66.220.17.126

[MysteryFCM]

The file is uploaded now (apologies for taking so long to reply, just got back in).

Cheers for dropping by with some rationale

[Menthix]

The file is uploaded now (apologies for taking so long to reply, just got back in).

The screencast confirms the theory from my last post:

• 02:00: Messenger Plus! 4.85.386 detects you don't have any compatible Windows Live Messenger version installed, but you do have an old Windows Messenger version installed. As a result Plus! offers you to download the old (3.63.148) version which is compatible with your configuration.
  
• 02:05: Messenger Plus! 3.63.148 starts being downloaded.
  
• 03:25: The Messenger Plus! 3.63.148 installer launches, this is a separate installer (can also be downloaded directly from http://www.msgpluslive.net/download/old/). Anything that happens past this point is not caused by the current Plus! version.
  
• 54:58: The old Messenger Plus! installer is finally loaded, as you can see it says 3.63.148 in the bottom-left.
  
• 55:08: You select to install the sponsor package, which is CiD. (BTW, you could have selected the other option to not have any sponsor package at all.)
  
• 55:32: The sponsor program license agreement which explains what the CiD package does is shown which the user needs to agree to before he can continue.
  
• 03:25:10: Windows Messenger is launched. Having this installed was the reason why you were offered to install the old Plus! version instead of the current version without CiD.
  
• 03:36:46: Recorder.exe is taking up almost all CPU resources. This is probably why it is taking so incredibly long. Under normal circumstances even on relatively slow systems inside a VM it never really takes more than 5 minutes to complete the installation.
  

So:

• No, MsgPlusLive-485.exe itself does not contain or install anything related to CiD or Swizzor. The same thing goes for every recent Messenger Plus! version released since February this year.
  
• However, in an unusual situation the current Plus! versions will offer you to download an older version (the 3.63.148 installer was digitally signed July 2008). This version in bundled with CiD (sometimes identified as Swizzor).
  
• Since MalwareBytes is blocking the site (not the installer file) for distribution of CiD I would say that is correct because the site does indeed still offer http://www.msgpluslive.net/download/old/, even though a tiny portion of the users download this version as opposed to the current version.
  
• Eset NOD32 on the other hand is not correct in classifying the current installer file itself as badware. If anything they should have labeled just the 3.x Messenger Plus! installers as badware.
  
• But because Yuna is already moving away from CiD I would say they either stop offering the old Messenger Plus! version, or remove the CiD package from this old version. See http://forums.malwarebytes.org/index.php?s...st&p=295857. If that would be done I don't see any reason for MalwareBytes and NOD32 (and any other badware scanner for that matter) to continue classifying Messenger Plus! as a threat. MysteryFCM, do you agree?
  

[MysteryFCM]

Pretty much, yes (I don't do VM's btw ).

I know I could've selected the other option btw, but the point was to show Swizzor's installation .

[MysteryFCM]

(sarcasm alert) Nice to know the users are mature ......;

http://www.msghelp.net/showthread.php?tid=95106&pid=998871#pid998871

"A**ehole" and "idiot" ?? .....

[Chrono]

Welcome to the internet, there are trolls everywhere nowadays. You cant judge the community by reading a few comments from a couple of members

Seriously though, and take this as a nice advice, upgrade your system if you're going to be doing tests like these. Also, it's quite funny that you do such tests but fail to use proper and secure codecs for your videos: http://en.wikipedia.org/wiki/Indeo#Security_advisory

Also, it's funny that you tried to install Messenger Plus! without even installing Messenger first. What's the point of having an addon for Messenger when you don't have Messenger? No one would do that. You should try to recreate a real situation, and that means installing Windows Live Messenger AT LEAST. i doubt the quality of any of your testings now, thanks to your video.

Btw: "03:36:46: Recorder.exe is taking up almost all CPU resources. This is probably why it is taking so incredibly long. Under normal circumstances even on relatively slow systems inside a VM it never really takes more than 5 minutes to complete the installation." << The fact that you didn't realize about that and blamed the slow installation on Plus! itself makes me think that you dont really know what you are doing.

And what menthix said.

Regards.

[MysteryFCM]

Welcome to the internet, there are trolls everywhere nowadays. You cant judge the community by reading a few comments from a couple of members

I wasn't judging the community.

Seriously though, and take this as a nice advice, upgrade your system if you're going to be doing tests like these.

My test system is just fine thank you.

Also, it's quite funny that you do such tests but fail to use proper and secure codecs for your videos: http://en.wikipedia.org/wiki/Indeo#Security_advisory

It's one of the codecs that comes with CamStudio

Also, it's funny that you tried to install Messenger Plus! without even installing Messenger first. What's the point of having an addon for Messenger when you don't have Messenger? No one would do that. You should try to recreate a real situation, and that means installing Windows Live Messenger AT LEAST.

Once again, the only point to the test, was to show MsgPlus installed Swizzor. The reasons it did such, and the situations in which it did such, were and continue to be, irrelevant. It wasn't a test of the program itself, nor was it ever intended to be such, hence not installing the latest WLM prior to testing.

i doubt the quality of any of your testings now, thanks to your video.

Your choice.

Btw: "03:36:46: Recorder.exe is taking up almost all CPU resources. This is probably why it is taking so incredibly long. Under normal circumstances even on relatively slow systems inside a VM it never really takes more than 5 minutes to complete the installation." << The fact that you didn't realize about that and blamed the slow installation on Plus! itself makes me think that you dont really know what you are doing.

It actually had nothing to do with Recorder.exe, it still took a while even without the recording software running. All recorder.exe did was make slow turn slower.

[Chrono]

I wasn't judging the community.

My test system is just fine thank you.

It's one of the codecs that comes with CamStudio

Once again, the only point to the test, was to show MsgPlus installed Swizzor. The reasons it did such, and the situations in which it did such, were and continue to be, irrelevant. It wasn't a test of the program itself, nor was it ever intended to be such, hence not installing the latest WLM prior to testing.

Your choice.

It actually had nothing to do with Recorder.exe, it still took a while even without the recording software running. All recorder.exe did was make slow turn slower.

Yet again, are you blind enough not to see that the fact that it took you "over an hour" to install was your own fault? i've been using the program since 2003 and i've never had problems installing it. 2 minutes tops. 1 hour? who are you kidding?

And then you dont expect people to think you're an idiot and an censored. Again, update your system (or upgrade your hardware, because it seems to me that you're still on a 486 machine ).

[Chrono]

Oh and the fact that it was "one of the codecs that came with camstudio" doesn't mean that you can't use a proper one. Do you know anything about something called "a configurations panel"? Again, it's an unsecure codec, and you should know it considering that's part of what you do here.

Sorry for the double post, but there's no edit button

[MysteryFCM]

Yet again, are you blind enough not to see that the fact that it took you "over an hour" to install was your own fault? i've been using the program since 2003 and i've never had problems installing it. 2 minutes tops. 1 hour? who are you kidding?

And then you dont expect people to think you're an idiot and an asshole. Again, update your system (or upgrade your hardware, because it seems to me that you're still on a 486 machine ).

Am I aware that I could've used a much faster system with more resources? Yes - but I don't have a much faster test machine at present. As for "Again, update your system" - not everyone has an endless supply of funds available to do such, some of us have family and bills, but thanks for playing.

[MysteryFCM]

Oh and the fact that it was "one of the codecs that came with camstudio" doesn't mean that you can't use a proper one. Do you know anything about something called "a configurations panel"? Again, it's an unsecure codec, and you should know it considering that's part of what you do here.

I am aware of that, and had it been for anything else, I'd have used one of the other codecs, but as they produce a much larger file, and this being a large file to begin with, I opted for the one that produced the smallest file. However, as it's completely unrelated to the topic at hand - it's irrelevant.

[Chrono]

i have bills too, and i have a crap computer too, so we have a lot in common (lol?). The thing is that i don't use this crap computer for testing purposes, and you shouldn't either, specially if you're gonna talk about the speed of the installer. What kind of tester are you if you dont have the proper machine to do proper testing?

i just installed the latest version of Messenger Plus! Live to see how much time does it take me. it took me no more than 2 minutes. i have 768mb of ram, an athlon XP processor (2.6gh). i bet you have a better system than mine (but still crap enough to prevent you from doing proper testing). im guessing your computer is full of malware, specially seeing that a windows update popup keeps asking you to restart every few minutes. i seriously cant believe you dont use a totally upgraded version of windows to do the testing, how unprofessional of you.

Regards

[Chrono]

The whole codecs thing is not irrelevant, because it gets to show how little you care about security, even though you're supposed to care.

There were like 5 minutes of useful recording in that 3 hours video. You could've used a proper codec and cut the unnecesary parts of the video out of it instead (saving us a lot of time too, btw).

[MysteryFCM]

Alas once again, the only purpose of the test was to show the presence of Swizzor. It wasn't about the program, nor was it about the speed of the installer, so this part of the discussion is OT and thus, irrelevant.

As for the popup, that was actually due to Windows Updates having just been installed and the machine not having been rebooted (and before you start, WU is completely irrelevant in this case - it was solely about the presence of Swizzor), but again, that's irrelevant.

Can we get back to the topic at hand now?

[MysteryFCM]

The whole codecs thing is not irrelevant, because it gets to show how little you care about security, even though you're supposed to care.

There were like 5 minutes of useful recording in that 3 hours video. You could've used a proper codec and cut the unnecesary parts of the video out of it instead (saving us a lot of time too, btw).

I could've edited the video to cut the "unnecessary parts", yes, but then I'd have been accused of editing it to hide something - so I didn't cut or edit anything.

As for my not caring, you're entitled to your opinion. Thankfully, those that know me, know me better. And once again, this is completely unrelated to the topic at hand, so this part of the discussion is over.

[Menthix]

Messenger Plus! 4.85 was re-released yesterday.

http://www.msgpluslive.net/download/ - http://mirror10.msgpluslive.net/20100808/T...lusLive-485.exe

This version will not offer to download the older version anymore. In adition the installer of the old version is removed from the server and http://www.msgpluslive.net/download/old/ has been modified accordingly.

MysteryFCM: Can you re-check and see if there is still a reason for MalwareBytes to continue blocking the site? Apparently NOD32 started blocking download.msgpluslive.net a few days ago, should be fine for them to stop blocking too.

[MysteryFCM]

I'll get it re-tested, thanks for letting me know (any reason I'm not seeing a mention of this on the website or forums btw?).

[Menthix]

Correction: http://www.msgpluslive.net/download/old/ is being offered again, but without the CiD/Swizzor in it. This just happened between my last post and now.

I guess that may also be why there isn't any official mention on the website/forum about it. Looks like it is still being worked on. Although I don't know if there will even be a news post or anything about it when it is done since this affects so few users.

[MysteryFCM]

No problem, was just curious.

[Menthix]

http://www.msgpluslive.net/download/old/ -> http://download.msgpluslive.net/setup/MsgPlus3-Setup.exe is now signed 9 August 2010

http://www.msgpluslive.net/download -> http://mirror10.msgpluslive.net/20100808/T...lusLive-485.exe is 8 August 2010

[CyberJake4D]

Dear Malwarebytes staff,

What a thread! Congratulations MysteryFCM.

My choice of security software and combination take into account pros and cons from internal and external information (user experiences, tests, etc.). As an end user of MBAM Pro, detection of any malware is main focus.

Apart from the technical side, the interest to read this exchange was about behavior; good from management (Nathalie) to show her company concern and technicality (Menthix) who better identified how the malware is incorporated to their product. On the other hand, someone waited until now in 2010 after being well caught to consider a change in their business plan! Therefore, they deserve to remain at least on an unofficial brown list.

Okay, no official mention about it... As far as well informed user Chrono is concerned, who focuses wrongly on the chronometer for irrelevancy (trying to disrupt the case of a solid detection), his or her logic isn't an attraction for MSG Plus Live!

Just an opinion,

CyberJake4D

[MysteryFCM]

Apologies for taking so long to reply. The results will be finalized within the next 12 hours (I've had a few other things that needed testing and re-testing first).

[MysteryFCM]

I've re-tested the latest release and Swizzor is indeed, no longer installed. Definately good to see this change (pity it took so long + blacklisting their IP range, for them to make this change though). As long as the old installers aren't present (will be checking once posted this), they'll be unblocked.

[Chrono]

Okay, no official mention about it... As far as well informed user Chrono is concerned, who focuses wrongly on the chronometer for irrelevancy (trying to disrupt the case of a solid detection), his or her logic isn't an attraction for MSG Plus Live!

i was certainly not focusing on the main matter of this thread, i'll give you that one, but do you really think that HOW they test things is irrelevant? Why trust a program like this a 100% when you know that anyone can make a mistake? Someone has to keep an eye on them too, i think it's good for everyone that someone gives his opinion about how the testing is done. I dunno if MysteryFCM will take note of anything i said, but an observation/criticism should always be well received. i was certainly not "disrupting the case of a solid detection"

Regards

[CyberJake4D]

Dear Chrono,

I'll answer you, just one last post. Of course, you could post back if you wish.

Simply, it seems you look at the other side of the medal (seemingly of a good product) whereas Malwarebytes checks if anyhow a website (here, through a possible product download) could be associated to a piece of malware.

Because it's not a comparison or performance test, just a detection test (there's a malware or not), equipment quality and software updates is not important here. So, from the flip side of the medal, it appears your position elongated this thread needlessly.

When alerted by IP protection, MBAM end users can be more careful (investigate better). A good reason to use this security software.

MSG Plus! Live would be more attractive to security aware individuals when dissociated from any malware.

Best wishes of PC security,

CyberJake4D

[MysteryFCM]

Just to put an end to this, I've confirmed the old installer no longer comes with Swizzor, and as such, removed the block on this IP.