Shoutbox

SERIOUS ALERT Virus Distributed Via MSGPLUS Download? - Printable Version

-Shoutbox (https://shoutbox.menthix.net)
+-- Forum: MsgHelp Archive (/forumdisplay.php?fid=58)
+--- Forum: Messenger Plus! for Live Messenger (/forumdisplay.php?fid=4)
+---- Forum: WLM Plus! Bug Reports (/forumdisplay.php?fid=7)
+----- Thread: SERIOUS ALERT Virus Distributed Via MSGPLUS Download? (/showthread.php?tid=41041)

SERIOUS ALERT Virus Distributed Via MSGPLUS Download? by Syndrome on 03-23-2005 at 11:08 PM

I'm not sure whether this is true or not. But i got infected with the very dangerous Spyware Loverspy Demo after installing the Actual MSGPlus WITH Sponsors.
I know this wasn't meant to be but in other Forums i heard from other MSGPlus users having the same problem after the installation of MSGPlus.

Loverspy is a dangerous Keylogger and Pass-stealer.

I don't want to accuse anybody i'm just trying to warn you if there is any link between MSGPlus and Loverspy because removing this Trojan is very difficult i didn't manage to do it so far

Regards

Sapphire


RE: SERIOUS ALERT Virus Distributed Via MSGPLUS Download? by frankiedaman on 03-23-2005 at 11:13 PM

I don't think the company that provide the Messenger Plus Sponsor (C2 Media) would bundle something that malicious with a program like Messenger Plus. I'll try to see if i can find some removal instructions fro that trojan however.

I take it you downloaded MSG Plus off the official site and not some P2P network right?

Update : Spyware.Loverspy Removal Instructions


RE: SERIOUS ALERT Virus Distributed Via MSGPLUS Download? by M73A on 03-23-2005 at 11:14 PM

it is known the optional program contains some unhelpful stuff but im not sure if it contains stuff like that *-) i'll go research and see


RE: SERIOUS ALERT Virus Distributed Via MSGPLUS Download? by L. Coyote on 03-23-2005 at 11:18 PM

quote:
Originally posted by Syndrome
I'm not sure whether this is true or not. But i got infected with the very dangerous Spyware Loverspy Demo after installing the Actual MSGPlus WITH Sponsors.
I know this wasn't meant to be but in other Forums i heard from other MSGPlus users having the same problem after the installation of MSGPlus.

Loverspy is a dangerous Keylogger and Pass-stealer.

I don't want to accuse anybody i'm just trying to warn you if there is any link between MSGPlus and Loverspy because removing this Trojan is very difficult i didn't manage to do it so far

Regards

Sapphire
This is very weird. I have MsgPlus! with sponsor installed and haven't got any spyware or trojans (the sponsor is adware, a special custom package for MsgPlus! from C2Media).

Where did you download MsgPlus! from? Did you download it from the official website ( http://msgplus.net )?
RE: SERIOUS ALERT Virus Distributed Via MSGPLUS Download? by mwe99 on 03-23-2005 at 11:22 PM

Hmm yeah where did you download it from? Patchou specifically did say that it contains no spyware or viruses


RE: SERIOUS ALERT Virus Distributed Via MSGPLUS Download? by frankiedaman on 03-23-2005 at 11:25 PM

Prior to the release of Messenger Plus a lot of fakes were going around the P2P networks and tricking users into downloading trojans etc.

There was a case similar to this a while ago i think that somebody had reported on the forums.

(edit : Wow, My 100th post. :D)


RE: SERIOUS ALERT Virus Distributed Via MSGPLUS Download? by Menthix on 03-23-2005 at 11:39 PM

Ad-Aware does detect LoverSpy Demo after Plus! installation with sponsor. I can confirm that (official 3.50 release from official site).

Which BTW doesn't necessary means there is an actual installation of "LoverSpy Demo". It could be a false detection or it could also just be a part of code that looks like LoverSpy Demo. For example some code which monitors which C2Media sites and C2Media partner sites you visited, in this case it would be harmless and everything by the rules (the sponsor agreement does notify it will monitors which of their sites and their partners' sites you visit).


RE: SERIOUS ALERT Virus Distributed Via MSGPLUS Download? by Syndrome on 03-23-2005 at 11:57 PM

I Downloaded MSGPlus from the official website. as i wrote i'm not sure about this. But in another Forum thread also MSGPlus was installed right before the Spybot got on the plan..

I've tried to remove it with Ad Aware Spysweeper Housecall and AntiVir but this fucking thing is always replicating itsself. I think i will try this in SafeMode again.

Again i have to say i don't want to accuse the MSGPlus team of beein responsible for this

Regards

Syndrome (don't know why i wrote sapphire in the first one Oo)

To the effect of the Spyware:

i found an optixx client on my Computer (which fits the fact that through loverspy any software can be installed on your PC)
and for 2nd various Pop Ups are on my PC (internetexplroer though i use Firefox) and 2 Iexplore Processes which can't be terminated (always replicate themselves)

BUT

the files which are mentioned in the symantec security response weren't created on my system
i'm clueless


RE: SERIOUS ALERT Virus Distributed Via MSGPLUS Download? by L. Coyote on 03-24-2005 at 12:00 AM

You shouldn't use those programs to remove the sponsor.

Reinstall with sponsor (now that you have tried to remove it with other programs, you might have damaged the files, so reinstall to fix it). Then uninstall the sponsor by going to Start => Control Panel => Add/Remove Programs => Uninstall MsgPlus!

You now have the option to uninstall the sponsor only.


RE: SERIOUS ALERT Virus Distributed Via MSGPLUS Download? by Menthix on 03-24-2005 at 12:02 AM

Syndrome: Use the Plus! uninstall and then choose to only uninstall the sponsor. Reboot after that and the scan to see if it's still there. Read instructions on how to remove the sponsor here:
- http://www.msgplus.net/help_tutorials.php?tut=ins...install#inu-remove

If you want to do a complete test, ten install Plus! again after that with the sponsor to see if LoverSpy comes back.


RE: SERIOUS ALERT Virus Distributed Via MSGPLUS Download? by Syndrome on 03-24-2005 at 12:16 AM

i managed to kill that nasty bug in safemode.

it created a directory called "draw dupe" in the userdata from whre the trojan replicated itsself. Deleting that directory just made up with evrything i think im (almost) clean now

im sorry if i stirred up the hive ^^ but i just wanted to be sure that noone else is beeing infected that way

thanks to all of you for your help

Syndrome

@ MenthiX i didn't expect that thing being IN the Messenger 3 Plus i just thought it may hide in one of the sponsors ads or something