malware/spyware inside ??? - Printable Version
-Shoutbox (https://shoutbox.menthix.net)
+-- Forum: MsgHelp Archive (/forumdisplay.php?fid=58)
+--- Forum: Messenger Plus! for Live Messenger (/forumdisplay.php?fid=4)
+---- Forum: WLM Plus! Help (/forumdisplay.php?fid=12)
+----- Thread: malware/spyware inside ??? (/showthread.php?tid=98423)
malware/spyware inside ??? by tiptopweb on 10-01-2011 at 03:11 PM
Hi
since i updated the last version of Messenger Plus 5.10.0.748 my antiwalware software find now strange entries in registry...
i have the message from emisoft antimalware scan report :
Key: hkey_current_user\software\microsoft\windows\currentversion\ext\stats\{963b125b-8b21-49a2-a3a8-e37092276531}
Trace.Registry.getstyles!E1
Key: hkey_current_user\software\microsoft\windows\currentversion\ext\stats\{963b125b-8b21-49a2-a3a8-e37092276531}\iexplore
Trace.Registry.getstyles!E1
more strange, emisoft CANT remove these entries from the registry
it is toolbar installed automatically with MsgPlus?
it should be nice to have an option to install it...or not...
and i never got any answer about my problem of the chat history and problem i have since the 4.8 version
is there any support for an answer?
thanks!
Mod Edit: Changed thread title back to original as it went wrong when I merged the threads
RE: malware/spyware inside ??? by Spunky on 10-01-2011 at 04:34 PM
Can't find those keys on my PC. Did you install the sponsor? If not, it may be something else you have installed
quote:
Originally posted by tiptopweb
it is toolbar installed automatically with MsgPlus?
Nothing installs automatically
RE: malware/spyware inside ??? by tiptopweb on 10-01-2011 at 05:43 PM
Thanks spunky for your answer
thats very strange
do u know where i could donwload the 4.7 version?
RE: malware/spyware inside ??? by CookieRevised on 10-01-2011 at 06:03 PM
quote:A quick Google search for the GUID 963b125b-8b21-49a2-a3a8-e37092276531 shows that it refers to a browser plugin ("Browser Companion").
Originally posted by tiptopweb
it is toolbar installed automatically with MsgPlus?
it should be nice to have an option to install it...or not...
There is nothing special about it in terms of malware or whatever. It absoluty is not spyware either. It is installed because you have choosen to install it.
Also note that it could have been installed by many programs, aka it might not have been Messenger Plus!.
Either way, if it was installed by Plus! then, as said before, you have explicitly choosen to install it. The setup of Plus! will not install sponsor stuff automatically; you need to tick or untick (according to your choice) the checkboxes and confirm the installation of those sponsor tools/ads.
Nothing gets installed by force.
And in case it was installed by Plus!, then you can simply uninstall it by running the uninstaller of Plus! and by choosing "uninstall sponsor".
Or by searching for the uninstaller of that ad/toolbar in your "Add/Remove Programs" list in Windows (depends on what flavor of sponsor you have).
Also, that same Google search I refer to above also shows that this Browser Companion sometimes comes with its own uninstaller also.
Third, another way to uninstall, or at least disable, browser plugins is to go to your browser settings.
[OFF TOPIC]
quote:I answered your question the day after you've posted it:
Originally posted by tiptopweb
and i never got any answer about my problem of the chat history and problem i have since the 4.8 version
is there any support for an answer?
thanks!
chat logs - history
and
chat logs viewer
[/OFF TOPIC]
PS: To keep things somewhat organized, don't put two different subjects in the same thread. Also, please don't make duplicated threads about the same subject; post in the existing thread about that subject (referring to your posts here and here).
RE: malware/spyware inside ??? by tiptopweb on 10-01-2011 at 07:59 PM
why my last message is deleted ?
i posted an answer and i dont see it anymore !
RE: malware/spyware inside ??? by CookieRevised on 10-01-2011 at 08:28 PM
[OFF TOPIC]
quote:See my previous post why. Your message wasn't deleted but moved to the appropiate thread: chat logs - history.
Originally posted by tiptopweb
why my last message is deleted ?
i posted an answer and i dont see it anymore !
[/OFF TOPIC]
RE: malware/spyware inside ??? by Cadavre on 10-08-2011 at 07:52 AM
So what is this Linkury toolbar, a form of malware, that installs itself even when you clearly specify it to not? It's given me and my friend a helluva time having to get rid of it, as it creates a folder in program files but no start menu directory nor does it show up for proper removal in add/remove programs. It's also extremely stubborn by having a process in task manager and a DLL that is "write-protected" and cannot be deleted.
If this is the kind of garbage that brute forces it's way in against the user's wishes upon a new update to Plus! then we're going to stop using it altogether. Fancy font colors and WAVs in chat windows isn't worth risking our computers over.
RE: malware/spyware inside ??? by CookieRevised on 10-08-2011 at 08:02 AM
Cadavre, I'm not sure about what you're talking about but nothing gets installed by force, if you specify not to install the sponsor!. Let that be very very clear.
RE: malware/spyware inside ??? by Cadavre on 10-08-2011 at 08:04 AM
I didn't check the sponsor, nothing was checked, it was checked when it comes up but I unchecked it and proceeded on with installation. I have no idea why it decided to brute force itself in anyway. Either your update was hijacked by a third party or things simply aren't the way they used to be.
RE: malware/spyware inside ??? by tiptopweb on 10-08-2011 at 08:12 AM
i had exactly the same problem...
RE: malware/spyware inside ??? by Cadavre on 10-08-2011 at 08:15 AM
I downloaded this extension from the official site in the first place, the updates were as followed when the program had a new version available. This is the only time I've had anything go out of the ordinary, also it appears someone else had the same problem, that makes four of us now.
It would be nice if we could be enlightened as to why this is happening to multiple users, after all you are the ones responsible for the program in the first place.
RE: malware/spyware inside ??? by CookieRevised on 10-08-2011 at 08:19 AM
People, if you have downloaded from the official site and unticked the boxes like you said then nothing gets installed in reference to the sponsors. Nothing was/is hijacked nor infected in the setup file.
I agree that a mishap might happen and that you have pressed 'next', 'next', next' too quickly (because the boxes are unfortunatly ticked by default), but if you take your time to read the pages and what is going to be installed, and decide to untick the sponsor or searchbar boxes, then nothing gets installed in regards to that!!
Cadavre, the number of people does not matter. In fact tens of thousands of people do not have such a problem.
And for the record also: we are not responsible! We are just volunteers who try to help people.
RE: malware/spyware inside ??? by Cadavre on 10-08-2011 at 08:23 AM
I made pretty sure it wouldn't install anything I didn't want, which was just about everything except the update itself.
So the majority versus the minority. Right. I'm getting the impression tech support isn't very technical today. Let's jump to extremes then, is this only affecting a small number of people in a specific location? Maybe our "USA server" is malfunctioning?
Give that I'm not too technical myself but I know the difference between something that clearly works and something that is completely broken.
EDIT: Then maybe whoever is actually responsible should come forth and try to explain it better? I don't find it funny how malware is already embedded into the program itself and could potentially trigger itself at anytime. Who is to say that something like that hasn't already happened?
RE: malware/spyware inside ??? by CookieRevised on 10-08-2011 at 08:34 AM
There are a couple of different setups*. And each one of them is programmatically the same except for the sponsor/toolbar it presents to the user. All the rest of the code, including the code to check if the checkboxes are ticked or not is the same in all of them. This does not depend on your local. So, again, nothing gets installed if you have unticked the sponsor/toolbar checkboxes.
* and with the latest version there are only 2 that I know of (there used to be more): the LK-setup and the BCH-setup.
RE: malware/spyware inside ??? by Cadavre on 10-08-2011 at 08:39 AM
The Browser Companion Helper, I remember this too doing something similar and was surprised when I opened Firefox and found it was hijacked by it, but it was easy to simply disable it. Linkury on the other hand was not as forgiving as I said. And yes, I unticked the boxes, the only thing that does not install without my permission is Google Chrome.
On a reminder back there however, I really don't like being accused of being too dense and hasty when we're on the computer, after realizing how delicate technology really is I try my best to be especially careful nowadays.
EDIT: It seems you're just saying the same things repeatedly, so I'll wait for someone else to respond.
RE: malware/spyware inside ??? by CookieRevised on 10-08-2011 at 08:49 AM
quote:They will tell you the same thing.
Originally posted by Cadavre
EDIT: Then maybe whoever is actually responsible should come forth and try to explain it better?
Alos, it is not malware, but adware. Major difference there. But anyways, whatever it is, it is not embedded in the setup, it gets downloaded and installed (if you have ticked the boxes).
And I'm repeating the same thing because there is unfortunatly not much else to say about it. Someone else will most likely say the very same things though.
All I (or anyone else) can suggest to disable/uninstall the sponsor stuff is what has already been said before in this thread and some other similar threads: it is not installed by itself and disable the toolbar/searches in your browser via your browser addons and uninstall the stuff by going to 'add/remove programs' and/or via the Plus! uninstaller (depending on what it is you want to remove).
If you are able to upload that offending setup file somewhere (eg: here) I can take a look at it, but other than that I'm afraid there is nothing else to say about it.
RE: RE: malware/spyware inside ??? by Cadavre on 10-08-2011 at 09:04 AM
quote:
Originally posted by CookieRevised
They will tell you the same thing.
How do you know that you're just a volunteer.
quote:
Originally posted by CookieRevised
It is not malware, but adware. Major difference there. But anyways, whatever it is, it is not embedded in the setup, it gets downloaded and installed (if you have ticked the boxes).
No.
"Adwares are the programs which delivers ads to your computer (generally in POP-UP's form). They consume your network."
Whereas:
"Malware is a very general word for software that deliberately harms, restricts, alters, or stops your computer from working properly where the true purpose of the download or installation is hidden or difficult to find and not clearly explained to the user."
That fits Linkury better. If Linkury was attacking my network I'd be in much bigger trouble right now.
quote:
Originally posted by CookieRevised
Because there is unfortunatly not much else to say about it. Someone else will most likely say the same things though.
All I (or anyone else) can suggest to disable/uninstall the sponsor stuff is what has already been said before in this thread (and in other similar threads).
If you are able to upload that offending setup file somewhere (eg: here) I can take a look at it, but other than that I'm afraid there is nothing else to say about it.
Because I'm going to risk keeping that thing on my computer?
I feel there's been no resolution to this, so out of my respect this topic should be locked and preserved for others who seek answers to this issue just to see the kind of help they will receive for it. I can only hope signing up on this forum and go out my way to figure this out will not have my email spammed. Good day.
RE: malware/spyware inside ??? by Squi on 10-08-2011 at 09:08 AM
Hello, I know Cadavre, and we never get these types of problems. You say this is adware, but no ads have popped up nor have we been pestered with anything that even resembles the definition of adware. Malware on the other hand, as defined by Techterms.com is "software programs designed to damage or do other unwanted actions on a computer system". Toolbars are notorious for such things, and why there was an unknown app/company called Linkury in Folder form with several DLL's and other another extension which also ran a background .exe as seen in the Task Manager sounds suspicious to me. A simple and quick Google search on Linkury shows some reviews on it, or tips on how to remove it, which already says it is not a good sign. If you are a volunteer, then who is behind Plus? Wouldn't it benefit to get to the root of the problem? I understand you only know so much, and I thank you for responding, but this is alarming. I've worked with computers for years and I know what is what, and while I realize the possibility of a mistake, this shouldn't have happened to several different people.
RE: malware/spyware inside ??? by Spunky on 10-08-2011 at 09:40 AM
As Cookie and I have already said, nothing gets installed without permission when using the official installer. If you could upload the file you both used to install Plus! we may be able to determine if anything is inherently different with it that may have caused this, however unlikely it is.
It must be said that mistakes can and do happen and it wouldn't be the first time we have had issues with the sponsor (as far as I can remember).
I am not familiar with Linkury and so can't say for definite that it is one of the sponsor "flavours".
Link us to the setup file so that we can check it over and pass it on to the developer team if we do indeed find a problem. It's not that we don't believe you, rather that it is very rare for something like this to happen.
As Cookie has said already, everybody on these forums is a volunteer; although many of us have been around for many years. Whilst we may not have all the answers, we have enough experience to help users with many problems.
RE: malware/spyware inside ??? by CookieRevised on 10-08-2011 at 09:44 AM
quote:The toolbars don't damage your computer (eventhough it might be hard to uninstall it in some cases). And the actions are not unwanted since you must tick the boxes in order to install it, which implies you want it to do what it does. So, no, not malware...
Originally posted by Squi
"software programs designed to damage or do other unwanted actions on a computer system"
As I said, I can understand a mishap and clicking something by accident (it has happened in the past to me too, just like anyone else I assume), but that does not make something automatically malware, eventhough I also understand the frustration something like this might bring (I had my big share of hair pulling and shouting at the screen too - still do sometimes
- and calling certain stuff 'malware' because it doesn't do what I thought it did... to quite often realize the fault was my own (which doesn't help ease the pain of course)).quote:nope, you're not going to get spammed. Why would you?
Originally posted by Cadavre
I can only hope signing up on this forum and go out my way to figure this out will not have my email spammed. Good day.
quote:Yuna Software, as you can read on the official website.
Originally posted by Squi
If you are a volunteer, then who is behind Plus?
Some of the programmers are also members of these forums, you can find them here: http://shoutbox.menthix.net/showteam.php
quote:Some people have reported the same stuff before, dating back to the very first versions years ago. Each time those people insisted that they didn't ticked the boxes. However, time and again it always came down to not reading the setup pages properly and/or (by accident) (un)ticking the wrong boxes. Each time something like this is reported it is done with a lot of (quite understandable) frustration, but that does not change anything to the fact that the choices were ultimatly done by the users themselfs though.
Originally posted by Squi
Wouldn't it benefit to get to the root of the problem? I understand you only know so much, and I thank you for responding, but this is alarming. I've worked with computers for years and I know what is what, and while I realize the possibility of a mistake, this shouldn't have happened to several different people.
Know that there is neither some random thing build in which decides to ignore the preference of the user. All the known setups are programmed to not download and install the sponsor if the boxes are unticked, simple as that (and in programming terms it is indeed a simply check, nothing complicated). All setups are also tested for this, not only by the programmers but also by us and other people too. Nobody has ever reported such a problem where the unticked boxes are ignore before, ever. Believe me, if they were ignored, the people responsible for this will hear about it, loudly.
So, if something was installed it is not the fault of those particular known setups, I'm sorry. And again, I understand that it can be very frustrating to hear this if it has happened to you, but it is what it is.
So, despite there were sometimes different problems with (other) sponsors in the past, the "installed by itself" problem like described in this thread was, in the end, always the fault of the user though.
--
Anyways, as I said in previous post, if we could take a look at the offending setup it would be very helpfull. Having the exact URL where the setup is downloaded from is even better (note: I'm not talking about http://www.msgplus.net/DownloadMsgPlus.aspx, but the URL it redirects to taken from the http headers). Otherwise there is no other way we can "get to the root of the problem".
Web browser add-ons...how to uninstall? by jessica87 on 10-08-2011 at 08:14 PM
Hello,
So, I received a notification to update Messenger Plus, and I thought it was a good idea. When it asks you if you would like to install the toolbars for web-browsers, I specifically clicked no. After I installed the new Messenger Plus and went on my web browsers (Google Chrome, Firefox and Internet Explorer), they all had the toolbar. I was able to uninstall the toolbar, but now, especially on Google Chrome (my primary web browser), when I type something in the search bar, it usually shows me results from Google. Now, it shows results from Plus! Network, something I do not want. I am able to close it via task manager on Google Chrome, but I cannot find it to uninstall.
Can someone please let me know how to remove this feature from my web browsers; it's quite annoying given that I didn't want any of these features in the first place!
RE: malware/spyware inside ??? by Nathalie on 10-10-2011 at 09:47 AM
This is not malware or spyware. It is very strange that you would get a toolbar without your permission.
However, you can uninstall it from Chrome as follows:
Click on "Start\Control Panel" and select "Add/Remove Programs" (Windows XP) or "Programs and Features" (Windows Vista/Windows 7). In the list that will be displayed select "Messenger Plus Community Smartbar!” then click on "Remove" or "Uninstall" and follow the instructions.
RE: malware/spyware inside ??? by matty on 10-10-2011 at 04:06 PM
quote:Why on earth is it labeled this? Certainly makes it seem we promote it...
Originally posted by Nathalie
Messenger Plus Community
RE: malware/spyware inside ??? by CookieRevised on 10-10-2011 at 04:24 PM
quote:Fully agree.... that toolbar has got nothing to do with our community!
Originally posted by matty
quote:Why on earth is it labeled this? Certainly makes it seem we promote it...
Originally posted by Nathalie
Messenger Plus Community
RE: malware/spyware inside ??? by jessica87 on 10-10-2011 at 08:21 PM
Nah, I was able to uninstall that toolbar. I have a different problem.
For Google Chrome users, you might know that when you type something in the address bar like "how to make cookies," it will automatically go to the Google search engine and find the results for you.
When I do this now, it automatically goes to Plus! Network search results, something I do not want. On Google Chrome, when I go to Options > Tools > Task Manager, I can end its process, but I can't uninstall Plus! Network officially.
That's how I got to this community forum in the first place; I've been trying to find out how to uninstall it and there's no clear way of contacting the administrators of Plus! Network, so I decided to join and see if anyone could help me.
RE: malware/spyware inside ??? by jessica87 on 10-10-2011 at 08:27 PM
Nevermind guys, I was able to figure it out.
I had to delete it as a link from Options > Manage Search Engines.
Thanks!
RE: malware/spyware inside ??? by matty on 10-11-2011 at 12:41 PM
quote:
Originally posted by matty
"Messenger Plus Community Smartbar!”
quote:Also the software is labeled Messenger Plus!... why is the ! after Smartbar...
Originally posted by CookieRevised
quote:Fully agree.... that toolbar has got nothing to do with our community!
Originally posted by matty
quote:Why on earth is it labeled this? Certainly makes it seem we promote it...
Originally posted by Nathalie
Messenger Plus Community