MyPhoneExplorer infected with malware / adware

Anmeldedatum: 23.02.2013 Beiträge: 12

The latest versions of MyPhoneExplorer seem to be infected with unwelcome installers. My guess is that the servers have been hacked.

When you install MyPhoneExplorer you will also get a full, unwelcome and unauthorized auto install of StrongVault and a "Football News" app.

This is NOT an isolated incident - if you Google "strongvault myphoneexplorer" you will see that MANY users who have downloaded the recent versions have been effected. Complaints from many are that they cannot remove Strongvault, without additional third-party app assistance, and that there are questions from Norton regarding the true nature of this program.

PLEASE look into this situation!

Anmeldedatum: 09.06.2011 Beiträge: 143

These are OPTIONAL installers, you can decline to install them if you want.

How else are the programmers to feed themselves, since this awesome software is FREE?

Anmeldedatum: 23.02.2013 Beiträge: 12

If you Google as I suggested, you will find that they are NOT optional. The third-party packages install fully automatic without permission.

Which is exactly what happened to me.

It is interesting to note, however, that the packages did not install, nor even prompt for installation, under WinXP. I just bought a new laptop with Win7 (grabbing one before Win8 is my only option) and *two* different installs of MyPhoneExplorer gave me both StrongVault and Football News. I used installers downloaded from November and yesterday, 23 February, and both infected me with the two very unwelcome, very uninvited programs.

VERY NOT APPRECIATED.

If they were truly optional, I would not have a complaint. Many installers have third-party optional installs and I have no issue with saying "No thank you". But these installs happen automatically in the background with no consent and no opt-out, at least in Win7, and that is VERY unwelcome.

Unless solved, I may have to have McAfee / Norton / Kaspersky et al review the MyPhoneExplorer install package to list as a malware conduit.

Anmeldedatum: 09.06.2011 Beiträge: 143

Oops, my mistake. I must be seeing things.

Or maybe you should just pay more attention to what you're doing?

Anmeldedatum: 23.02.2013 Beiträge: 12

TheLandYacht hat Folgendes geschrieben:

Oops, my mistake. I must be seeing things.

Or maybe you should just pay more attention to what you're doing?

Would you like me to make a video to PROVE that this is not what you see when you install the version of the app that [most] people download? Do you really believe interface boxes that large would be easy to ignore?

If you bothered to actually read all the details of my post, you will see that I, and many others, do NOT get the software options that you pointed out. I did not, nor never did I get, an option for a "Babylon Search". Never heard of it nor was this installed on my computer.

What many of us got was a self-install for STRONGVAULT and FOOTBALL NEWS. And it didn't just happen once, it happened TWICE - I uninstalled the app I freshly downloaded from the website and installed an alternative version that I downloaded in November. Same result - self-install of StrongVault and Football News.

Why don't you do what I told you to do - a Google search to PROVE that some of us are NOT getting any install selection boxes for StrongVault, or Football News, and that the install of these apps is happening completely automatically in the background! For example:

http://answers.microsoft.com/en-us/windows/forum/windows_other-windows_programs/what-program-is-strong-vault-connected-to/f9cfb0e2-af3b-46ca-80a4-470c8d36f8fc?page=15&msgId=dae20c09-09d7-49f7-9804-69fafb71007c

If you like, I'll forward you the TWO copies of MyPhoneExplorer installer executable that I have and you can install them on your personal system yourself. And promptly get two programs auto-installed that you didn't ask for. Again, if you Google "Strongvault" it seems to be a virus-type installer that is unwelcome by both the developer as well as the users. With luck, the developer of MyPhoneExplorer did not purposely add this program and the MPE installer was infected via some type of conduit; this issue can hopefully be resolved with an inspection of the installer.

Interestingly if you run the MyPhoneExplorer installer with your network disconnected...StrongVault and Football News do not get installed, so the installer is downloading the program live during the setup process.

The type of third-party installers that you note in your screengrabs, as I noted before, I have no problem with as it is all above board and quite clear as to the motives and opt-in and opt-out options. But StrongVault and Football News offered no warnings, no opt-outs, no explanations and is highly suspicious.

Anmeldedatum: 09.06.2011 Beiträge: 143

So. Google results simply using two search words "strongvault" & "myphoneexplorer". A grand total of 15 results. Of those, 8 aren't in english, so I don't know what they're about. Of the others, all but one seem to be exact quotes of a single post about strongvault...or quotes of your own post. I assume this not because it has the same information...but because it has the same sentence structure...and the same words, in the same order...on each quote.

As to "your" installer...when I want an installer, I go directly to the software vendor. In this case, FJ Software. I've got every installer going back nearly 2 years (each received from FJ, in a couple of cases directly from him as beta bugfixes and feature requests). But I went ahead & downloaded a fresh copy of 1.8.4 anyway. Installed, I see none of the problems you suggest.

Having used this program (several versions over the last couple of years) on multiple machines, I've seen none of the malware you suggest.

I'm not calling you a liar, obviously this happened to you otherwise you wouldn't be ranting about it...but it appears that perhaps something weird is going on in YOUR case...and according to google, perhaps to one other person on the planet.

Rather than assume that the software is suspect from the result of one user's experience, I have to assume that either your system was already hijacked...or the installer you got was not from FJ and had been altered.

Anmeldedatum: 19.11.2010 Beiträge: 788 Wohnort: Sunny Cornwall ...

To the OP - can you give us the link you used to download this software? As, like TLY, I have been using MPE for more than 2 years, have installed every version plus many other 'nightly builds' and have never seen this issue.

Anmeldedatum: 23.02.2013 Beiträge: 12

TheLandYacht hat Folgendes geschrieben:

So. Google results simply using two search words "strongvault" & "myphoneexplorer". A grand total of 15 results. Of those, 8 aren't in english, so I don't know what they're about. Of the others, all but one seem to be exact quotes of a single post about strongvault...or quotes of your own post. I assume this not because it has the same information...but because it has the same sentence structure...and the same words, in the same order...on each quote.

As to "your" installer...when I want an installer, I go directly to the software vendor. In this case, FJ Software. I've got every installer going back nearly 2 years (each received from FJ, in a couple of cases directly from him as beta bugfixes and feature requests). But I went ahead & downloaded a fresh copy of 1.8.4 anyway. Installed, I see none of the problems you suggest.

Having used this program (several versions over the last couple of years) on multiple machines, I've seen none of the malware you suggest.

I'm not calling you a liar, obviously this happened to you otherwise you wouldn't be ranting about it...but it appears that perhaps something weird is going on in YOUR case...and according to google, perhaps to one other person on the planet.

Rather than assume that the software is suspect from the result of one user's experience, I have to assume that either your system was already hijacked...or the installer you got was not from FJ and had been altered.

Thank you for your reply.

The reason I am on this forum is that I got the installer HERE. Off FJ Software direct. Like you, I go direct to the source.

On Windows XP the installer does nothing except install MPE, however on my fresh Windows 7 Professional install, MPE installed StrongVault and Football News - twice. Installed MPE, got install of StrongVault and Football News as well. Uninstalled StrongVault, uninstalled Football News, ran AV tests, uninstalled MPE. Reinstalled MPE using second installer download...got StrongVault and Football News, again.

So it can't be an accident, it is somehow intentional (not saying intentional by the developer, but by someone).

I would love someone running Win7 Pro, with anti-virus not yet installed, to try the installer themselves to get a third-party report. I would be most happy to forward the [TWO] versions of the installer than I have downloaded from here for independent examination. I should personally consider filming live video of the installation and posting it on YouTube just to show that this is all true and I am not crazy Laughing

Speaking seriously, many years ago I used to do system repairs, virus removals and data recovery services (hand-editing the FAT tables and sector structures Shocked

). For example, you will find my profile at tek-tips.com where, at the time, I was on the Top 10 Technicians list for the entire site. So I have some idea of what is going on behind the curtain here Laughing

Interestingly, I re-downloaded the installer today and it does NOT match the very first installer I download:

- first installer downloaded directly from FJ Software:
version 1.8.4
Size: 6.45 MB (6,765,832 bytes)
Created: Tuesday, ‎November ‎27, ‎2012, ‏‎7:45:09 PM

- second installer downloaded directly from FJ Software:
version 1.8.4
Size: 6.53 MB (6,856,985 bytes)
Created: Today, ‎March ‎03, ‎2013, ‏‎12 hours ago

Oh yes, BTW, malwarebyte and superantispyware both report no issues found, tested after I manually uninstalled StrongVault and Football News. StrongVault, as reported in the Microsoft thread, is quite sneaky and puts copies of itself into hidden directories based off the root, even after full uninstall. I delete the directories and edited the registry to remove remnant keys. No stray DLL's seem to be lingering around here.

I am almost tempted to wipe and reinstall Win7 Pro (as this is a fresh reinstall anyway), but then installing MPE yet again will simply cause the same situation in regards to security (although I figured out that killing internet access prior to running the installer causes no install of StrongVault and Football News). I would go into the system deeper but I've simply decided that digging that deeply into computers isn't worth much of my time as of late, I've become preoccupied with so many other things in my life now. I'm almost ready to do a program trace...if only it was truly worth my time. A wipe and reinstall (again) of Windows 7 (this is a new-to-me laptop) is frankly easier and probably a time-saver in comparison.

Anmeldedatum: 09.06.2011 Beiträge: 143

I've installed on 3 machines. 2 are XP, the other's W7. But I'll admit I'm using antivirus software & running AntiMalware & Spybot on a fairly frequent basis.

Anmeldedatum: 19.11.2010 Beiträge: 788 Wohnort: Sunny Cornwall ...

Please, don't just tell us where you got it, give us the exact link you used.

Thank you.

Anmeldedatum: 23.02.2013 Beiträge: 12

dvhttn hat Folgendes geschrieben:

Please, don't just tell us where you got it, give us the exact link you used.

Thank you.

http://www.fjsoft.at/download.php?id=1

Never from any place else.

Anmeldedatum: 23.02.2013 Beiträge: 12

TheLandYacht hat Folgendes geschrieben:

Rather than assume that the software is suspect from the result of one user's experience, I have to assume that either your system was already hijacked...or the installer you got was not from FJ and had been altered.

Err, no. If you bother to do more research than a quick overview, you will find that customers using the installer from the Google Play store have issued the exact same complaint - installation of malware in the background without user consent.

https://play.google.com/store/apps/details?id=com.fjsoft.myphoneexplorer.client&hl=en

Check out the 1 and 2-star review section.

See

http://www.androlib.com/android.application-comment.com-fjsoft-myphoneexplorer-client-jttAj.aspx

where StrongVault is specifically named as installed without consent:

"Be very careful! I have been quite happily using this software since the days of my HTC hero, never a problem. Recommended to a friend, installed desktop client on his laptop and Bam!... browser hijacker, malware, specifically strongvault[ (my emphasis). If you encounter such problems, a visit to Microsoft fixit recommended. Still gonna have to do a fresh windows install to be sure. Used to be great why o why?......"

"Because the PC app installed crapware that took days to remove Sad

"Take Care 1 star as the app is just what I needed BUT the pc client from the developers web site down loaded a virus - snap.do - onto my pc. Not saying this is the fault of the dev or it is deliberate. I am not the only one to suffer - Google search testifies to this. I would suggest care is taken when downloading and if anyone has a clean copy let me know"

Sound familiar?

Oh, yeah, BTW, "Babylon Search" has itself officially been classified as "adware" by Microsoft

https://www.microsoft.com/security/portal/definitions/whatsnew.aspx?version=1.87.1429.0&Release=Released&Package=AM

Read more here:

http://en.wikipedia.org/wiki/Babylon_%28software%29#Malware_issues

Anmeldedatum: 09.03.2013 Beiträge: 2

It happened to me too.
Manually deinstalled both StrongVault and football news. Football news still tries to launch on boot.

Anmeldedatum: 23.02.2013 Beiträge: 12

dinklemouse hat Folgendes geschrieben:

It happened to me too.
Manually deinstalled both StrongVault and football news. Football news still tries to launch on boot.

Make sure that the Football News directory is completely deleted from your Program Files / Program Files (x86) subdirectory, then use Regedit to delete the startup keys. Use the Search function in regedit to look for "Football".

Also, reset Window's window defaults to show all files including hidden and system files, then go into you C: drive's root directory and check for hidden directories. StrongVault DEFINITELY places hidden 'uninstaller' subdirectories at the root level and MUST be deleted otherwise the system is still "infected"

Anmeldedatum: 09.03.2013 Beiträge: 1

I just installed MyPhoneExplorer today, flawlessly, from the version 1.8.4 that I downloaded here. There were absolutely NO problems with it. No Malware, not even any attempts at loading any other types of software as TheLandYacht shows in his posts. I got it up and working perfectly with my Wifi, to sync with Outlook.

Went through my system and registry with a fine tooth comb and no trace of any Football News or StrongVault. Don't know what happened to you, dinklesnake, but I think you must have other things going on.

All I can say, is finding this program was a life saver for me, as I've been looking for two days to find something to sync my crippy crappy Samsung Droid Charge to my Outlook Calendar and this is the one that worked and works easily. Google pulled its support of their Calendar Sync utility and, since I have a new system, I couldn't reinstall it. Neither Samsung nor Verizon have anything that works to easily sync the phone to Outlook.

This little program is the best thing I've found to use to do the job since I had a Blackberry. Of course there are some kinks to work out in what gets synced how, but that's the case with all syncing programs. WILL DEFINITELY BE DONATING TO THE CAUSE! Kudos and Thank You, Development Team!!!

Informationen zum Datenschutz auf dieser Website