Today on irc someone came in with a problem with installing Plus! Me and Sunshine went to work and found out it was a virus. When i downloaded Plus! From the site and from Simtel I got this.



Now the 3-02 version i got from the site and the .zip I got from Simtel. Sunshine scanned and found no virus' but it is weird no?

EDIT: Both Files are 3.01.94

quote:

---

Originally posted by Stigmata
simtel like to include there own files

---

Well the only file in the .zip was MsgPlus!.exe

You betcha

rar a .zip?

Errmmm, Stigmata:
1) the files on Simtel are exactly the same as the one yo find on Patchou's server. The only thing that simtel does is to zip them, nothing more...
2) The point in being a mirrorsite is that they do not alter any of the files they host!
3) You can't hide a file inside a zipfile
4) "rar the file, then using winrar to unrar it it will show u everything inside  have a check" ... that makes absolutely no sense...


GiantSpider has send the file to me...

Size:
Original Plus! 3.01.94: 3.497.984 bytes
Infected Plus! 3.01.94: 3.502.080 bytes (=4096 bytes bigger)

TimeDateStamp: (this is not the timedatestamp that you'll see in windows, but this is the timedatestamp from when the exe file was actually made; it is found inside the exe-header itself)
Original Plus! 3.01.94: 2/6/2004 22:29:47
Infected Plus! 3.01.94: 24/7/2004 22:31:36 (=yesterday!)

The resources (aka setupfiles etc...) inside are the same

Remarks:
It is very strange that the file was downloaded at an official source while the file was named MsgPlus-302.exe.

Note that this happend only to GiantSpider and the person on IRC!

As well as GiantSpider as the person who came on IRC got this file from downloading it from an official source.

The thing that popuped up after installing was "Bad Elmo, u need to install this with the parental program"...

A scan of the file resulted in nothing, no detected infection. (at least as far as I can tell with a cheap/free scanner )

Although I can't find anything (at this moment after a quick search) related to a virus, this has been reported before with other people (and other files):
http://club.cdfreaks.com/showthread.php?t=84510
http://www.pchelper.nl/forum/index.php?showtopic=1718
http://www.talkroot.com/archive/topic/14496-1.html

Also, together with the "bad elmo"-talk, there is also talk about a related MP3_plugin.exe (someone says this is the source of the problem), and inside that file I find "http://www.lop.com". Logic, if you consider that someone else says that that file is the LOP installer. But why the strange name then?).. :/

Conclussion:
* Or both are infected with some kind of spyware/virus/trojan/whataver (but it is strange that this only happend once and only with Plus! downloading)
* Something is fishy with the sponsor-program (LOP acting up again?)

Note:
Although it seems that it is some malicious thing called "Bad Elmo", it is realy frustrating that you can't find ANYTHING about it on the net. The only things you find are "it is spyware", "it is a virus", etc... but nobody or no company reports about what it ACTUALY is and what it EXACTLY does....

I just downloaded it from Simtel and there was nothing in it.

Nothing as in empty?

Kryptonate means "nothing" as in "nothing wrong with the file"....guess not :/

I highly doubt anybody else will get the MsgPlus-302.exe file, see my previous post...

quote:

---

Originally posted by GiantSpider
Nothing as in empty?

---

quote:

---

Originally posted by CookieRevised
Kryptonate means "nothing" as in "nothing wrong with the file"....
I highly doubt anybody else will get the MsgPlus-302.exe file, see my previous post...

---

wow... straaaange... of all the people I just asked now to download Plus! from Simtel (to check), they all got the same official untampered file...

anyways, GiantSpider, if you've run the 302-file, can you do a scan with Spybot S&D and attach the log in a post here?

quote:

---

Originally posted by CookieRevised
wow... straaaange........

---

Actually that page looks "right" in the sense that it has a broken layout in your browser though....

But look how it should actualy look (see attachment)...
As you can see, everything is similar, except the layout differs a bit. Maybe this is because it couldn't load the part where the actual listings of the downloads are... can you try again?

hm, looks like that

I tried downloading from the Belgian mirror and the Canadian one.
Belgian one:
0kb
Canadian one:
packed size = 3.434.050
total size = 3.497.984

Hmm i done some dl-ing myself an noticed a slight diff in the size:

msgplus-301.exe dl on 17-7-2004  3416kb
(edit: hmm dodgy date, i dont recall re-dl it)
msgplus-301.exe dl today  3420kb
(both times dl-ed from www.msgplus.net)

have there been changes since i dl plus!3 wich will explain this diff?

Also i scanned the files (received from GS an my own dl's) with Antivir Guard an Spybot S&D an it came up with nothing ( i haven't executed the files)

Edit: dl's from Simtel can vary cuz the dl come from mirrors not from the actual site....talk about lookin for a needle in a haystack :/ Also the person comin onto IRC today dl from msgplus.net (we told him to redownload).

quote:

---

Originally posted by CookieRevised
Infected Plus! 3.01.94: 3.502.080 bytes (=4096 bytes bigger)

---

quote:

---

Originally posted by Kryptonate
I tried downloading from the Belgian mirror and the Canadian one.
Belgian one:
0kb

---

quote:

---

Originally posted by Sunshine
Edit: dl's from Simtel can vary cuz the dl come from mirrors not from the actual site....

---

quote:

---

Originally posted by Sunshine
Hmm i done some dl-ing myself an noticed a slight diff in the size:
msgplus-301.exe dl on 17-7-2004  3416kb
msgplus-301.exe dl today  3420kb
(both times dl-ed from www.msgplus.net)

---

quote:

---

Originally posted by Kryptonate

quote:

---

Originally posted by CookieRevised
Infected Plus! 3.01.94: 3.502.080 bytes (=4096 bytes bigger)

---

just downloaded this one from msgplus.net

---

Thanx alot everyone for your help and research into this. Does Patchou know about this. I think this could be a thing for him to look into.

MsgPlus-302 = 3,502,080 bytes (From Official Site)
MsgPlus-301 = 3,497,984 bytes (From Official Site)
MsgPlus-301 = 3,502,080 bytes (From Simtel)

All of the above are the same file!

yeah, he proberly knows, he updated the sponsor package (I've been told by trusted people )...

since when is there a 302? It's not even in the download section of the site

There isn't. Look read the goddamn thread mkthx