Messenger Plus! bundler software program contains optional adware (Spyware_PH_MessengerPlus)

About this signature or vulnerability

Proventia Network MFS, IBM Security Server Protection for Windows, Proventia Desktop, Proventia Network IDS, Proventia-G 1.1 and earlier, BlackICE Agent for Server, BlackICE PC Protection, BlackICE Server Protection, RealSecure Network, RealSecure Server Sensor, RealSecure Desktop, RealSecure Desktop Protector 3.6, Proventia Network IPS, Proventia Server IPS for Linux technology, Virtual Server Protection for Vmware:

This signature looks for MessengerPlus spyware making a phone home type request after it has been installed.

Proventia Network MFS, IBM Security Server Protection for Windows, Proventia Desktop, Proventia Network IDS, Proventia-G 1.1 and earlier, RealSecure Network, RealSecure Server Sensor, Proventia Network IPS, Proventia Server IPS for Linux technology, Virtual Server Protection for Vmware: The signature works correctly, but the traffic may be considered legitimate in some customer environments.

Default risk level

 Medium

Sensors that have this signature

Proventia Network MFS: XPU 1.42, IBM Security Server Protection for Windows: 1.0.914.0, IBM Security Server Protection for Windows: 2.1.14.2400, Proventia Desktop: 8.0.614.1, Proventia Network IDS: XPU 24.3, Proventia-G 1.1 and earlier: XPU 24.3, BlackICE Agent for Server: 3.6eof, BlackICE PC Protection: 3.6cpa, BlackICE Server Protection: 3.6.cpa, RealSecure Network: XPU 24.3, RealSecure Server Sensor: XPU 24.3, RealSecure Desktop: eob, RealSecure Desktop Protector 3.6: eob, Proventia Network IPS: XPU 1.42, Proventia Server IPS for Linux technology: 1.0, Virtual Server Protection for Vmware: 1.0

Systems affected

Microsoft Windows 95, Microsoft Windows NT: 4.0, Microsoft Windows 98, Microsoft Windows 98SE, Microsoft Windows 2000, Microsoft Windows Me, Microsoft Windows XP

Type

Unauthorized Access Attempt

Vulnerability description

How to remove this vulnerability

References