MVP awards, Messenger Plus! and adware -- a good combination?

MVP awards, Messenger Plus! and adware -- a good combination?

Summary: A controversy has been raging in certain circles the last few days over a MVP award, which has now been rescinded, to an adware pusher known as Patchou, Cyril Paciullo, the author of Messenger Plus!. There's a lot of nonsense going around and I'd like to clear some of that up.

SHARE:
TOPICS: Security
7

A controversy has been raging in certain circles the last few days over a MVP award, which has now been rescinded, to an adware pusher known as Patchou, Cyril Paciullo, the author of Messenger Plus!, now known as Messenger Plus! Live. Ed Bott blogged about it here. Patchou's devotees have been staunchly defending him and his app and are blaming a few MVPs for causing Microsoft to rescind the award.  There's a lot of nonsense going around and I'd like to clear some of that up. 

Why did the security MVPs, including myself, object to Patchou's award?  Simple answer -- his app bundles adware and a rather nasty adware at that, best known as Lop even though Patchou and Messenger Plus! refer to it as the "sponsor". So what's wrong that?  The devotees say the adware is optional, which is true, but there's some guilt thrown at a user who opts out of the "sponsor".  The dialog says "I refuse to give my support, don't install the sponsor".  "Gee -- I must be bad if I don't install the sponsor." See SunbeltBLOG for screenshots.  Also Messenger Plus! is widely known to be primarily targeted at kids under 18, who cannot enter into a legal contract and likely would not understand the EULA, if they bothered to read it. 

So what is this "sponsor" software?  I downloaded and installed MessengerPlus! Live, including the "sponsor" to see for myself. Lop is primarily advertising software that spawns pop-ups on the desktop. Lop used to include a toolbar and change the user's homepage, but that behavior has been eliminated. The "sponsor" installer adds a fake bho (browser helper object) in the registry and creates a hidden job that starts IE in the background and launches another executable. I observed Lop to keep two instances of Internet Explorer running constantly, even when I didn't have a browser open. Each time I opened IE one or two pop-ups immediately appeared.  These pop-ups are not branded, unlike WhenU and Zango even. When I tried to terminate the two instances of IE, one or two other files would kick into action and restart IE, files with names like JugsRoam.exe and heart bend send dash.exe. You can see a list of file names used by Lop here. Lop frequently changes file and folder names in an attempt to evade detection by anti-malware programs. The EULA even contains a clause prohibiting its removal by other applications. The Lop processes continuously contact these domains, ayb.dns-look-up.com and ads.dns-look-up.com, which reside on an IP address owned by C2 Media, the makers of Lop.

It's no wonder that many of the anti-malware vendors call the "sponsor software" a trojan, Trojan Swizzor

SunbeltBLOG has some additional gripes about the "sponsor".

Ok, to those who support Patchou?  Fundamental problem:  LOP stinks.  And imagine someone installing MessengerPlus and getting that little cute icon to "upgrade your antivirus program" and getting an outright fraudulent scam.  Imagine that person being a relative of yours who doesn't quite know much about computers, and getting scammed.  Or getting popups they don't know the source of (because LOP does not disclose that the popup was generated by LOP, unlike even WhenU or Zango).  

Note the link to the desktop icons placed by the "sponsor".  One additional thing -- I mentioned earlier that a large percentage of Messenger Plus! users are under 18. The "sponsor" displays pop-ups that are entirely inappropriate to tweens and young teenagers, ads for AdultFriendFinder and the like. 

One of the best sources of technical information and history for Messenger Plus! and the sponsor software, short of installing it yourself, is from another Microsoft MVP, Sandi Hardmeier, who has chronicled Messenger Plus! and its changes for several years now. 

Personally, I think Microsoft made a mistake in awarding Patchou and did the right thing by rescinding the MVP award.  If Messenger Plus! wasn't bundled with adware, I would feel differently. I understand that Patchou has to earn a living and I hear that he is technically astute and an excellent programmer, but in my opinion, an adware distributor should not be given the MVP award, especially when the adware in question has such disturbing, trojan-like behaviors. 

Topic: Security

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

7 comments
Log in or register to join the discussion
  • It does make sense

    Now that Microsoft has entered the protection racket errrrr security business I mean, expect the makers of SpySheriff, CWS, Vundo, and Zango to recieve plaques and thank-you notes.
    zmud
  • RE: MVP awards, Messenger Plus! and adware -- a good combination?

    I used to rely on Patchou's little add-on, but now... I'm not sure.
    If somebody asks me about messenger plus! I will definitely tell them to steer away from the it.
    Too bad!
    nachol18
  • RE: MVP awards, Messenger Plus! and adware -- a good combination?

    I don??t fully agree. If you tell you could feel "bad" for the "i refuse to help" text... I??ll feel really sorry for you.
    About the Plus being used by kids... if you don??t want to allow your kids to install an app, then set them an user without administrative rights.
    I really dislike any kind of adware, spyware or wathever you want to name it, but it??s up to you to have your computer clean or full of those programs.
    criado
    • Are you kidding?!

      So you are saying that adware, viruses, and spyware are installed voluntarily, and it is your problem if you get them!
      I have heard some extreme things, but never this extreme...!!!
      Madsmasher
  • RE: MVP awards, Messenger Plus! and adware -- a good combination?

    While I agree with you that Microsoft did the right thing by taking the award back, the real damage was done by giving the award in the first place.

    It is not unlike taking back the Olympic Gold Medal years after the fact. The notoriety derived is still there, maybe to an even greater extent since the controversy has grown, and the new winner is similar to the new gold medalist that gets the email playing the Olympic theme announcing they won the gold.
    ty_pippen
  • RE: MVP awards, Messenger Plus! and adware -- a good combination?

    It's good that MS rescinded that award. It is bad enough fighting spam and other unwanted items without having someone who otherwise would deserve the award joining in on the "dark side."
    accessbob1
  • RE: MVP awards, Messenger Plus! and adware -- a good combination?

    http://www.analogstereo.com/mercedes_ml_class_owners_manual.htm
    us_forums