MediumProventia Network MFS, Proventia Network IDS, Proventia-G 1.1 and earlier, Proventia Network IPS, Proventia Desktop, Proventia Server IPS for Linux technology, RealSecure Desktop Protector 3.6, RealSecure Server Sensor, RealSecure Network, BlackICE Agent for Server, BlackICE PC Protection, Proventia Server IPS for Microsoft Windows technology, BlackICE Server Protection:
This signature looks for MessengerPlus spyware making a phone home type request after it has been installed.
Medium
Proventia Network MFS: XPU 1.42, Proventia Network IDS: XPU 24.3, Proventia-G 1.1 and earlier: XPU 24.3, Proventia Network IPS: XPU 1.42, Proventia Desktop: 8.0.614.1, Proventia Server IPS for Linux technology: 1.0, RealSecure Desktop Protector 3.6: eob, RealSecure Server Sensor: XPU 24.3, RealSecure Network: XPU 24.3, BlackICE Agent for Server: 3.6eof, BlackICE PC Protection: 3.6cpa, Proventia Server IPS for Microsoft Windows technology: 1.0.914.0, BlackICE Server Protection: 3.6.cpa, RealSecure Desktop: eob
Microsoft Windows 95, Microsoft Windows NT: 4.0, Microsoft Windows 98, Microsoft Windows 98SE, Microsoft Windows 2000, Microsoft Windows Me, Microsoft Windows XP
Unauthorized Access Attempt
Messenger Plus! is an add-on for MSN Messenger that bundles optional advertising-oriented spyware (adware). The adware is installed when Messenger Plus! is downloaded on your system. Messenger Plus! itself is not adware, but optionally installs adware called C2Media on your system, which is also known as LOP.com.
If the Messenger Plus! software is not desired, uninstall it from your system. Use an up-to-date antivirus or spyware removal program to determine if the target computer is host to a spyware program.
GIANT Labs Web site
Messenger Plus!
http://www.spynet.com/spyware/spyware-Messenger-Plus!.aspx
Messenger Plus! Web site
Messenger Plus! | Get The Facts!
http://www.msgplus.net/getthefacts.php
ISS X-Force
Messenger Plus! bundler software program contains optional adware
http://www.iss.net/security_center/static/18307.php