Originally Posted by KingPhoenix

weird... all the spyware detectors ive used dont detect it...

Originally Posted by scastle

Right. Just been doing some diggining around. Found this: http://www.wilderssecurity.com/showthread.php?t=30511 . People who know Patchou (Messenger Plus programmer) say there is a "sponsor program" you can opt to install, which installs adware from lop.com, but if you opt not to install it, you don't get adware.

However, some other people claim they installed Messenger Plus, and despite opting NOT to install the "sponsor program", there was spyware left on their system, and the msgplush DLL (installed as part of Messenger Plus) bound itself to every process that connected to the Internet, despite the fact it had no apparent purpose.

Assuming all that is true, it looks extremely suspicious.

Originally Posted by Willdersecurity.com

Messenger Plus is MALWARE!

--------------------------------------------------------------------------------

Here's a news article from spywareinfo.com to prove it:

Messenger Plus Bundling Lop.com

Many of you may have heard of a program called Patchou's "Messenger Plus". I used it myself once, before I discovered Trillian. Similar to the many front end programs for Internet Explorer (Avant browser, MyIE2, etc), Messenger Plus adds a user interface to Microsoft's MSN Messenger that contains extra features.

Patchou has brought in C2Media as a sponsor and is now bundling their lop.com software into Messenger Plus. For those of you who have never heard of it, lop.com software is classified as a trojan by antivirus vendors and as a browser hijacker by antispyware vendors. You can find plenty of information about it by doing a Google search for lop.com. Just be warned - some of the language used by lop victims will melt your monitor.

No single parasite has caused as many support threads at our message boards as lop.com (although Xupiter comes close). Ad-aware, Spybot, and all other spyware removal programs target several older variants of lop.com. It now comes in a version that is nearly impossible to detect automatically. It uses randomly named files, randomly generated CLSID identifiers, and uses activex installation methods that let them update all of their installers at once.

Before this change, the number of lop.com complaints actually had gone down because it was so easy to remove and could even be blocked beforehand. Since C2Media introduced these new versions that mutate randomly, the number of infections has become larger than ever. The only sure way to be rid of it is to ask for help at the SWI support forums.

Patchou, the developer of Messenger Plus, has issued a statement regarding the complaints he's been receiving due to his new "sponsor". To all of the people who are saying that they won't use his program because of lop.com, he has this to say, "I don't want to be rude but if you boycot version 2.10.36, you're an idiot."

<sarcasm>
Rude? Well gee, what could possibly be "rude" about being called an "idiot" for refusing to install software that sets off trojan alarms in antivirus programs?
</sarcasm>

Whether it makes you an idiot or not, I strongly recommend that everyone stay as far away from Patchou's Messenger Plus as possible. If you have installed it already and now have lop.com's software all over your system, uninstalling Messenger Plus supposedly will also remove lop. If that doesn't work, then please read this FAQ and follow the instructions. We are very experienced at removing this thing and can easily walk you through it.

Originally Posted by scastle

However, some other people claim they installed Messenger Plus, and despite opting NOT to install the "sponsor program", there was spyware left on their system, and the msgplush DLL (installed as part of Messenger Plus) bound itself to every process that connected to the Internet, despite the fact it had no apparent purpose.

Originally Posted by AndrewJames

Well I have msn plus and a patch thing from mess.be installed so I guess I should be kinda worried?