), so you should have read the license and should have agreed it. So it is not Patchou's responsiblity but yours.
quote:
Originally posted by carolinadrew
We have decided to completely remove Messenger Plus from all systems here as a result of these problems.
Why? If you want to use Plus!, use it. If you don't like the sponsor, just don't install it, as you can use Plus! without it.
quote:
Originally posted by carolinadrew
Its the most irresponsible thing I've ever seen done with a piece of free software.
It would be irresponsible if Plus! didn't warn you the fact that it was going to install a sponsor. But Plus! did. It showed a window asking you to install the sponsor or not and you agreed even if you didn't read and didn't want to.

Don't put the blame on Patchou and his sotfware. Sorry, it's your fault, not Patchou's.
RE: Note about Trojan detection by AustinM1983 on 10-15-2003 at 01:14 PM

i do agree but i would pefer plus without the added software ... i know you can chose not to instal the program but alot of people are very IT intolerent and thus i don't see the current solution as the best choice ... although i don't know what would be a better one ... i do understand that patchou needs the money that this software provides .... i just think it would be better if a link was added to plus every version of pluss .. in this site would be details on the program and the user could chose to instal it or not ... the program added to pluss should offer something like a animated web helper or something so plus is advertising for this program and not just giving it all plus customers that don't read when they instal programs,,,

i don't know the best solution i just hope their can be a better one than what is current ... and yes i think the current one is alot better than it could be to ...

thanx Austin


RE: Note about Trojan detection by musicalmidget on 10-15-2003 at 01:28 PM

quote:
Originally posted by wabz
Hmmmm  Like I'd ever believe Patchou would put a trjoan into plus

Yeah, exactly.

Why would he even want to? :-/
RE: Note about Trojan detection by bl1nkr0x on 10-15-2003 at 04:19 PM

just a thot - but how about changin the install process lightly for wen u install the sponsor?

i no Patch wants ppl 2 install it so he can get sum money - BUT alot of ppl r put off as they dont read those wee install screens thoroughly (if at all) and accidentally install teh sponsor software - therefore getting ads on their desktop - they assume it was Plus! and uninstall it

i no this isnt patch's fault at all but still it might be better if instead of making the box in the install program ticked and u have 2 untick it - how about makin it unticked and u have 2 tick it?

i think this wud help a lot

if u wanted 2 go further u cud even make it a special option at the end of installation and have its own installation (not in background) so that ppl nu exactly what it was maybe with screenshots of it or sumthin.

just a suggestion 2 keep ppl happy :)


RE: Note about Trojan detection by BooGhost on 10-15-2003 at 06:22 PM

quote:
Originally posted by musicalmidget
quote:
Originally posted by wabz
Hmmmm  Like I'd ever believe Patchou would put a trjoan into plus

Yeah, exactly.

Why would he even want to? :-/
Does Bill use MsgPlus! :rolleyes:
RE: Note about Trojan detection by Patchou on 10-16-2003 at 01:47 AM

carolinadrew: I'm sorry you can't make the different between an adware, a virus and a trojan because they all are very different softwares. Detecting an adware as a trojan is similar to seeing a lizard in your house and calling the police to report an aligator. As documented in my software, companies who want Messenger Plus! can automate the installation with the /InstallInstallNoSponsor command line. You know a lot of software that offer the same option? I don't.

I accept responsability for what the sponsor installs on your computer, which is almost nothing except for a search bar in Internet Explorer (wow, what a Trojan). If some users report problems related to the sponsor, I forward them to C2Media, they make a fix and I release an update. So far, no real problem was reported with the sponsor. People saying that it doesn't unisntall properly are people who tried to play smart, and deleted some files themselves before trying to uninstall the software. And as it's the case for any other program, if you delete some important files, the whole program refuses to uninstall at it's no more capable of restoring the system properly. The only thing bad with all that are incompetent IT who don't know how to do their job.

I don't like to say those things but you forced me to defend my point.

Patchou.


RE: Note about Trojan detection by Patchou on 10-16-2003 at 01:55 AM

Btw, I just checked Symantec web site and they do agree with me: http://securityresponse.symantec.com/avcenter/ven...ad.adware.lop.html ...it's not listed as a trojan anymore.


RE: RE: Note about Trojan detection by bra1nwash on 10-16-2003 at 07:01 AM

quote:
Originally posted by bl1nkr0x
just a thot - but how about changin the install process lightly for wen u install the sponsor?

i no Patch wants ppl 2 install it so he can get sum money - BUT alot of ppl r put off as they dont read those wee install screens thoroughly (if at all) and accidentally install teh sponsor software - therefore getting ads on their desktop - they assume it was Plus! and uninstall it

i no this isnt patch's fault at all but still it might be better if instead of making the box in the install program ticked and u have 2 untick it - how about makin it unticked and u have 2 tick it?

i think this wud help a lot

if u wanted 2 go further u cud even make it a special option at the end of installation and have its own installation (not in background) so that ppl nu exactly what it was maybe with screenshots of it or sumthin.

just a suggestion 2 keep ppl happy :)

hmm it might b a gd idea!;) patchou shud consider it...
RE: Note about Trojan detection by KnightieBoy on 10-17-2003 at 11:46 AM

quote:
Originally posted by Patchou
Btw, I just checked Symantec web site and they do agree with me: http://securityresponse.symantec.com/avcenter/ven...ad.adware.lop.html ...it's not listed as a trojan anymore.
Good to hear (Y) :) its not even listed on my virusscanner :dodgy: eSafe :dodgy:
RE: Note about Trojan detection by Guido on 10-17-2003 at 07:40 PM

quote:
Originally posted by Patchou
after many people reported a trojan was installing with Messenger Plus
Yeah, we even have received quite a few claims at gfdd.net about antivirus software detecting "plus as a trojan".

quote:
Originally posted by musicalmidget
quote:
Originally posted by wabz
Hmmmm  Like I'd ever believe Patchou would put a trjoan into plus

Yeah, exactly.

Why would he even want to? :-/

Well, actually, to earn lots of money :P. But I know Patchou pretty well and I'm 100% sure he hasn't done it, he is not doing it and would not do it either.
RE: Note about Trojan detection by si3rra on 10-17-2003 at 11:16 PM

Hay Patchou!..
maby u should realse the md5 hash with the next realse..
There maby somone putting a trojan in your program and then uploadning it.. for public download..
If u realsese md5 hash and u tested and u included no torjan or virus..
i download and check md5 and it matches then people can stop the whining!:..


RE: Note about Trojan detection by Patchou on 10-17-2003 at 11:22 PM

quote:
Well, actually, to earn lots of money


There's no way you can make a penny by distributing a trojan.. who would pay you to open backdoors on your computer? trojans are useful to hackers only.

As for encrypting the file, I dont need to, I control the official distribution souces and I know that I won't distribute a virus or a trojan or whatever else similar in Messenger Plus!, ever. I don't worry. Now that antivirus software shave been updated, we won't get anymore of these reports.

Patchou
RE: Note about Trojan detection by Guido on 10-18-2003 at 12:46 AM

quote:
Originally posted by Patchou
There's no way you can make a penny by distributing a trojan.. who would pay you to open backdoors on your computer? trojans are useful to hackers only.
Yes, i know - and you have a point there. However, there is always weird people who pay others for weird things :D.

I was obviously (and mistakenly) talking about spyware -- sorry :P
RE: Note about Trojan detection by Vantage on 10-20-2003 at 01:16 AM

Hey Thx SOOOO much Patchou I really needed that Post ;)
(y)


RE: Note about Trojan detection by Odin.EXE on 10-20-2003 at 09:44 AM

Mmm... Nothing happen to mine Anti-Virus... Ut fight virus daily but nothing has found on msg plus... I belive Patchou!


RE: Note about Trojan detection by chrisbloe on 10-20-2003 at 09:29 PM

I'm likin' the look of the 2.50 that I saw on mess.be :-) Nice work Patchou


RE: Note about Trojan detection by GiantSpider on 10-21-2003 at 06:13 PM

isnt that funny. I use AVG 2 but it didnt find that and i always keep it updated but thanx anyway patchou


RE: Note about Trojan detection by CookieRevised on 10-21-2003 at 06:16 PM

If you would install the sponsor you would have got a notice of a virus with the previous AVG... (see other numerous threads)
But never mind this post, just a comment...


RE: Note about Trojan detection by GiantSpider on 10-21-2003 at 06:30 PM

ok
thanks 4 dat

But let it be nown that i dont download sponser because i USED 2 use kazaa (and we all no wot crap comes with that) but i hav give msg + 2 all my friends


RE: Note about Trojan detection by Patchou on 10-27-2003 at 06:45 PM

Well, it has been proven that there never was a trojan in Messenger Plus!, I can close this thread :)