Security news and information

The Microsoft MVP Program consists of people who were awarded by Microsoft for to their participation in the various communities that cover and support Microsoft products.  Whether this be making free Windows tools, helping with spyware removal, or answering questions on the forums or newsgroups, these people get awarded an MVP as a sign of recognition for the free help they provide. 

Unfortunately, though, this October when the latest batch of renewals and new awardees were admitted we found a new MVP who leaves a bad taste in our mouths.  This awardee is Cyril Paciullo, otherwise known as Patchou, and is well know as the creator of Messenger Plus.  As a program, Messenger Plus actually has some slick features, but our problem is that this program also comes with a known adware and Trojan called LOP.

What is funny is when Microsoft Security MVP Derek Knight scanned the main executable for Messenger Plus, at the free scanning site VirusTotal, Microsoft was the only vendor that stated that the installer was a threat. 

When you install Messenger Plus you are given an option to install their “sponsored” application, otherwise known as LOP, as shown below.  They do not force you to install the sponsor and it is entirely your option.  As a matter of fact they offer the sponsor program quite politely. Once installed, though, this program will add a bunch of icons to your desktop for online gambling, ringtones, and watching television and will display popup ads on your computer when you are browsing the Internet. To uninstall the program you need to run the Messenger Plus uninstall program where you can specify to remove the sponsor.  Sunbelt Blog has a good writeup, with more pictures, on the effects of LOP.

Our main problem with this awardee is not he wants to make some money through his software, as everyone is entitled to make money off of their hard work, but that he is using this program to distribute a known Trojan and Adware that in the past was notoriously difficult to remove.  This becomes even more of a problem as Messenger Plus is targetted at a younger audience who may not even bother to read the EULA. 

What we find so confusing is why Microsoft would want to have someone who distributes this type of malware as part of their program, regardless of whether or not it is optional.  As a Microsoft MVP, though you are not an employee you are someone who represents Microsoft and their products.  To me, this latest awardee only tarnishes the image and program that Microsoft is attempting to foster.

If you do not think that LOP is too bad, as Messenger Plus has a league of fanatics who think there is nothing wrong with this sponsor program, then why would so many Anti-virus vendors flag it as malware?

C2.Lop
http://www.pestpatrol.com/spywarecenter/pest.aspx?id=453094362
http://vil.nai.com/vil/content/v_134945.htm
http://www.xblock.com/product_show.php?id=405
http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453094362
http://research.sunbelt-software.com/threatdisplay.aspx?name=C2.Lop&threatid=8144

Swizzor (Another name for LOP)
http://www3.ca.com/securityadvisor/virusinfo/virus.aspx?id=14461
http://www.bitdefender.com/VIRUS-143019-en–Trojan.Swizzor.DH.html
http://www.viruslist.com/en/viruses/encyclopedia?virusid=65694
http://www.sophos.com/virusinfo/analyses/trojswizzorbq.html
http://www.f-secure.com/v-descs/swizzor.shtml
http://vil.nai.com/vil/content/v_134088.htm

Tags: Security, Microsoft, LOP, Messenger Plus