eset nod32 blocked messenger plus 4.85

eset nod32 blocked messenger plus 4.85 - Printable Version

-Shoutbox (https://shoutbox.menthix.net)
+-- Forum: MsgHelp Archive (/forumdisplay.php?fid=58)
+--- Forum: Messenger Plus! for Live Messenger (/forumdisplay.php?fid=4)
+---- Forum: WLM Plus! Help (/forumdisplay.php?fid=12)
+----- Thread: eset nod32 blocked messenger plus 4.85 (/showthread.php?tid=95106)

eset nod32 blocked messenger plus 4.85 by silent_07 on 07-24-2010 at 05:34 PM

eset nod32 blocked messenger plus 4.85
win32/adware.cidhelp

can you fix please next version?

RE: eset nod32 blocked messenger plus 3.85 by Menthix on 07-24-2010 at 06:36 PM

I had the same here.

Odd because NOD never really had a problem with older versions before. while cidhelp refers to Circle Development which was something used in older versions, not in this one.

Contacted NOD earlier today, hopefully they'll fix it.

RE: eset nod32 blocked messenger plus 3.85 by Hank on 07-25-2010 at 12:08 AM

quote:
Originally posted by Menthix
I had the same here.

Odd because NOD never really had a problem with older versions before. while cidhelp refers to Circle Development which was something used in older versions, not in this one.

Contacted NOD earlier today, hopefully they'll fix it.

looks like NOD have a few more to fix, they cant even support Thunderbird3.1 an how long has it been out? the ( Eset Smart Security Extension ) does not work.

RE: eset nod32 blocked messenger plus 3.85 by Kafman on 07-25-2010 at 06:04 AM

quote:
Originally posted by Menthix
I had the same here.

Confirmed in the spanish forums with two users who had nod32 aswell eset smart security.

Looks like ESET added the sponsor as a malware to their signatures.

RE: eset nod32 blocked messenger plus 3.85 by Menthix on 07-25-2010 at 09:20 AM

quote:
Originally posted by Kafman
Looks like ESET added the sponsor as a malware to their signatures.

Which sponsor though? 3.85 comes with a Conduit toolbar, or in some cases Ask.com... cidhelp refers to the old sponsor which hasn't been used for quite a while.

All Plus! versions dating back to version 4.50 seem to be blocked by NOD32 now (since Update 5306 (20100723). Versions older than that are not labeled with CiDHelp. In the past NOD would only block the old (pre v4.80) sponsor when you actually install the sponsor.

But blocking any Plus! version newer than 4.81 just doesn't make sense at all, the CiD sponsor isn't used in those versions at all. The newer Plus! versions either use Conduit (community toolbar) or As.com (search engine) as a sponsor. Neither are adware, no antivirus inditifies it as being that, even NOD agrees on that...
Conduit: http://www.virustotal.com/analisis/c640cae328d651...92dbbf1-1280051763
Ask.com: http://www.virustotal.com/analisis/d029c34dd469a3...7669945-1280051389

Additionally none of the newer versions are blocked by any other scanner:
4.85: http://www.virustotal.com/analisis/6231b9e65f4ea7...d78f4ee-1280051958
4.84: http://www.virustotal.com/analisis/0792c2a0ac92a4...213b359-1280052125
4.83: http://www.virustotal.com/analisis/c19739b132a269...4c42664-1280052289
4.82: http://www.virustotal.com/analisis/9e22e81f66d4d0...372a78f-1280052360
4.81: http://www.virustotal.com/analisis/ac93e570fed539...d9f5caf-1280052449

Only some of the older versions which actually *did* use a CiD adware sponsor a blocked by other scanners:
4.11: http://www.virustotal.com/analisis/8d8ca2c8b9c19d...da321ab-1280052802

If you use NOD32, download MsgPlusLive-485.exe and submit it to ESET as a false positive.

Seems ESET isn't completely sure yet either:
[Image: please-submit-this-object-to-eset-for-analysis.png]

[Image: please-submit-this-object-to-eset-for-analysis.png]

RE: eset nod32 blocked messenger plus 3.85 by Kafman on 07-25-2010 at 08:31 PM

quote:
Originally posted by Menthix
All Plus! dating back to version 4.50 seem to be blocked by NOD32 now.

Yeah forgot to detail that, like you already said, it blocks all the CiD variants (wich it doesn't have any sense since it is the old sponsor...)

It doesn't have any sense that ESET blocks Conduit or Ask.com and classify it as a CiD variant...

Here's the spanish tread with two screenshots, from nod32 aswell eset smart security wich detects it as a CiD variant: http://foro.msgpluslive.es/showthread.php?tid=14574&page=2

RE: eset nod32 blocked messenger plus 3.85 by Patchou on 07-27-2010 at 04:00 PM

As you can see, as time passes by, some AV programs don't get any smarter, quite the opposite... .

RE: eset nod32 blocked messenger plus 3.85 by Menthix on 07-28-2010 at 03:16 PM

quote:
Originally posted by Email conversationwith ESET
This is one example of the dropped malware file:
http://www.virustotal.com/analisis/79bf7f8085018d...d57936d-1280301607

Only the vendor can solve it, it is not a false positive.

Regards,

Daniel Novomeský
Virus Researcher
ESET spol. s r.o.

> >--[<REMOVED>@<REMOVED>.com]---------------------
> > Hello,
> >
> > This sounds strange to me.
> >
> > I am a happy user of Messenger Plus!, I have it installed on several of
> > my systems and see no sign anywhere of the "Circle development" adware
> > or the Win32/TrojanDownloader.Swizzor you mention. Neither do friends
> > who have this software too and use other anti virus products without
> > getting a warning.
> >
> > I temporary disabled NOD32 and installed the executable. I did a scan of
> > the entire system after installation but found nothing (except for the
> > installer itself), neither do i see any advertising appear.
> > On what indication/symptoms exactly do you base this threat
> > classification? For example, which files/registry keys or communication
> > with which hostnames/IPs to look for?
> >
> > You also mention "it" being identified as Win32/TrojanDownloader.Swizzor
> > and being classified as malware by almost all vendors. How/where would i
> > find this file so I can see this for myself? Because the file i sent you
> > is certainly not classified as malware by any vendor i know. Perhaps you
> > are referring to a file which is downloaded during execution, I would
> > like to see more details on it.
> >
> >
> > I'm not convinced yet about this not being a false positive.
> >
> >
> > Greetings,
> > Johan
> >
> >
> >
> >
> > samples@eset.sk wrote:
>> > >
>> > > Dear Johan Brune,
>> > >
>> > > Thank you for your submission.
>> > > I have run the attached executable and it resulted in installing the bad "Circle development" adware. It is identified as Win32/TrojanDownloader.Swizzor trojan. Almost all vendors classify it as malware. Swizzor malware caused lot of problems worldwide.
>> > > The statement about no relation with the CiD is not in a harmony with the truth.
>> > > Intentional spreading of malware is considered as criminal act in many countries and it is not wise to overlook it.
>> > >
>> > > Regards,
>> > >
>> > > Daniel Novomeský
>> > > Virus Researcher
>> > > ESET spol. s r.o.
>> > >
>>> > >> --[<REMOVED>@<REMOVED>.com]---------------------
>> > >
>>> > >> The attached file is *password protected*, password is: infected
>>> > >> The *extension of the file inside the .zip has been changed from .exe to
>>> > >> .bak* to bypass GMail's restrictions on attachement file types. Despite
>>> > >> password protecting the .zip GMail will see there was a .exe inside and
>>> > >> refuse to send it.
>>> > >> My customer number: EAV-01534435
>>> > >>
>>> > >> The file attached is a *false positive*.
>>> > >>
>>> > >> The official location to download this file is
>>> > >> http://www.msgpluslive.net/download/
>>> > >> (http://mirror3.msgpluslive.net/MsgPlusLive-485.exe).
>>> > >>
>>> > >> The file is the installer of the latest version (4.85.386 - 19/07/2010)
>>> > >> of a software called Messenger Plus! Live (http://www.msgpluslive.net/).
>>> > >> Older versions of Messenger Plus! did indeed bundle with an (optional)
>>> > >> adware sponsor package developed by Circle Development Ltd. However,
>>> > >> none of the recent versions of Messenger Plus! released over the past
>>> > >> months contain or download the CiD adware. The makers of Messenger Plus!
>>> > >> stopped using the CiD package completely and have no affiliation with
>>> > >> Circle Development Ltd.
>>> > >>
>>> > >> Messenger Plus! is created my Yuna Software Ltd.
>>> > >> http://www.yunasoftware.com/. Instead of the CiD adware Messenger Plus!
>>> > >> is bundled with either:
>>> > >>
>>> > >> * A community toolbar for the user's browser developed by Conduit
>>> > >> Ltd. (http://www.conduit.com/).
>>> > >> * Or the Ask.com search assistent which makes Ask.com the default
>>> > >> searchengine in the user's browser.
>>> > >>
>>> > >> One of these two options is presented to the user during installation of
>>> > >> the Messenger Plus! software. Which of the two is presented to the user
>>> > >> depends on some factors like geographical location. In both cases the
>>> > >> installation of the sponsor package is optional and it is made clear to
>>> > >> the user what it does. Both Conduit and Ask are respected companies
>>> > >> which are not in the business of distributing adware, neither are they
>>> > >> in any way affiliated with Circle Development Ltd. which the CiDHelp
>>> > >> label refers to.
>>> > >>
>>> > >> None of the other antivirus companies I know detect this as a threat,
>>> > >> including the other recent versions which don't include CiDHelp either.
>>> > >> MsgPlusLive-485.exe :
>>> > >> http://www.virustotal.com/analisis/6231b9e65f4ea7...d78f4ee-1280051958
>>> > >> MsgPlusLive-484.exe:
>>> > >> http://www.virustotal.com/analisis/0792c2a0ac92a4...213b359-1280052125
>>> > >> MsgPlusLive-483.exe:
>>> > >> http://www.virustotal.com/analisis/c19739b132a269...4c42664-1280052289
>>> > >> MsgPlusLive-482.exe:
>>> > >> http://www.virustotal.com/analisis/9e22e81f66d4d0...372a78f-1280052360
>>> > >> MsgPlusLive-481.exe:
>>> > >> http://www.virustotal.com/analisis/ac93e570fed539...d9f5caf-1280052449
>>> > >>
>>> > >> Also see the thread about this in the Messenger Plus! support forum with
>>> > >> more information: http://shoutbox.menthix.net/showthread.php?tid=95106
>>> > >>
>>> > >>
>>> > >> I hope this issue can be solved quickly. Please contact me if more
>>> > >> details are needed.
>>> > >>
>>> > >> Greetings,
>>> > >> Johan Bruné

Frustrating as I can't find the file they refer to anywhere. Perhaps it is the old CiD uninstaller, but I sumbitted v3.85 which doesn't use that. Eset claims they see Win32/TrojanDownloader.Swizzor in v3.85. I'd like to see it with my own eyes but it doesn't look like they're going to help people with that

RE: eset nod32 blocked messenger plus 3.85 by Lou on 07-28-2010 at 03:31 PM

quote:
Originally posted by Menthix
Frustrating as I can't find the file they refer to anywhere. Perhaps it is the old CiD uninstaller, but I sumbitted v3.85 which doesn't use that. Eset claims they see Win32/TrojanDownloader.Swizzor in v3.85. I'd like to see it with my own eyes but it doesn't look like they're going to help people with that

Perhaps they're testing this by installing over a previous installation that already had the CiD sponsor? In that case they would obviously get a false positive because it's not even from the same installer :undecided:

RE: eset nod32 blocked messenger plus 3.85 by newcastle on 07-30-2010 at 09:16 AM

have the same problem here.

RE: eset nod32 blocked messenger plus 4.85 by Menthix on 08-04-2010 at 12:32 PM

quote:
Originally posted by Lou
Perhaps they're testing this by installing over a previous installation that already had the CiD sponsor? In that case they would obviously get a false positive because it's not even from the same installer

Would sound unlikely. I would assume they do automated testing on clean VMs.

It is definitely an CiD uninstaller though. Installed the old 4.60. When you install that version with the CiD sponsor it creates an uninstall.exe in C:\Program Files\Circle Development\. That file looks a lot like what Eset claims they are seeing:
4.60 CiD uninstaller: http://www.virustotal.com/analisis/d9fd774108d289...5be03e1-1280921456
Eset's mysterious find: http://www.virustotal.com/analisis/79bf7f8085018d...d57936d-1280301607

But even if you would...

Delete the uninstall.exe file from the old version (while keeping CiD installed)
Download and install the latest plus! version
Try to remove CiD through Plus' uninstaller

...that won't cause the current Plus! version to download the CiD uninstaller either. It just makes Plus! say "CiD is installed but the uninstaller is corrupted. Install the CiD again to fix".

So what would explain the detection?

Eset is ignorant and is classifying everything they recognize as Messenger Plus! as being bundled with CiD, based on an old version. Even though newer versions don't bundle with CiD.
Eset's testing methods are malfunctioning like Lou suggested.
Or some code in the current Messenger Plus! version could still download/contain the uninstall.exe Eset refers to even though it is unused. After all, some of the other CiD uninstall functionality is still there too. Perhaps there's something which ticks Eset's stuff off even in the latest version.

The annoying thing is Eset isn't clear in telling exactly what they're basing their detection on

. Perhaps someone else can try to get some sense out of them: How to submit virus or potential false positive samples to ESET's labs. As long as Eset doesn't tell what their problem is Yuna can't exactly fix it either. Damn annoying, because I'm using NOD32 myself too and using Plus! installers all the time

.
Tip: when sending them MsgPlusLive-485.exe, rename it to something like MsgPlusLive-485.bak before zipping and (optionally) password protecting it. GMail won't allow you to send a zipped .exe, even if you password protect the .zip.

RE: eset nod32 blocked messenger plus 4.85 by matty on 08-04-2010 at 12:58 PM

Do I smell another petition in the works?

RE: eset nod32 blocked messenger plus 4.85 by Menthix on 08-04-2010 at 02:56 PM

quote:
Originally posted by Eset's reply on a request for more detailed information
Dear Johan Brune,

I think your questions was already answered.
The recent version was tested. Testing the MsgPlusLive-485.exe resulted in Swizzor infection on previously clean system. It was confirmed by the independent tester too (non ESET employee). Reverse engineering confirmed the recent executable has references to Sponsor (CiD).
The vendor's website contains misleading informations. It states Messenger Plus! is freeware and 100% free. Freeware implies no optional malware and no third party sponsor components.
Sure the vendor can get more informations, unfortunately we were not contacted by him yet.

Regards,

Daniel Novomeský
Virus Researcher
ESET spol. s r.o.

* Menthix summons Yuna/Patchou. Them contacting Eset directly may lead to something useful.

Eset has an interesting definition of freeware btw:
http://www.merriam-webster.com/dictionary/freeware
http://en.wikipedia.org/wiki/Freeware
http://definr.com/freeware

RE: eset nod32 blocked messenger plus 4.85 by Chrono on 08-04-2010 at 11:17 PM

well, isnt it obvious that patchou/yuna shoul be contacting them? i thought they'd have done that right after Menthix noted all the issues

* Chrono slaps patchou/yuna around a bit with a large trout.

RE: eset nod32 blocked messenger plus 4.85 by Hank on 08-05-2010 at 12:06 AM

quote:
Originally posted by Chrono

* Chrono slaps patchou/yuna around a bit with a large trout.

and you wonder why Patch wont use your name for his Kid

quote:
Originally posted by Chrono
well, isnt it obvious that patchou/yuna shoul be contacting them? i thought they'd have done that right after Menthix noted all the issues

i dunno but i would think Patch/Yuna would be better off to contact NOD32

RE: eset nod32 blocked messenger plus 4.85 by Menthix on 08-05-2010 at 09:13 AM

Also see the discussion on the MalwareBytes forum (MalwareBytes is apparently blocking the Plus! site):
http://forums.malwarebytes.org/index.php?showtopic=57081

At least MalwareBytes is willing to show people what they see. I think we may have an explanation now:
http://forums.malwarebytes.org/index.php?showtopi...=findpost&p=295857

RE: eset nod32 blocked messenger plus 4.85 by Hank on 08-05-2010 at 09:36 AM

quote:
Originally posted by Menthix
Also see the discussion on the MalwareBytes forum (MalwareBytes is apparently blocking the Plus! site):
http://forums.malwarebytes.org/index.php?showtopic=57081

i clicked on malwarebytes forum by accident an thouhgt DZ upgraded the forum to a new Forum board

RE: eset nod32 blocked messenger plus 4.85 by vaccination on 08-05-2010 at 01:03 PM

quote:
Originally posted by Menthix
At least MalwareBytes is willing to show people what they see. I think we may have an explanation now:
http://forums.malwarebytes.org/index.php?showtopi...=findpost&p=295857

The guy in that thread is acting like an arsehole though. Glad I don't use their software.

RE: eset nod32 blocked messenger plus 4.85 by Chris4 on 08-06-2010 at 02:43 AM

I got the video working by installing this codec (not worth installing, unless you really want to).

MenthiX was right - he's downloading Messenger Plus! Live 4.85, but because he doesn't have Windows Live Messenger 8 or 9 on his test machine, the installer then detects he only has Windows Messenger 4 (which comes with XP) and it then downloads the old Plus! 3.63 version with the adware.

[Image: dLyNf.png]

[Image: Lxktr.png]

[Image: y2ASt.png]

RE: eset nod32 blocked messenger plus 4.85 by Hank on 08-06-2010 at 02:55 AM

my rule is "never argue with an idiot otherwise bystanders cant tell the difference".. an it seems he is an idiot.

OT: talking bout idiots, where's Discrate

RE: eset nod32 blocked messenger plus 4.85 by bilbobagins75 on 08-07-2010 at 05:06 PM

So can someone tell me , Is it safe to download the current version with your virus software disabled and then re-enable it afterwards or is there actually a problem with the software being infected ?

RE: RE: eset nod32 blocked messenger plus 4.85 by Chris4 on 08-07-2010 at 11:11 PM

quote:
Originally posted by bilbobagins75
So can someone tell me , Is it safe to download the current version with your virus software disabled and then re-enable it afterwards or is there actually a problem with the software being infected ?

Yes, Messenger Plus! Live is completely safe to download. It's not infected, just falsely detected by 1 out of 44 anti-virus companies (NOD32) of which we're trying to resolve. If you're using NOD32 - disabling it, installing Plus!, then re-enabling may do the trick, however it may falsely detect it in the future and result in Plus! disappearing, so I'd recommended adding Plus! to the safe list (if it has one) or using different anti-virus software.

eset nod32 blocked messenger plus 3.85 by questatmayne on 11-03-2010 at 01:16 PM

my nod32 won't even allow it to install ,i say ignore then it said it must be terminated. first of all what is the solution for this problem and second is that if i even exceed installing it then Microsoft messenger plus live is the company who must take full responsibility when i get a virus from this application. messenger plus should cancel the update they are offering and fix it so that i won't get a virus error. i use eset nod32.

NOD32 antivirus system information
Virus signature database version: 5587 (20101103)
Dated: 3. november 2010. a.
Virus signature database build: 20647

Information on other scanner support parts
Advanced heuristics module version: 1113 (20100827)
Advanced heuristics module build: 1223
Internet filter version: 1.002 (20040708)
Internet filter build: 1013
Archive support module version: 1111 (20100826)
Archive support module build version: 1256

Version: 2.70.39

RE: eset nod32 blocked messenger plus 4.85 by CookieRevised on 11-03-2010 at 01:37 PM

quote:
Originally posted by questatmayne
what is the solution for this problem

Dissable NOD32, then redownload and install Messenger Plus!.

Messenger Plus! is safe and contains NO virusses at all. See this very same thread for the reason why NOD32 gives you this warnings.

quote:
Originally posted by questatmayne
and second is that if i even exceed installing it then Microsoft messenger plus live is the company who must take full responsibility when i get a virus from this application.

That's wrong though, in multiple ways.
First of all Microsoft hasn't got anything to do with Messenger Plus! at all. Messenger Plus! is created by Yuna, which is not affiliated with Microsoft.

Second, it is your own responsibility if you want to ignore warnings from virus scanners etc. It is not the responsebility of the virusscanner's manufacture, nor is it the responsebility of the creator of the software you're installing despite the wanrings. Although, as said, there is nothing wrong with ignoring it in this case though.

RE: eset nod32 blocked messenger plus 4.85 by Menthix on 11-03-2010 at 04:51 PM

quote:
Originally posted by questatmayne
messenger plus should cancel the update they are offering and fix it so that i won't get a virus error. i use eset nod32.

Yuna Software is in contact with people at Eset (makers of NOD32) to solve the issue. Unfortunately it is a very slow process. It is not a matter of canceling the update, NOD32 is flagging the installer of all recent Plus! versions.

Also note:

NOD32 classifies Win32/MessengerPlus as a "potentially unwanted application" (orange) and not as a "threat" (red).
Other security products which started flagging Messenger Plus! in the same timeframe as Eset already investigated the issue and confirmed Plus! is not insecure or malicious. See the reports from: Norton Safe Web, hpHosts and Malwarebytes.
NOD32 is the only known anti-virus product to have a problem with Messenger Plus!, dozens of other notable products all label it safe: VirusTotal MsgPlusLive-490.exe scanning results.

This is very annoying, but as long as the people at Eset don't change their mind there is nothing else you can do except for disabling NOD32 for the few minutes it takes to install Plus!. People at Yuna Software are already in contact with Eset too, but if you wish to complain to Eset you can reach them through this way: How to submit virus or potential false positive samples to ESET's labs

Temporary disabling NOD32 will do, although it does take a couple more steps than Eset says it will.

Doubleclick on the NOD32 icon in the systray next to the clock in the lower-right of your screen. On Windows 7 in some cases the NOD32 icon is hidden behind the little up arrow next to the clock.
In the lower-left of the NOD32 windows click 'Change' to toggle to 'Advanced mode'.
Once you're in advanced mode, click on 'Setup' and then 'Antivirus and antispyware protection'.
You should see the status of all 4 of NOD32's components, click on 'Disable' under all 4 of these components.
Now you should be able to download Plus! and install it without any problem.
Once you are done you can delete the installer file and re-enable NOD32. Only the installer is flagged by NOD32, Plus! works fine once it is installed, even with NOD32 on its highest settings.