Dear staff member(s),

Recently a site named <removed> has started. This site contains an MSN-hijacking tool that is used by many people. Opening the site will result in an automessage saying the following:

Wanna be a MSN-hacker? So you can mess with al your friends? Go to <link removed>

This program violates a law that must be respected. That law is privacy violation and is STRICTLY forbidden. I had contact with MSN Netherlands, and they said the following [translated from Dutch to English]:

"Dear Frits,

The problem you have brought to us is ONLY possible to be active with any version of Messenger Plus! installed. We recoomend you to get in contact with Patchou."

I e-mailed the internet host aswell, called Planet Internet BV. [www.planet.nl] I'm still waiting for their reply. I did a little research and found out that the MSNFunMaker is an MSN Trojan 5.0/MSN Spider and that the .exe makes a file on the Pad it's put in named gmon.out. I tried to delete it, but no result came out of it.

What I want to reach with this forum post is that you, from MessengerPlus.NET/Patchou.com consider making a program against it, or preform legal steps against the site owner(s).

Sincerly,

Frits Mijnders
The Netherlands
dafrizz@gmail.com

Frits, it's very good that you inform people about this.  
WHOIS on the <removed> gives this address:

Registrant:
   Ab Decor
   Ijsselstraat 21
   Ijsselstein, Utrecht 3401DY
   NL

I checked this address with Routenet.nl (I'm also Dutch) and this address is fake . Same goes for the telephone number on the WHOIS page: 0573408448. The province of Utrecht, and IJsselstein for sure, has regional number 03(0) and not 057.

You're right that Planet.nl should remove this site from their servers as soon as possible, and I hope they will.

(The 'root' of the Planet.nl account picturecentre is hosted on shows this site: <link removed> which contains no info about the user..)

BTW.. I downloaded the installer exe but Norton doesn't detect it as a virus. I scanned the file with the online malware scanner and only 2 of the 12 scanners give a hit:
Kaspersky Anti-Virus  Trojan-Dropper.Win32.WinAD.d (1.02 seconds taken)
mks_vir  Trojan.Dropper.Winad.D (0.22 seconds taken)

dang that seems dangerous.. so if we get Plus! off are we sure to b okay?!

I don't see any way Messenger Plus has anything to do with this. Strange reply from MSN...

(btw, isn't this in the wrong forum?

quote:

---

Originally posted by lp15
dang that seems dangerous.. so if we get Plus! off are we sure to b okay?!

---

its probably a plugin for messenger plus!, and there is a disclaimer saying that messenger plus! plugins may cause dodgy behaivour (not in those exact words)

Its like blaming bropia on microsoft.

Just to clear some things up:

What I understand from dafrizz and the <removed> site is that it's supposed to be a hacking tool which attacks people using Msgplus. I think this is not true and it's just a virus/trojan that's installs itself and claims to be Msgplus.
If you read the readme of the tool it says you have to type commands like

"name(...)" where '...' should be the name you want you contact's name to change to.
These are no normal Msgplus commands... (which start with a '/').

@ lp15:
There is NO need to remove Plus. This is a virus/trojan, and it doesn't spread trough MSN/Msgplus, so only if you download/execute it yourself it's a problem. Just don't run it and never accept anything like it from your contacts.

@ Juzzi:
Msgplus has nothing to do with it in the first place, but the 'hacking tool' claims to be a tool which attacks Msgplus users. I think Microsoft is just being naïve; this is just a MSN trojan which probably also works on MSN users without Msgplus.

I know a firend who uses this...

quote:

---

Originally posted by Vilkku
I know a firend who uses this...

---

me and ash tried it, but it didnt work.

I don't think it matters if it works or not... . It's probably a backdoor trojan, so the 'creator' of the program can also 'hack' your msn...

The 'hacker' needs to give another contact 'a file', before he can 'hack' his contact. I think it promotes itself to the 'contact' as a colored message or something (that's why it should only work with people who have Msgplus installed). Maybe it promotes itself as a plugin. I don't know.... . At least I don't believe that it's something that only affects Msgplus users..

<link removed>
Check that out, "Robert de Vries"... no Ab Decor, that's a prank

"Robert de Vries" sounds kinda prank too. It's "too typically Dutch" (I don't know how to say this well). My guess is that it's a second fake name

quote:

---

Originally posted by Markus
"Robert de Vries" sounds kinda prank too. It's "too typically Dutch" (I don't know how to say this well). My guess is that it's a second fake name

---

'GP'...?      in 'a village in NL'?     You 'found that out'?    (You mean discovered)

quote:

---

The problem you have brought to us is ONLY possible to be active with any version of Messenger Plus! installed. We recommend you to get in contact with Patchou.

---

quote:

---

Originally posted by Markus
I think Microsoft is just being naïve;

---

quote:

---

This cool thing works on all MsnVersions, inclusief MsnPlus.

---

quote:

---

Originally posted by Markus
'GP'...?      in 'a village in NL'?     You 'found that out'?    (You mean discovered)

---

It just installs adware/spyware, and a shitload of it. (Internet Optimizer, etc..)

quote:

---

Originally posted by CraigDowel
http://www.huisartsen-laren.com/

there you are... The domain name was previously registered by Robert the Vries he is on the game  for a long time..

---

quote:

---

Originally posted by CraigDowel
My mistake, but indeed, he is a dutch guy, check my updated previous post.

---

quote:

---

Originally posted by Markus

quote:

---

Originally posted by CraigDowel
http://www.huisartsen-laren.com/

there you are... The domain name was previously registered by Robert the Vries he is on the game  for a long time..

---

quote:

---

Originally posted by CraigDowel
My mistake, but indeed, he is a dutch guy, check my updated previous post.

---

I see... <link removed> was also about Laren. (which is a small town in gelderland, holland. I checked the postal code from the huisartsen-laren.com site)

---

quote:

---

Originally posted by CraigDowel
No, Robert is true. His father is a GP in a village in NL... I found that it out.

http://www.huisartsen-laren.com/

there you are... The domain name was previously registered by Robert the Vries he is on the game for a long time..

---

quote:

---

Originally posted by CraigDowel
Jep, but that's just a start. He has built MSN Trojans previously

---

hehehe LOL de program works perfect with or without plus yes it's Ilegal and the only thing your are doing is making free promotion and telling us to download, in fact maybe that was the propuse of these thread... you sholud thing about it!!

I tried it....when I tried opening from zip archive....It said.... Error: win32.ddl not found....

edit: it does the same when it's out of the zip also.... wtf!! what is this peice of shit virus?

* Purity will shit if norton doesn't update their software to this shit!

quote:

---

Originally posted by Purity
I tried it....when I tried opening from zip archive....It said.... Error: win32.ddl not found....

* Purity will shit if norton doesn't update their software to this shit!

---

F***!, No one download this! Installs a bunch of malware, and possible virus! F***!!!!! So many processes!!

This is screwing up my computer big time!

I did a system restart right....but before restart I deleted all the unneeded processes and backround programs....such as:  bargins, slml, MediaAccess, MediaAAK. And when I logged back in after restart...I got a message saying invalid Reg key.... or someting like that then it said that it fixed it....(in the same message...) And it took forever to log in!

This just disabled my auto protect...

quote:

---

Symantic user session

Blah blah blah....

Send report      dont sent

---

yes, it socks, system freeze softwares are cool in theses cases, I alwayas turn it on before install trojans like this one...
The computer's client is the one who crash, not yours, You don't need to install anything..

I'm scanning for viruses right now....my Norton auto protect was on when I tried installing the program...

This virus has covered everything.

like seriously, I stopped it from starting at startup and it fixes it back to enable on startup! F*** sakes! 

This is pissing me off soo much!:mad:

lol, stupid plug-in, it just about got me yesterday

ermmm... guys I hope you all were smart enough to not launch such things in your main Windows Installation.

NEVER EVER run stuff like that outside a closed virtual environement or test computer and without the proper knowledge on what you exactly are doing!!!!!!!!!!

Things like this always leave stuff behind or stuff which can not be recovered from.

get the ip address of the site and then go to http://network-tools.com

Did you actually install it?!?!?!?!

Hasnt this whoel thread been about not installing it......
and hwy would you download a virus anyway? leave that to symantec

quote:

---

Originally posted by Purity
I'm scanning for viruses right now....my Norton auto protect was on when I tried installing the program...

This virus has covered everything.

like seriously, I stopped it from starting at startup and it fixes it back to enable on startup! F*** sakes! 

This is pissing me off soo much!:mad:

---

quote:

---

Originally posted by Segosa
It just installs adware/spyware, and a shitload of it. (Internet Optimizer, etc..)

---

quote:

---

Originally posted by CookieRevised

quote:

---

Originally posted by CraigDowel
No, Robert is true. His father is a GP in a village in NL... I found that it out.

http://www.huisartsen-laren.com/

there you are... The domain name was previously registered by Robert the Vries he is on the game for a long time..

---

how do you 'find out' that 'GP' is the father of Robert de Vries?????? Also Robert de Vries can be a very common name. You can't 'find out' such details (father/son/etc...) without a page where it clearly states and links all these together, and even then it can be someone with the same name...

quote:

---

Originally posted by CraigDowel
Jep, but that's just a start. He has built MSN Trojans previously

---

how do you know this?

---

Ummm....If the plugin is strictly forbidden...then why did you post the link? Also if it were possible to shut someone's computer down via Messenger; and do all kinds of other things to their contact list, shouldn't someone be a little suspicious;

*psssttt* For future reference; "msntrojan supermsntrojan msn" appears at the top of the Title Bar in your Internet Browser

Common Sense People Just use Common sense, don't download anything that sounds too good to be true.

quote:

---

Originally posted by jtstone1983
Ummm....If the plugin is strictly forbidden...then why did you post the link? Also if it were possible to shut someone's computer down via Messenger; and do all kinds of other things to their contact list, shouldn't someone be a little suspicious;

*psssttt* For future reference; "msntrojan supermsntrojan msn" appears at the top of the Title Bar in your Internet Browser

Common Sense People Just use Common sense, don't download anything that sounds too good to be true.

---

It's not stricly forbidden.. it's just a program that installs shitloads of mal-/ad-/spyware. But it's hosted from a Planet.nl homepage site, and that's against the Terms & Conditions of Planet.nl. They should delete his webspace (and maybe cancel his internet account, because if he has a planet.nl homepage site he also has planet.nl as ISP.

Still making a point though, just use common sense, anything with the word Hack and Take Over always leads to spyware and viruses...

Eventually it will be deleted, the same thing happened on the mess.be forums when somebody posted a direct link to updates.exe for Bropia;

Side Note: The Main link on the first post should be removed and renamed; this prevents complaints to Patchou, and pointless threads in the Help and Support section complaining about spyware that isn't related to Plus.

quote:

---

Originally posted by Segosa

quote:

---

Originally posted by jtstone1983
Ummm....If the plugin is strictly forbidden...then why did you post the link? Also if it were possible to shut someone's computer down via Messenger; and do all kinds of other things to their contact list, shouldn't someone be a little suspicious;

*psssttt* For future reference; "msntrojan supermsntrojan msn" appears at the top of the Title Bar in your Internet Browser

Common Sense People Just use Common sense, don't download anything that sounds too good to be true.

---

It isn't even a trojan, just an ad/spyware installer.

---

time to prun this thread

Good Idea; maybe remove the link too; prevent further downloads as well

I came to a total of 53 possble/adware viruses, I kinda wish norton wouldn't look for spyware and adware, because all I really wanted to see was how much viruses I had..

Bah, deleted it all!

It doesnt look good.

quote:

---

Originally posted by saralk
me and ash tried it, but it didnt work.

---

quote:

---

Originally posted by John Anderton
It doesnt look good.

quote:

---

Originally posted by saralk
me and ash tried it, but it didnt work.

---

I hope that it doesnt work for everyone cause i got really odd msg's
I got a invite from someone i dont know (invite to add to the list) and then she said that it wasnt added by her . Also i got a msg from a person that was a friend of my friends and i had added her once but i only spoke to her once then deleted her address but i got a pic from her (msg asked me permission to send it) and it was titled new naked pic of me and i know she wouldnt do that
WTF is happening

---

quote:

---

Originally posted by Segosa
You've been abducted by aliens.

---

quote:

---

Originally posted by John Anderton

quote:

---

Originally posted by Segosa
You've been abducted by aliens.

---

huh ??? What ?? Pardon me

---

quote:

---

Originally posted by andrey
What I wanted to say is that the <link removed> website has just disappeared and has been replaced by a "page not found" page.

---

Its back up.

He's my classmate from last year, he's a pritty weird guy I can tell you..

LOL.. the stupid fool uploaded his website somewhere else. Now it's angelfire. Let's send them an email .

EDIT:
* user13774 clicks the angelfire banner

* user13774 finds a 'report abuse' button...

* user13774 reads the Report Abuse information page[/url]

* user13774 thinks the site is violating this rule:
Piracy / Hacking / Copyright Violations - It is forbidden to provide pirated materials on your Lycos web site. This includes software and serial numbers. We will remove your site if it provides tools or information about computer hacking. Your account will also be removed if it is found to be in violation of the Digital Millennium Copyright Act.

* user13774 fills in the 'Report Abuse' form..

DONE

Ahh it dont work. Pile of crap it is.

quote:

---

Just send the file <removed> to someone in your MSNlist.
When this person opens the file, he or she will go offline for a few secconds and then come online again.
At the moment she or he comes back online again, you can start messing around with him/her.

---

it don't work tho

or maybe it seems like it doesnt? the whole point of it being a trojan would for it to be hidden

Sorry for the late reply, but my friend said it works. After a day he had to format his comp because of some problems...

Anyway, he is a computer n00b and formats every week because the comp gets slow.

hmmm... now I have to phone another hosting company? Djeez....
* CookieRevised thinks this guy isn't going to give up... me neither

too bad DDossing is forbidden in Holland

he but yeah reporting abuse over and over would work

Well... Whois.net says:

Registrar: <removed>
   Domain Name: <removed>
      Created on: 19-MAR-01
      Expires on: 19-MAR-06
      Last Updated on: 15-MAR-05

So I went to <link removed> and there you can Report Spam as they call it. I think that is what we're looking for. I will  fill in their 'Domain Complaint'.

filed one if every one does it they cant ignore us

quote:

---

Dear NamesDirect,

I want to complain about the domain <removed>. The owner of this domains promotes hacking software for MSN Messenger, a product of Microsoft Corporation. But next to that the program itself contains virusses and multiple types of ad-/spyware. He has been kicked from a few webhosts (i.E. Planet Internet, www.planet.nl) where he hosted his site. Currently his site is being hosted by Angelfire, but I already reported his site to Lycos, the owner of Angelfire.

Can you please take action against (the owner of) this domain?

Thank you,

Mark

---

quote:

---

Your complaint has been submitted. Our Abuse Department will contact the owner
of the domain that a complaint has been filed. They will investigate and if
necessary disable the domain. This process can take up to 15 days.
Thank you for your patience.

NOTE: Please do not enter multiple complaints. This can prolong the
investigation and delay resolving the situation in a timely manner.

---

quote:

---

Originally posted by Markus

NOTE: Please do not enter multiple complaints. This can prolong the
investigation and delay resolving the situation in a timely manner.

---

why would anyone install that thing when they saw this thread?

quote:

---

Originally posted by Lieter
filed one if every one does it they cant ignore us

---

quote:

---

Originally posted by Lieter

quote:

---

Originally posted by Markus

NOTE: Please do not enter multiple complaints. This can prolong the
investigation and delay resolving the situation in a timely manner.

---

hehe that should be fun

---

IT clearly states on the "NOTE" that multiple reports will just delay the process! Why would you feel another one?

stupid me, ok youre right.. i gotta agree (i filed 1 in total)

This is like the bropia kinda, sending links to contacts saying 'Wanna hack msn messenger [URL]"

Guys, this domain is not directly registered to namesdirect, but to namezero. But namezero is a namesdirect company. The site works with an url forwarder... <link removed>

And another hint, just phone the company and file your complain. They mostly ignore such complains filed by email, their policy also says that picturecentre is not 'directly' acting illegal...

Oh <link removed> is the real site, maybe complaining works here...

quote:

---

Originally posted by CraigDowel
Oh <link removed> is the real site, maybe complaining works here...

---

quote:

---

Originally posted by CraigDowel
Guys, this domain is not directly registered to namesdirect, but to namezero. But namezero is a namesdirect company. The site works with an url forwarder... <link removed>

---

quote:

---

Originally posted by CookieRevised

quote:

---

Originally posted by Lieter
filed one if every one does it they cant ignore us

---

YES THEY CAN.... if eveybody does this, it is called SPAMMING.

quote:

---

Originally posted by Lieter

quote:

---

Originally posted by Markus

NOTE: Please do not enter multiple complaints. This can prolong the
investigation and delay resolving the situation in a timely manner.

---

hehe that should be fun

---

DO NOT

---

Indeed, I urge everyone to stop 'finding things out' and 'filing complaints'....

I'm already on top of this and found some related things but also found that some information posted in this thread is NOT true. Don't put links were links don't exist, or do a proper search before saying something. _Especially_ in such matter!

Filing undocumented, bad reports will do more damage then good. DDossing doesn't work either....

As far as I'm concearned this thread should be closed and pruned so the information posted here can't be misused to file reports or whatever. The more you talk about such subjects, the more people will get victimized. Proof? look at the people in this thread who executed the trojan without the propper knowledge, because they were curious if it worked....

Those who have more info or wanna say something about this can always PM me...

-------------------------------

quote:

---

Originally posted by CraigDowel
Oh angelfire is the real site, maybe complaining works here...

---

Thanks very much for that quick removal tutorial...

Ok Cookie. You're doing a good job . I already filled in a 'Abuse report' @ Angelfire two days ago, but I'll leave it to you now . I like to hear how the calls with the hosting companies turned out. I'll talk to you about it on MSN.

Cookie, any updates?

Update:

Got a mail back from Lycos (owner of angelfire):

quote:

---

Hello,

Thank you for contacting the Lycos Network Abuse Department.

The account you have brought to the attention of the Lycos Network Abuse
Department was found to be in violation of our Terms and Conditions.  As
a result, it has been removed from our servers.  Thank you for reporting
it to us.

Please note that the creator of this page is in no way directly
associated with the Lycos Network or its web publishing products.  We
exercise no editorial control over the content posted by or the actions
of our users.  All users are expected to abide by our Terms and
Conditions, which can be found at the following URL:

http://www.lycos.com/lycosinc/legal.html

I hope you find that our prompt response to this situation addresses
your concerns.  If you have any questions or find more accounts that
require our attention please feel free to contact us again.

Sincerely,

Fred

Lycos Network Abuse Specialist
http://reportabuse.lycos.com

---

Christ, he's up again :/

I don't think it really matters anyways. Why would you want something that is just annoying. I had to reinstall windows just to stop the automatic messages being sent to my contacts.

Because of all the feed back on the abuse part, anyone who sent them a complaint, got an email....this usually never happens....I got mine 4 days ago.

Hello,

I just want to provide some information on this program which I have done a viral analysis on.  It adds "C:\WINDOWS\Systray.exe" and "C:\Program Files\Media Access" as far as I can tell.  It appears as a Windows Installer Package but really is nothing more than a viral executeable.

I have submitted this file to McAfee AntiVirus Emergency Response Team (AVERT) and Symantec.  McAfee has responded by adding this to its "Potentially Unwanted Programs" list.  I feel it should be in there next virus definitions, they feel otherwise.  Symantec has yet to comment on the virus.

Anyway,
Just avoid it,
Dane .

Edit: My varient doesnt appear to do the same routine as Cookie's does.  Perhaps Cookie has a different varient.

quote:

---

Originally posted by Dane
Hello,

I just want to provide some information on this program which I have done a viral analysis on.  It adds "C:\WINDOWS\Systray.exe" and "C:\Program Files\Media Access" as far as I can tell.  It appears as a Windows Installer Package but really is nothing more than a viral executeable.

---

quote:

---

Originally posted by Lieter
isn't Systray.exe a windows executable needed to start windows...

---

Youre right.. mine(win 2k pro) is locaded in C:\WINNT\System

Yep, Tochjo is right, all the files I listed were created in a monitored environment at the time of analysis.

Removal Tool: Click Here