The Messenger Plus! Sponsor Program continues to place users at risk - Winfixer rears its head again

"Shawnz", a known supporter of Messenger Plus! and a member of its help forums apparently posted the following comment to a blog entry about Messenger Plus! that I made a month ago ("Shawnz", by the way, lists his age as 14 - let's hope he hasn't installed the sponsor - if he has, he has breached the EULA which says you must be 18 or over to install the Sponsor - if he hasn't, he is NOT in a position to comment on a program that he does not use - if he's not 14 years old, well, that's the age he gives on his Spaces Blog and his MP! forum ID so that is his presumed age until proven otherwise).

Why do I say "apparently"?  Because of the remote possibility that we are dealing with a different Shawnz Wink

Shawnz says:

"can you please freaking get a life and stop whining about patchou. there are thousands of worse programs out there. at least patchou _tries_ to make it a decent package -- he hires people (using the proceeds of the sponsor) to report any unsafe ad - most of those ads, by the standard he sets, shouldn't be there.

the only reason he sticks with lop is because they also provide him with a free server for the messenger plus website, the messenger plus forum, etc."

You can find his comment here: http://msmvps.com/blogs/spywaresucks/archive/2006/11/12/277195.aspx

You would think that people like "Shawnz", even at 14, would have learned not to "poke the sleeping guard dog".  I will NOT stop watching Patchou's sponsor program, or reporting on it, at Shawnz's say so, and I would have thought that as a Messenger Plus! forum regular he would know that I have rejected, many times, excuses like those that he makes in his comment, and that flaming me only makes me more determined to watch and report.

Anyway, because the blog entry that Shawnz commented on is a month old I decided it was worth my while to reinstall the sponsor to see if the winfixer problem has been fixed and to see if the people that have apparently been hired are stopping the bad guys from getting through - thank you Shawnz for bringing my attention back to Messenger Plus! several months before I had intended to re-test. 

Is the winfixer problem gone?  Nope.

Within 12 hours of installing the Sponsor there was an attempt to install Winfixer on my machine.  Either the people that Shawnz says were hired to watch for unsafe ads don't exist, or they're not doing their job.  Every single time I install the sponsor Winfixer makes an appearance - if I can spot a problem within hours, then why can't Circle Distribution / C2Media, or their testers?

It is obvious that those behind the Sponsor Program either cannot be trusted to do the right thing by Patchou, or they are not up to the job of policing who they sell advertising space to, because every time I test, the bad guys have got through. 

The Messenger Plus! Sponsor Program continues to be a danger to those who install it.

This is what I saw within 12 hours of installing the Sponsor Program.  I emailed Patchou and sent him copies of the screenshots before I sent this blog post live so that he is made aware of the latest problem and will have the chance to take what action he can against this latest problem. 

First I saw this:

I also saw this - note the attempt to automatically download Winfixer to the PC as evidenced by the infobar - also note the new behaviour - an activex control embedded in a Web page that is made to look like a pop-up window. If you try to click on the red x to "close" the window, you activate the control.  Nice trick - not.  Of course, the claimed "624 pornographic and sensitive files" do not exist.

Close the popups and you see:

Did Trend like the attempt to download Winfixer? Hell no:

 

Published Tue, Dec 12 2006 7:01 by sandi

Comments

# re: The Messenger Plus! Sponsor Program continues to place users at risk - Winfixer rears its head again

Tuesday, December 12, 2006 1:03 AM by Paperghost

....what a spectacularly stupid comment to leave on your site. Aside from that, the ActiveX "popup" is particularly infuriating.

Sandi says @paperghost:  I presume you're speaking about the comment made by our very young friend shawnz Wink

# re: The Messenger Plus! Sponsor Program continues to place users at risk - Winfixer rears its head again

Tuesday, December 12, 2006 4:30 AM by lordpake

Nice reading, again. While I do use Plus myself, I do not accept the current situation with the sponsor and hope that your efforts will one day actually make Patchou to correct the situation :) If not, well let's at least hope more people become aware of it.

# re: The Messenger Plus! Sponsor Program continues to place users at risk - Winfixer rears its head again

Wednesday, December 13, 2006 6:58 PM by Svip

Those images you speak of?  I have seem them as well.

And may I just add the following:  I use Gaim, my Operating System is Linux and I am using Minefield (Firefox 3.0).

In conclusion, those popups you speak of are likely not the Sponsor programs' fault.  Unless it has installed on a nonnative system without me ever downloading it nor installing it.  I could show you popups if I get them again, to prove myself.

Sandi says: Your conclusions are incorrect.  Firstly, pop-ups are not unique to the MP! sponsor program.  Secondly, the *advertisers* are not unique to the MP! sponsor program. Therefore, it cannot be assumed that the popups you see, and I see, are from the same source.

The pop-ups I have captured screenshots of are most certainly generated by the sponsor program and disappear as soon as the sponsor is removed - not only that I have software that tracks exactly what generates the advertisements and where they come from - yep, from servers associated with, and files installed by, the sponsor.

I am in regular correspondence with Patchou about problem pop-ups and he has never once said that they are not generated by his sponsor program - on the contrary, he is fast to report the winfixer and AFF pop-ups to Circle Distribution for immediate removal.

As for your pop-up problems, perhaps you should check your system for other spyware or adware not related to MP! Wink

# Messenger Plus! and Winfixer - once again.

Friday, December 15, 2006 9:19 AM by Spyware Sucks

I am sick to death of this. I keep seeing Winfixer pushers using the Messenger Plus! Sponsor Program

# Important information re: the Messenger Plus! sponsor program and Winfixer

Monday, December 18, 2006 2:44 PM by Spyware Sucks

Over the past 48 hours Circle Development have edited the HOSTS file on machines that are running the