IPB

Welcome Guest ( Log In | Register )

 
Reply to this topicStart new topic
> Messenger+'s spyware
Milk
post May 8 2004, 06:01 PM
Post #1


Super Geek
***

Group: Advanced Member
Posts: 271
Joined: 15-December 03
From: ©
Member No.: 129



This is more a warning than anything else.

It has been highlighted that fewer people than expected are aware of the 'change of direction' taken by Messenger Plus' creator Patchou.

With the release of the new msn app, I feel it important that people are aware of the new content of Patchou's app - trojans.

Patchou decided that his code wasn't enough as a community project, and therefore took on a few 'sponsors' - most notably C2Media the owner of lop.com software.

For those of you who have never heard of it, lop.com software is classified as a trojan by antivirus vendors and as a browser hijacker by antispyware vendors. You can find plenty of information about it by doing a Google search for "lop.com".

One Anti-Spyware resource tracking the dev puts it so:

QUOTE
No single parasite has caused as many support threads at our message boards as lop.com (although Xupiter comes close). Ad-aware, Spybot, and all other spyware removal programs target several older variants of lop.com. It now comes in a version that is nearly impossible to detect automatically. It uses randomly named files, randomly generated CLSID identifiers, and uses activex installation methods that let them update all of their installers at once.

Before this change, the number of lop.com complaints actually had gone down because it was so easy to remove and could even be blocked beforehand. Since C2Media introduced these new versions that mutate randomly, the number of infections has become larger than ever. The only sure way to be rid of it is to ask for help at the SWI support forums.




btw - Patchou's reply ?

QUOTE
To all of the people who are saying that they won't use his program because of lop.com, he has this to say, "I don't want to be rude but if you boycot version 2.10.36, you're an idiot."



- Don't use it. If you have it - uninstall.




Lop sets off AVG anti-virus here

This post has been edited by Rezza: May 9 2004, 02:50 AM


--------------------
Got Milk?
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
SuranWrap
post May 8 2004, 06:25 PM
Post #2


Geek God I
Group Icon

Group: Advanced Member
Posts: 628
Joined: 8-January 04
From: Southern Ontario, Canada
Member No.: 285



I remeber when MSN plus was good!
I just make my own perl scripts now
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
.::PHPfanatic::.
post May 8 2004, 10:42 PM
Post #3


Geek God V
Group Icon

Group: GN VIP III
Posts: 3239
Joined: 3-November 03
From: Lansing, MI
Member No.: 6



Thanks for the information Milk otherwise I wouldn't have known about this I know for sure. I've uninstalled it now. This would actually be a good thread to pin.

Topic Pinned


--------------------
AMD: Defeat Intel in court, shove them down a flight of stairs and then begin kicking them repeatedly... with a steel boot.

user posted imageuser posted imageuser posted imageuser posted imageuser posted image

1. PCI-E: Comprehensive Overview
2. Athlon 64-90nm
3. AMD Spec Chart
4. Ultimate Testing of 27 GPUs
5. nF4 SLI [LanParty, K8NXP, A8N]
6. High-End CPU Coolers
7. AMD Progression Chart
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
SuranWrap
post May 8 2004, 11:59 PM
Post #4


Geek God I
Group Icon

Group: Advanced Member
Posts: 628
Joined: 8-January 04
From: Southern Ontario, Canada
Member No.: 285



I think when you uninstall it, it leaves the spyware/trojan still in the computer.
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
Milk
post May 9 2004, 12:56 AM
Post #5


Super Geek
***

Group: Advanced Member
Posts: 271
Joined: 15-December 03
From: ©
Member No.: 129



Patchou maintains that since during the set-up, you can chose the 'no-install' option, therefore there is no issue here - I disagree.

I believe that the marketing strategy is targeted at those types of users, whome (as we discussed in the Gmail thread), require some 'help' in many of these areas. It is an underhand attempt to install software which is now exceptionally aggressive system-wide - with its own mutagenic code creating re-install potential.

Yes you can choose 'not to install' - but maybe you should ask yourself "what is this app worth to me?"

The trojans - and that's what they are, regardless of how much you might seek to requalify their role - are included by the deveoper to make revenue for himself.

Therefore he is seeking to make money at the expense of many of those who wish to support his app and coding by doenloading. Why not go donate-ware?, certainly there would be more than enough support considering the number of downloads the app receives. There is no reason to include this viri other than simply because it was the quickest way to make money - the net result, users should decide not to use it and therebye the deveoper receives no financial return.

Yes it's in the license agreement on the install, yes users have the capacity to read it, - does it make the choice the right one knowing what everyone does about these companies and their activities? - well, I guess you can all make up your own mind about that one.

As for the uninstall - the included uninstaller supposedly removes all traces of the 'sponsor' programme as well, however you would be better advised to run an aggressive anti-spyware app (SpySweeper / Spybot S&D etc.) at least in co-operation with the included removal system.

The fact that it sets off an antivirus application is not in itself a wholely significant issue, false positivies are not unheard of *cough* Symantec *cough* MacAfee *cough*, however when you approach these anti-virus vendors and ask them about this particular 'false-positive' they are keen to stress that it has been included not only as an indication of the 'backdoor' capabilities - i.e. TROJAN! - but also because as a vendor they are producing in the interests of a market, and that market has stipulated a need for the identification and removal of such malware viri crossovers.

Were users to make a selective stand against the developers mercenary activity, (seriously- why not stay with donateware options under a new platform?), then there might emerge a trend for developers less keen to prostitute their abilities for a straightforward financial gain, at the expense of new and inexperienced computer users.

(Incidentally - as with Google's GMail, all additional information such as the forum threads, were witheld until such times as the issue became common knowledge and users were inundating them with concerns; does it make it right that such transparency came 'after' the revelation?? )

Hopefully things will change since the application addition has consistently been of an extremely high standard, it's a pity that the developer has pimped their obvious ability for a short-term gain.


--------------------
Got Milk?
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
Rezza
post May 9 2004, 02:51 AM
Post #6


Geek God V
Group Icon

Group: GN VIP
Posts: 2076
Joined: 3-November 03
From: ubiquitous on GN
Member No.: 4



topic title changed for clarity
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
Milk
post May 10 2004, 12:54 AM
Post #7


Super Geek
***

Group: Advanced Member
Posts: 271
Joined: 15-December 03
From: ©
Member No.: 129



QUOTE (Rezza @ May 9 2004, 02:51 AM)
topic title changed for clarity



new thread title:

Messenger+'s spyware



lol Rezza, brilliant. thumbsupsmiley.gif


--------------------
Got Milk?
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
——Vampyric——
post May 10 2004, 02:03 AM
Post #8


Geek God I
Group Icon

Group: Advanced Member
Posts: 605
Joined: 17-February 04
From: Southern Ontario, Canada
Member No.: 503



QUOTE (Milk @ May 9 2004, 12:56 AM)
false positivies are not unheard of *cough* Symantec *cough* MacAfee *cough*

Nice.


I believe patchou is not doing anything dofferent than before, still good product, and all.
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
anakinsolois
post Jun 20 2004, 06:33 AM
Post #9


Geekzilla!
Group Icon

Group: News Poster
Posts: 2160
Joined: 4-January 04
From: Coimbatore, India
Member No.: 259



old news, can be unpinned


--------------------
user posted image
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
GTX5_Crusader
post Jun 20 2004, 11:14 AM
Post #10


Cold-Blooded Loner
Group Icon

Group: SuperMod
Posts: 3697
Joined: 3-November 03
From: Where my sword takes me. (USA)
Member No.: 7



I agree. Done.

Yeah... someone lost the pin to this one. Oh well...


--------------------
The Freedom to Hack is Satisfaction. The Crime to Crack is Destruction. (? GTX5_Crusader)
IPB Image
IPB ImageIPB ImageIPB Image
- The key to understanding Internet Explorer is realizing that Microsoft isn't trying to insult your intelligence by making it automatic. Firefox makes sure you know nothing. -
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
mutinymonger
post Aug 9 2004, 05:59 PM
Post #11


Elite Geek
*****

Group: Advanced Member
Posts: 471
Joined: 2-June 04
Member No.: 2082



Another prog with spyware - Internet Explorer. Dead serious, I just installed XP PRO, after formatting C: drive, and ran a spyware scan using ad-aware. BOOM! Spyware found.
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
gofikphoenix
post Aug 9 2004, 07:19 PM
Post #12


Jew
Group Icon

Group: GN VIP
Posts: 1502
Joined: 26-November 03
Member No.: 70



IE doesn't have spyware when you download it, it comes with XP Pro. Of course i assume that if you just formatted you haven't updated and patched it, which will leave it immediatly open for spyware to get in if you decide to surf to a few sites. I have to say i find it hard to believe that the first thing you do is to install a spyware scanner and scan your computer for spyware, especially if you haven't used it yet. wacko.gif

Anyhow this thread is far to old so if GTX or Rezza would like to do the honours, or we could just let it bob down the list.


--------------------
Ban Me, I dare you!
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
mutinymonger
post Aug 9 2004, 07:28 PM
Post #13


Elite Geek
*****

Group: Advanced Member
Posts: 471
Joined: 2-June 04
Member No.: 2082



I swear on my life that I did not connect to the internet once after installing Pro. In fact, my ethernet controller driver was missing, along with some other, so I couldn't connect to the net. The spyware progs I left in tact, along with multiple progs, media and games. Trust me, it comes with spyware. As for the scanning, I thought "May as well". Not likes there's tons of spyware in it, just 1 entry.
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
gofikphoenix
post Aug 12 2004, 01:26 PM
Post #14


Jew
Group Icon

Group: GN VIP
Posts: 1502
Joined: 26-November 03
Member No.: 70



Stop swearing Mutiny, its against the rules to curse tongue.gif

Ok, i might as well believe you but i find it extremly strange.


--------------------
Ban Me, I dare you!
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
mutinymonger
post Aug 12 2004, 01:31 PM
Post #15


Elite Geek
*****

Group: Advanced Member
Posts: 471
Joined: 2-June 04
Member No.: 2082



I just read your post, and I didn't see mine above it. It freaked me out! I'm thinking "I didn't swear did I?" Then I saw the emoticon, and read my post and my heart rate receeded to a normal level again.. smile.gif
User is offlineProfile CardPM
Go to the top of the page
+Quote Post

Fast ReplyReply to this topicStart new topic

 



Lo-Fi Version Time is now: 2nd September 2010 - 11:39 PM