MSN Plus! - This is what happens when you install

**XPerties** · June 13, 2003

I found this over on their forums, as a member posted it showing his unhappiness about the new spyware stuff that gets installed now. I thought you all should know about this and understand what happens.

=======================================================

Plus with Lop Registry:

REGEDIT4

[HKEY_CLASSES_ROOT\CLSID\{0f21c63c-6c2f-457d-83d3-6663758ed5f0}]

@="vemkrfysspwpmpowehnl"

[HKEY_CLASSES_ROOT\CLSID\{0f21c63c-6c2f-457d-83d3-6663758ed5f0}\InprocServer32]

@="C:\DOCUME~1\ADMINI~1\APPLIC~1\chyaglmch.dll"

"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{0f21c63c-6c2f-457d-83d3-6663758ed5f0}\ProgID]

@="cwewz.chlymlcrnwuwi.1"

[HKEY_CLASSES_ROOT\CLSID\{0f21c63c-6c2f-457d-83d3-6663758ed5f0}\VersionIndependentProgID]

@="cwewz.chlymlcrnwuwi"

[HKEY_CLASSES_ROOT\CLSID\{b29aad89-f23e-424b-91c5-eaca1cb13128}]

@="lknsglprooc"

[HKEY_CLASSES_ROOT\CLSID\{b29aad89-f23e-424b-91c5-eaca1cb13128}\InprocServer32]

@="C:\DOCUME~1\ADMINI~1\APPLIC~1\chyaglmch.dll"

"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{b29aad89-f23e-424b-91c5-eaca1cb13128}\ProgID]

@="xrcsf.chlymlcq.1"

[HKEY_CLASSES_ROOT\CLSID\{b29aad89-f23e-424b-91c5-eaca1cb13128}\VersionIndependentProgID]

@="xrcsf.chlymlcq"

[HKEY_CLASSES_ROOT\cwewz.chlymlcrnwuwi]

@="vemkrfysspwpmpowehnl"

[HKEY_CLASSES_ROOT\cwewz.chlymlcrnwuwi.1]

@="vemkrfysspwpmpowehnl"

[HKEY_CLASSES_ROOT\cwewz.chlymlcrnwuwi.1\CLSID]

@="{0f21c63c-6c2f-457d-83d3-6663758ed5f0}"

[HKEY_CLASSES_ROOT\cwewz.chlymlcrnwuwi\CLSID]

@="{0f21c63c-6c2f-457d-83d3-6663758ed5f0}"

[HKEY_CLASSES_ROOT\cwewz.chlymlcrnwuwi\CurVer]

@="cwewz.chlymlcrnwuwi.1"

[HKEY_CLASSES_ROOT\xrcsf.chlymlcq]

@="lknsglprooc"

[HKEY_CLASSES_ROOT\xrcsf.chlymlcq.1]

@="lknsglprooc"

[HKEY_CLASSES_ROOT\xrcsf.chlymlcq.1\CLSID]

@="{b29aad89-f23e-424b-91c5-eaca1cb13128}"

[HKEY_CLASSES_ROOT\xrcsf.chlymlcq\CLSID]

@="{b29aad89-f23e-424b-91c5-eaca1cb13128}"

[HKEY_CLASSES_ROOT\xrcsf.chlymlcq\CurVer]

@="xrcsf.chlymlcq.1"

[HKEY_CURRENT_USER\Software\ielaeaacouclly]

"cv"=dword:00000000

"eeprhcoooocprashaastesheootpshtooouooshycthssibsspooprtst"="xxxxxxxxxxx.ca"

"hck"=dword:00000001

"hh"=dword:00000003

"hv"=dword:00000000

"lkv"=dword:00000001

"lyea"=dword:ffffffff

"lyiiea"=dword:00000003

"oh"=dword:00000000

"oknoo"="xxxxxxxxxxxx.ca"

"ooc"="Fri Jun 13 08:48:48 2003"

"pro"=dword:00000000

"stc"="Fri Jun 13 08:48:48 2003"

"troowlhckcvvavcweac"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"

"troowlhcktrqweoo"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

"troowlhcktrqweoooo"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

"vi"="2.73pkg"

"ya"=dword:00000000

"ylprlylkc"=dword:0079dd47

"yoo"=hex:37,39,35,62,37,39,38,62,39,38,66,36,66,61,32,35,00

"yy"="70000010"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"AutoSearch"=dword:00000000

"Search Bar"="http://E25768.find-quick.com/searchbar.html"

"Search Page"="http://E25768.find-quick.com/searchbar.html"

"Use Search Asst"="no"

"Window_Placement"=hex:2c,00,00,00,02,00,00,00,03,00,00,00,ff,ff,ff,ff,ff,ff,\

ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,9a,00,00,00,16,00,00,00,7a,02,00,00,57,01,00,00

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser]

"ITBarLayout"=hex:11,00,00,00,4c,00,00,00,00,00,00,00,34,00,00,00,1b,00,01,00,\

4d,00,00,00,01,00,00,00,20,07,00,00,a0,0f,00,00,05,00,00,00,62,05,00,00,26,\

00,00,00,02,00,00,00,21,07,00,00,a0,0f,00,00,04,00,00,00,21,01,00,00,a0,0f,\

00,00,06,00,00,00,60,05,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,89,ad,9a,b2,3e,f2,4b,42,91,c5,ea,ca,1c,b1,31,28,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00

"{B29AAD89-F23E-424B-91C5-EACA1CB13128}"=hex:89,ad,9a,b2,3e,f2,4b,42,91,c5,ea,\

ca,1c,b1,31,28

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Backup]

"cv"=dword:0000000a

"eeprhcoooocprashaastesheootpshtooouooshycthssibsspooprtst"="xxxxxxxxxxxx.ca"

"hck"=dword:00000001

"hh"=dword:00000003

"hv"=dword:0000003f

"lkv"=dword:00000001

"lyea"=dword:ffffffff

"lyiiea"=dword:00000003

"oh"=dword:00000000

"oknoo"="xxxxxxxxxxxxx.ca"

"ooc"="Fri Jun 13 08:48:48 2003"

"pro"=dword:00000000

"stc"="Fri Jun 13 08:48:48 2003"

"troowlhckcvvavcweac"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"

"troowlhcktrqweoo"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

"troowlhcktrqweoooo"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

"vi"="2.73pkg"

"ya"=dword:00000000

"ylprlylkc"=dword:0079dd47

"yoo"=hex:37,39,35,62,37,39,38,62,39,38,66,36,66,61,32,35,00

"yy"="70000010"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021493-0000-0000-C000-000000000046}\Enum]

"Implementing"=hex:1c,00,00,00,01,00,00,00,d3,07,06,00,05,00,0d,00,0c,00,31,00,\

1e,00,d8,00,06,00,00,00,01,24,d0,30,81,6a,d0,11,82,74,00,c0,4f,d5,ae,38,83,\

31,68,32,a0,48,1b,44,a3,42,7c,2a,44,0a,94,78,f3,31,ee,c4,68,47,d2,11,be,5c,\

00,a0,c9,a8,3d,a1,61,4e,a2,ef,78,b0,d0,11,89,e4,00,c0,4f,c9,e2,6e,62,4e,a2,\

ef,78,b0,d0,11,89,e4,00,c0,4f,c9,e2,6e,64,4e,a2,ef,78,b0,d0,11,89,e4,00,c0,\

4f,c9,e2,6e

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021494-0000-0000-C000-000000000046}\Enum]

"Implementing"=hex:1c,00,00,00,01,00,00,00,d3,07,06,00,05,00,0d,00,0c,00,31,00,\

1f,00,4b,00,02,00,00,00,25,8c,5c,4d,75,d0,d0,11,b4,16,00,c0,4f,b9,03,76,7f,\

de,ea,bd,65,c2,d0,11,bc,ed,00,a0,c9,0a,b5,0f

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]

"SavedLegacySettings"=hex:3c,00,00,00,34,00,00,00,01,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]

"@shdoclc.dll,-867"="&Tip of the Day"

"@shdoclc.dll,-868"="Shows the Tip of the Day."

[HKEY_CURRENT_USER\Software\Patchou]

[HKEY_CURRENT_USER\Software\Patchou\MsgPlus2]

"DefaultConfiguration"="Nobody"

"LanguageFile"="DefaultLg.dat"

"SoftwareState"=dword:3ee9c82c

[HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\Nobody]

[HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\Nobody\Preferences]

"LogInUnicode"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG]

"Seed"=hex:8d,fd,de,58,10,fc,00,d2,9d,e8,4b,77,46,f9,e1,52,85,37,70,a2,00,33,\

00,f8,52,5a,03,3c,2b,8b,80,bd,73,c6,bb,cb,b0,7a,be,eb,52,ae,d8,02,40,8e,74,\

25,50,30,8a,94,d1,c4,bd,05,be,52,f2,95,30,a5,a0,31,e8,e8,5a,c4,33,0b,71,75,\

ff,69,07,98,c3,a7,4a,86

"Active"=dword:00000001

"Enabled"=dword:ffffffff

"EventClassID"="{D5978630-5B9F-11D1-8DD2-00AA004ABD5E}"

"InterfaceID"="{D597BAB3-5B9F-11D1-8DD2-00AA004ABD5E}"

"OwnerSID"="S-1-5-21-1757981266-1592454029-725345543-500"

"PerUser"=dword:ffffffff

"SubscriptionID"="{6C5C4393-7A5D-4975-83B3-0DF21D600635}"

"SubscriptionName"="Messenger ISensLogon Subscription"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}\Subscriptions\{81A5BEC0-ACEE-4166-BC75-D66CED9851A5}]

"Active"=dword:00000001

"Enabled"=dword:ffffffff

"EventClassID"="{D5978620-5B9F-11D1-8DD2-00AA004ABD5E}"

"InterfaceID"="{d597bab1-5b9f-11d1-8dd2-00aa004abd5e}"

"OwnerSID"="S-1-5-21-1757981266-1592454029-725345543-500"

"PerUser"=dword:ffffffff

"SubscriptionID"="{81A5BEC0-ACEE-4166-BC75-D66CED9851A5}"

"SubscriptionName"="Messenger ISensNetwork Subscription"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}\Subscriptions\{81A5BEC0-ACEE-4166-BC75-D66CED9851A5}\SubscriberProperties]

"ulConnectionMadeTypeNoQOC"=hex:13,00,00,00,07,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]

"AutoSearch"=dword:00000000

"Search Bar"="http://E25768.find-quick.com/searchbar.html"

"Search Page"="http://E25768.find-quick.com/searchbar.html"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search]

"SearchAssistant"="http://E25768.find-quick.com/searchbar.html"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{b29aad89-f23e-424b-91c5-eaca1cb13128}"="lknsglprooc"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MessengerService\Policies]

"IMWarning"="MsgPlus rocks!"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0f21c63c-6c2f-457d-83d3-6663758ed5f0}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products40820900063D11C8EF00054038389C\Usage]

"ProductNonBootFiles"=dword:2ecd001a

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MessengerPlus2"="\"@ProgFiles\Messenger Plus! 2\MsgPlus.exe\""

"wmcy"="C:\DOCUME~1\ADMINI~1\APPLIC~1\prklyvoo.exe -QuieT"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MessengerPlus2]

"DisplayName"="Messenger Plus!"

"UninstallString"="\"@ProgFiles\Messenger Plus! 2\MsgPlus.exe\" /Uninstall"

[HKEY_LOCAL_MACHINE\SOFTWARE\Patchou]

[HKEY_LOCAL_MACHINE\SOFTWARE\Patchou\MsgPlus2]

"BinDir"="@ProgFiles\Messenger Plus! 2"

"FileNameDll"="MsgPlusH.dll"

"FileNameExe"="MsgPlus.exe"

"LocalizationDir"="@ProgFiles\Messenger Plus! 2\Resources"

"SoftwareBuild"=dword:0000232f

====================================================

Plus with Lop and what it installs in your directorys:

+---Documents and Settings

| \---Administrator

| +---Application Data

| | aieaop.lib

| | chyaglmch.dll

| | index_01.gif

| | index_02.gif

| | index_03.gif

| | index_04.gif

| | index_05.gif

| | index_06.gif

| | index_07.gif

| | index_08.gif

| | index_09.gif

| | index_10.gif

| | index_11.gif

| | index_12.gif

| | index_13.gif

| | index_14.gif

| | index_15.gif

| | index_16.gif

| | index_17.gif

| | index_18.gif

| | index_19.gif

| | moumgvwioo.exe

| | prklyvoo.exe

| | spacer.gif

| | try_b_16.gif

| |

| +---Cookies

| | administrator@atdmt[1].txt

| | administrator@ayb.lop[1].txt

| | administrator@bins.lop[1].txt

| | administrator@j9122.bins.find-quick[1].txt

| | administrator@p12539.find-quick[1].txt

| | administrator@www.msgplus[2].txt

| | index.dat

| |

| \---Favorites

| | Adult Entertainment.url

| | Gambling.url

| | Games.url

| | MP3 Music.url

| | News.url

| |

| +--- Adult

| | Adult Chat.url

| | Amateur Photo.url

| | Asian Sex.url

| | Ebony.url

| | Fetish.url

| | Gay and Lesbian.url

| | Hardcore.url

| | Live Video Feeds.url

| | Matchmaking.url

| | XXX Cartoons.url

| |

| +--- Business and Finance

| | B to B.url

| | Banking.url

| | Business.url

| | Careers.url

| | Credit Cards.url

| | Finance.url

| | Insurance.url

| | Office.url

| | Printing.url

| |

| +--- Computers and Tech

| | | Computer Games.url

| | | Computer Stores.url

| | | Dedicated Server.url

| | | Domain Names.url

| | | Hardware.url

| | | Laptops.url

| | | Software.url

| | | Web Design.url

| | | Web Hosting.url

| | |

| | \---Telecommunication

| | Mobile Phones.url

| | Telecommunication.url

| | Telephone.url

| | Text SMS Messaging.url

| |

| +--- Cool Stuff

| | Auction.url

| | Classifieds.url

| | Free Emails.url

| | Free Homepages.url

| | Free Services.url

| | School Essays and Homework.url

| | Services.url

| |

| +--- Entertainment

| | Adult Entertainment.url

| | Automotive.url

| | DVD.url

| | Entertainment.url

| | Hot Games and Gaming.url

| | Mp3.url

| | Travel.url

| |

| +--- Gambling

| | Black Jack.url

| | Chips.url

| | Craps.url

| | Multi Player.url

| | Online Casinos.url

| | Poker.url

| | Roulette.url

| | Slots.url

| | Sports Books.url

| |

| +--- On Lifestyle

| | | Art.url

| | | Astrology.url

| | | Books.url

| | | Community.url

| | | eBooks.url

| | | Kids.url

| | | Magazines.url

| | | Matchmaking.url

| | | Pets.url

| | | Self Help.url

| | | Wine.url

| | | Women.url

| | |

| | +---Education

| | | Education.url

| | | Training.url

| | |

| | +---Health and Beauty

| | | Beauty.url

| | | Health and Fitness.url

| | | Pharmacy.url

| | |

| | \---Home and Garden

| | Construction.url

| | Furniture.url

| | Home and Garden.url

| | Real Estate.url

| | Utilities.url

| |

| \--- Shopping and Gifts

| Accessories.url

| Apparel.url

| Cards.url

| Electronics.url

| Flowers.url

| Gifts.url

| Jewlery.url

| Retail Products.url

| Shoes.url

| Shopping.url

| Toys.url

|

+---Program Files

| \---Messenger Plus! 2

| | MsgPlus.exe

| | MsgPlusH.dll

| | Readme.txt

| | Setup.dat

| | SponsorSetup.exe

| |

| \---Resources

| DefaultLg.dat

| Lang_Albanian.ini

| Lang_Arabic.ini

| Lang_Bahasa Malaysia.ini

| Lang_Bosnian (SCB).ini

| Lang_Brazilian.ini

| Lang_Bulgarian.ini

| Lang_Chinese Simplified.ini

| Lang_Chinese Traditional.ini

| Lang_Danish.ini

| Lang_Deutsch.ini

| Lang_Espanol (Espana).ini

| Lang_Espanol (Latino).ini

| Lang_Estonian.ini

| Lang_Euskara.ini

| Lang_Finnish (Suomeksi).ini

| Lang_Francais.ini

| Lang_Greek.ini

| Lang_Hebrew (Ivrit).ini

| Lang_Islenska.ini

| Lang_Italiano.ini

| Lang_Japanese.ini

| Lang_Korean.ini

| Lang_Lietuviu.ini

| Lang_Nederlands.ini

| Lang_Norsk (Bokmal).ini

| Lang_Portugues.ini

| Lang_Russian.ini

| Lang_Serbian (SCB).ini

| Lang_Svenska.ini

| Lang_Thai.ini

| MsgPlusRes.dll

|

\---WINNT

| agoeavooll.gif

| lgoeavooll.gif

| mgoeavooll.gif

| oeavoollkl.htm

| vgoeavooll.gif

|

\---system32

\---wbem

\---Logs

wbemcore.log

**rstryker** · June 13, 2003

HOLY ^%$^$&%

**Flash** · June 13, 2003

Well that p***ed me off, some complex s*** in that install...

I un-installed MSN +, registry still gonna be affected i take it...?

**XPerties** · June 13, 2003

Well that p***ed me off, some complex s*** in that install...
I un-installed MSN +, registry still gonna be affected i take it...?

yep. The best way I have seem to get all that crap out was to do what nekkid posted. Both of these apps have to be used. using only one will not work. First use this uninstaller: http://lop.com/new_uninstall.exe

Then both these apps:

http://www.MSFN.org/board/index.php?act=ST&f=19&t=6631

**Doggie** · June 14, 2003

yeah because hes got spyware adware etc..

bad way of ruining good software

**Tinker** · June 14, 2003

Well I decided to use the new_uninstall.exe and remove MsgPlus 2, when I clicked on new_uninstall I got a warning pop up about copy right laws. Then there was a window wanting to confirm something, not for sure what because it did not say. I clicked no and then I got a window saying it was going to change back my DNS, etc., etc.

Is the un_installer safe?

Also is the first version of Msg Plus safe to use? I have a copy of it if it is.

**Aaron** · June 14, 2003

yes, its safe to use, as long as you install it carefully instead of clicking on Next in a rash! In one of the setup screens you can uncheck a box to install the Lop.com software

Sign In

MSN Plus! - This is what happens when you install

Recommended Posts

XPerties

Link to comment

Share on other sites

rstryker

Link to comment

Share on other sites

Flash

Link to comment

Share on other sites

XPerties

Link to comment

Share on other sites

Doggie

Link to comment

Share on other sites

Tinker

Link to comment

Share on other sites

Aaron

Link to comment

Share on other sites

Create an account or sign in to comment

Create an account

Sign in

Recently Browsing 0 members

Activity

Browse