Shoutbox

wow... straaaange... of all the people I just asked now to download Plus! from Simtel (to check), they all got the same official untampered file...

anyways, GiantSpider, if you've run the 302-file, can you do a scan with Spybot S&D and attach the log in a post here?

quote:

---

Originally posted by CookieRevised
wow... straaaange........

---

yeah, my first impresson too, so I thought there could have been something that went wrong with the download so I wanted to try again. I clicked the link on http://www.msgplus.net/download.php and was directed to Simtel.net, where I couldn't see anything about Plus!, I got this page. I deleted the cookies of Simtel.net but I still get the same.

Actually that page looks "right" in the sense that it has a broken layout in your browser though....

But look how it should actualy look (see attachment)...
As you can see, everything is similar, except the layout differs a bit. Maybe this is because it couldn't load the part where the actual listings of the downloads are... can you try again?

hm, looks like that

I tried downloading from the Belgian mirror and the Canadian one.
Belgian one:
0kb
Canadian one:
packed size = 3.434.050
total size = 3.497.984

Hmm i done some dl-ing myself an noticed a slight diff in the size:

msgplus-301.exe dl on 17-7-2004  3416kb
(edit: hmm dodgy date, i dont recall re-dl it)
msgplus-301.exe dl today  3420kb
(both times dl-ed from www.msgplus.net)

have there been changes since i dl plus!3 wich will explain this diff?

Also i scanned the files (received from GS an my own dl's) with Antivir Guard an Spybot S&D an it came up with nothing ( i haven't executed the files)

Edit: dl's from Simtel can vary cuz the dl come from mirrors not from the actual site....talk about lookin for a needle in a haystack :/ Also the person comin onto IRC today dl from msgplus.net (we told him to redownload).

quote:

---

Originally posted by CookieRevised
Infected Plus! 3.01.94: 3.502.080 bytes (=4096 bytes bigger)

---

just downloaded this one from msgplus.net

PC-Cillin doesn't come up with anything

quote:

---

Originally posted by Kryptonate
I tried downloading from the Belgian mirror and the Canadian one.
Belgian one:
0kb

---

Yup, the Belgium mirror seems to be broken....

quote:

---

Originally posted by Sunshine
Edit: dl's from Simtel can vary cuz the dl come from mirrors not from the actual site....

---

No... although the zipfile can vary cause of different compression rates used (but this is very unlikely), the actual program inside it, in this case Plus!, MUST be exactly the same as the main download.
What CAN happen is that a mirror doesn't have the latest download, but still then that "older" download will be exactly, byte by byte, the same as the (old) main download...

---

quote:

---

Originally posted by Sunshine
Hmm i done some dl-ing myself an noticed a slight diff in the size:
msgplus-301.exe dl on 17-7-2004  3416kb
msgplus-301.exe dl today  3420kb
(both times dl-ed from www.msgplus.net)

---

quote:

---

Originally posted by Kryptonate

quote:

---

Originally posted by CookieRevised
Infected Plus! 3.01.94: 3.502.080 bytes (=4096 bytes bigger)

---

just downloaded this one from msgplus.net

---

Confirmed... I also just downloaded that file!!!!!!

conclussion:
* Patchou's server is infected...
* The whole "Elmo"-thing was local and the person on IRC was infected. and it is all a coincidence together with:
* Patchou has updated "something" (but I find it very strange that it is exactly 4096 bytes bigger => mostly a sign of viri)

EDIT:
* "Bad Elmo" seems indeed sponsor related and apparently Patchou has updated the setup package with an updated sponsorpackage....
(but this still doesn't explain the name of the file that GiantSpider got)

Thanx alot everyone for your help and research into this. Does Patchou know about this. I think this could be a thing for him to look into.

MsgPlus-302 = 3,502,080 bytes (From Official Site)
MsgPlus-301 = 3,497,984 bytes (From Official Site)
MsgPlus-301 = 3,502,080 bytes (From Simtel)

All of the above are the same file!

yeah, he proberly knows, he updated the sponsor package (I've been told by trusted people )...

since when is there a 302? It's not even in the download section of the site