Comments on websites
Regtidy 2009
Fri 24 Jul 2009 01:50:53 AM UTC — shazzaFraudulent Security Program site claims
"Boost PC and internet speeds up to 300% "
regtidy.com
Fraudulent Security Program site claims
"Boost PC and internet speeds up to 300% "
regtidy.com
links please
Tue 28 Jul 2009 02:46:51 AM UTC — Nigel-Lew.... make that 2 vendors as Trend Micro are also flagging regtidy.com as "Virus_Accomplice; Disease_Vector"
/edit
Make that 3 as I've just been informed by a friend that Avira are now also detecting RegTidy as "DR/FakeAlert.SK"
Seems some of the vendors agree with me ......
how are you running said query, this morning virustotal was the mutts nuts. Now its something else. Feel free to send me internal and or compulsory evidence and quit sending me links to third party crap.
What does that stuff even mean? nothing..."Virus_Accomplice; Disease_Vector" WTF. I am sorry but that means jack shit....
the app does not does not do weird shit, period. You don't have to give me the benefit of the doubt, take the evidence and the key and do the right thing I will forward you three days of a non stop diatribe explaining this sort of thing to them and watching them fix it.
Nigel
....
Tue 28 Jul 2009 03:02:04 AM UTC — MysteryFCMFor Trend Micro, pop regtidy.com into the form at;
http://reclassify.url.trendmicro.com
... it will show you the current classification.
For Malwarebytes, either go to the malwarebytes.org URL I posted, or download MBAM and run it against RegTidy yourself.
As for Avira, I do not have permission to post the source that alerted me to Avira's detecting it, so am not going to post that, the report was sent to me from someone I trust, and thus, you're welcome to test Avira against it yourself, the report I was given indicates detection for it will be added in the next update;
"The file 'RegTidy_Setup.exe' has been determined to be 'MALWARE'. Our analysts named the threat DR/FakeAlert.SK. The term "DR/" denotes a program that is able to place a virus or a malware discretely on a system.Detection will be added to our virus definition file (VDF) with one of the next updates"
I am rather curious, what marketing course did you do that led to your deciding profanity was a good way of promoting a product? I've posted my findings, nothing more, surely that does not justify resorting to such levels?
If you want to forward me a key and your "diatribe", then feel free. I can be reached at;
services @ it-mate DOT co DOT uk
Regards
Steven Burn
Ur I.T. Mate Group / hpHosts
it-mate.co.uk / hosts-file.net
"Virus_Accomplice; Disease_Vector"
Wed 29 Jul 2009 10:50:22 AM UTC — phantazmNigel-Lew: What does that stuff even mean? nothing..."Virus_Accomplice; Disease_Vector" WTF. I am sorry but that means jack shit....
It means that Regtidy is classified similar to Regcure - another rogue.
Copyright © 2005-2009 RegTidy.com
Tue 28 Jul 2009 07:16:52 AM UTC — g7wCopyright © 2005-2009 RegTidy.com
whois clearly reveals: regtidy.com Created: 2009-07-07
Current Version: 3.5.0.100
Release Date: Sunday, 28 June 2009
(MD5: 7d906294cde39addce7cf01a7064c9d3)
Customer Testimonials
Ricky New York
John Fredrickson
et. blah, blah
Really? 150 countries already?
I thought you posted previously that this app has been in the wild for like a week now, how could the download count and country location possibly be accurate and factual information? Sure you aren't trying to mislead prospective customers? Online, we call that "scam"
And surely you can think of better names for people than Crystal Australia
No retort about "name / location" either. If it were "name" - "location" for one, it would be that way for all, it's uniformity and proper labels would be applied to identify as such.
You?
Your Hacker Safe image...
It still uses registryConvoy's name, you should at least change from:
regtidy.com/images/registryconvoy_banner_award.gifto:
regtidy.com/images/regtidy_banner_award.gifOne little thing HackerSafe doesn't exist anymore (view my Trust Seal Poll post), the CEO (Brett M. Oliphant - indicted in December 2007 for fraud) was sued and McAfee bought Scan Alert, since 2007 it's now called: McAfee Secure
music?
Plagiarism is one thing; you know go to one site, find some good "terms of use / license agreements" and copy it elsewhere, but you really need to read what you cut-n-paste, why would a registry cleaner's license discuss music?
It's safe to say that all of the website information: the look, the description(s), etc is a direct product of jnlew.com - this IS what you do right? Based on this site's design, misleading self-representation, promotion of rogue scanner software if I were to rate your website today, it's wouldn't be too high. And I surely would make reference to this thread as a prime example within my comment.
Major AV companies will detect this as Malware based upon it's being Rogue
Avira already has; others will follow (they usually do).
Not too bad for a peanut huh?
Some questions
Tue 28 Jul 2009 03:10:21 PM UTC — BobJam"My point is that its not malware or a virus, contrary to popular opinion."
At the risk of prolonging an acrimonious thread, you may be misunderstanding something here, Nigel. The objection the community has (myself included) is not that regtidy contains a virus . . . I can't say whether it does or does not because I haven't loaded it myself, though it may indeed serve as a vector for one . . . but rather it is a scam attempting to pry cold hard cash from the hands of noobs . . . IOW, a rogue and thus malware.
Relative to the term "malware" . . . there is a technical definition and a "common usage" definition. Very often the two are different.
While sticklers may insist that the technical definition is the "right" one, "malware" in common usage is generally taken to be ANY malicious code, which could be anything from spyware code designed to extract personal information or to defeat encrypted messaging, CODE IN APPS THAT WILL DISPLAY DUBIOUS SCAN RESULTS THAT WILL SCARE A NOOB INTO PURCHASING THE APP, (ie. rogue registry scanners), all the way to virus code designed to destroy data on your machine.
When you say "malware", that is what most people think off, with the exception of technorati that adhere to technical definitions, and who sometimes are quick to point out that you are "wrong" to think otherwise. Of course, they are correct insofar as technical definitions are concerned, but in the case of "malware" that technical definition does not portray what the common usage is.
And I think the community is using this broader definition of malware when it maintains that regtidy is malware.
Trying to be fair ("You folks need to learn how to play fair"), though I agree with all the community has said, I think the disconnect may be rooted in the term "malware". Applying that broad definition, I certainly believe regtidy is malware.
I take it however that you're claiming the scan results are not spurious or designed to frighten a noob into purchasing the retail version of regtidy?
Perhaps if you would answer a few questions directly that might clarify the discussion. Some of the answers may be obvious to you, but I suspect a precise answer may help the community understand your point of view better.
The claim that regtidy results in "Internet speeds up to 300%" . . . is that just marketing hype or is there evidence for this? If so, could you expand?
g7w said: "The Prevx link doesn't state "safe" merely Currently being reviewed there is a difference; and whether or not the file name is all CAPS or HungarianProper is mute - they are the same file." Can you respond to this? Specifically, would you agree that the Prevx link says what g7w said it says? Would you agree that there's a difference between stating "safe" and "currently being reviewed"? Are you saying "REGTIDY.DLL" (all caps) is a different file than "regtidy.dll" (lower case)?
"I have scanned this stuff repeatedly with a wide range of things". Can you be more specific? What are some examples of that "wide range of things"?
"folks that don't know how to sandbox an app or run a VM". Can you be more specific? Were you referring to the entire WOT community, or someone specific in the community, or to a group outside the community?
You used the phrase "dodgy app" more than once. "Dodgy" is pretty vague. Can you be more specific? Please give an example of what you would consider a "dodgy app".
"a few odd behaviors" . . . I think you were referring to regtidy there. What were those "odd behaviors"?
Someone asked this question: "And, give us one reason why regtidy 2009 or registry convoy is not rogue" . . . can you answer that directly, explaining your reason clearly? (Without profanity, please)
In my experience, a "PR" person makes an effort to convey a pleasant viewpoint. As Steve pointed out, the use of profanity hardly conveys anything like that. Is his, and my, concept of "PR" incorrect? Some of your comments certainly don't portray any effort to tone down the conflict.
"until I kindly attempted to point out" was "Please learn how to read before you go futzing with someones brand and or reputation". Is that how a "PR" person BEGINS a conversation?
"peanut gallery" . . . referring to the community that way does not seem to be the method of someone who wants to resolve a conflict . . . rather it elevates the conflict. Is that the goal of a "PR" person?
"learn how to read" . . . again, a "PR" approach? Clearly, I'm being sarcastic here, but my point is that if you want to have a productive discussion, I don't think saying things like that enhances your viewpoint. OTOH, if you just want to rant, that about does it.
So which is it . . . do you want to have a productive discussion or not?
"I would like to start seeing some redactions in this thread" . . . asking for apologies from the community is premature. If you answer the questions I posed, then the community may be better equipped to rethink (or not) their judgement . . . and I'll reiterate . . . a judgement I fully agree with at this point.
TIA
Classification issues
Tue 28 Jul 2009 10:22:40 PM UTC — TonorI can't say whether it does or does not because I haven't loaded it myself, though it may indeed serve as a vector for one . . . but rather it is a scam attempting to pry cold hard cash from the hands of noobs . . . IOW, a rogue and thus malware.
Many rogue programs don't get listed as such by some AVs; this is a classification problem I have come across when submitting to AV vendors for analysis. A few times I have had responses that the file doesn't contain malicious code; this is true of a recent case discussed here involving adware-2009.com. Invariably, the virus analysts are often right, but it's the nature of the beast that needs to be classified. Some anti-malware programs are better at it than others.
Agree
Wed 29 Jul 2009 10:37:19 AM UTC — phantazmMaybe "the file doesn't contain malicious code".
But if the site has malicious intentions,
it is still malware, imo.
Virus is always malware, but not all malware is a virus...
MBAM
Wed 29 Jul 2009 01:29:47 AM UTC — g7wI'm curious at to MBAM's classification, if any, has anyone discussed this at their forum?
-------
Against Intuition - gives us safety through Web of Trust.
WOT Community - gives us security through unity.
Thank you all
- G7W
Intentions
Wed 29 Jul 2009 11:56:05 AM UTC — BobJamAs phantazm said, it's intentions that need to be classified. And I can't imagine any detection system that would detect . . . intentions. Malicious code, yes . . . intentions, I doubt.
So, other than listing these things in a "rogues gallery" (which requires the judgement of the site that's listing it as such), I don't see how they could be detected or classified based on any detection method.
There are blogs which classify these things (Dancho, Colin, Frank, and evilfantasy come to mind), but I don't see how any antivirus/spyware program could detect these things if they don't contain any malicious code but rather have malicious intent.
Perhaps there should be a "Malicious Content ONLY" in the WOT scorecard comments.
I see that regtidy.com is red, but there are a lot of comments with the "Malicious content, viruses" category and that may be misleading if it's intent only. There is a comma in there, which likely indicates "OR", but I'm not so sure noobs would notice that nuance. An "AND/OR" or an "ONLY" may be more clear. Or I guess a "Malicious Intent" would even be more clear. Gezzzz . . . there are a gazillion iterations that might be used.
But I can't imagine MBAM or SuperAntispyware could detect intent, unless you consider redirects or javascript as signs of malicious intent. And in that case, I would think there would be a lot of FP's.
(In regtidy's case, there is apparently some kind of malicious code detected because several programs are detecting it, so in that case I guess it would be interesting to see how MBAM classifies it . . . if it detects it).
Some AMs detect rogue 'intentions'
Wed 29 Jul 2009 01:14:55 PM UTC — Tonor» I can't imagine any detection system that would detect . . . intentions. Malicious code, yes . . . intentions, I doubt.
Some anti-malware programs do detect these kind of programs as rogues or frauds; Prevx is one of them using the Fraudulent Security Program category, and Kaspersky has a category called not-a-virus:FraudTool. Of course, there are times where malware and fraud cross each other. Obviously, in the former case, it just means more analysis is needed by the respective vendors.
» (In regtidy's case, there is apparently some kind of malicious code detected because several programs are detecting it, so in that case I guess it would be interesting to see how MBAM classifies it . . . if it detects it).
I don't think there is actually any malicious code in regtidy; it's the fact the program gives misleading and erroneous results after each scan, which they expect a user to pay to apparently fix these so-called problems. It is possible there are legitimate bugs in the software, but so many other fraudulent programs exhibit the same traits as evidenced here and elsewhere that it's hardly surprising some of us have pounced on this.
I thought the MBAM classification was simply Rogue.RegTidy.
Detection how?
Thu 30 Jul 2009 09:10:54 AM UTC — BobJam"Some anti-malware programs do detect these kind of programs"
So how is the detection made . . . code, title from a list . . . what? (Please don't take my tone as abrasive . . . am just genuinely curious).
Analysis by running the application
Thu 30 Jul 2009 10:30:37 AM UTC — TonorI would expect this is done by running the program on a clean fresh OS install and seeing what it actually does, or within a VM. This is what I mean by extra analysis. Yes, more work, but that's the only way with these sort of applications that look authentic and don't appear to contain any malicious code per se using normal detection routines.
I am guessing by the way, so don't take my word as gospel.
I know that when I spoke to Prevx they had tested it on a clean fresh XP SP3 install.
....
Thu 30 Jul 2009 11:44:29 AM UTC — MysteryFCMThat's how we test them over at Malwarebytes too ;o)
Regards
Steven Burn
Ur I.T. Mate Group / hpHosts
it-mate.co.uk / hosts-file.net
hidden surprises
Thu 30 Jul 2009 11:56:38 AM UTC — g7wI suspect that installing and running the applicatin is the only way one could verify that though the program [code] is "clean" itself, this is how those that download backdoor Trojans and other malware are sniffed out. The malware does not have to be present on initial install, but can be a "hidden surprise" - they're telling you that they are fetching a fresh definition file, but are they really?
-------
Against Intuition - gives us safety through Web of Trust.
WOT Community - gives us security through unity.
Thank you all
- G7W
Code versus intentions
Wed 29 Jul 2009 03:40:51 PM UTC — phantazmBobJam: "So, other than listing these things in a "rogues gallery" (which requires the judgement of the site that's listing it as such), I don't see how they could be detected or classified based on any detection method."
Malicious intentions should be covered already: "Fraud, scam, phishing"
re: intention
Wed 29 Jul 2009 06:10:16 PM UTC — g7wintention is something that can easily change, "I've changed my mind" changes the end result, thus changes the outcome and the intention
These rogues are not classified by intention, they're classified as deceptive.and are generally referred to as scareware
A well known example, a rogue AV Scanner reports
To remove these harmfule files - you MUST PURCHASE NOW
Now let's do the same thing with another scanner, a registry cleaner
To fix these arrors and optimize your Registry - you MUST PURCHASE NOW
What's the difference with the two example scanner results?
Nothing - they both report false positives and use scare tactics and thus are considered Rogue, not to mention Untrustworthy. Would you feel comfortable with these people having access to your credit card information?
25410202...... RegTidy_Setup.exe.......1.13 MB.......MALWARE
25412617....... pad_file.xml .................. 5.68 KB.......CLEAN
The file 'RegTidy_Setup.exe' has been determined to be 'MALWARE'. Our analysts named the threat DR/FakeAlert.SK. The term "DR/" denotes a program that is able to place a virus or a malware discretely on a system.Detection will be added to our virus definition file (VDF) with one of the next updates.
-------
Against Intuition - gives us safety through Web of Trust.
WOT Community - gives us security through unity.
Thank you all
- G7W
Where's Nigel?
Fri 07 Aug 2009 05:13:36 AM UTC — g7wIt seems we've lost Nigel; he's "given up."
I see he's been busy with regtidy.com
Many screen shots and even has a editor recommended logo and link:
hxxp://www.brothersoft.com/regtidy-2009-263503.html
Too bad, I'm contemplating about rating Mr. Lew's site red for complying (designing/branding) with known Rouge software authors / domains.
Opinions?
-------
Against Intuition - gives us safety through Web of Trust.
WOT Community - gives us security through unity.
Thank you all
- G7W
.....
Fri 07 Aug 2009 05:37:29 AM UTC — MysteryFCMI blacklisted Brothersoft a while ago .....
Regards
Steven Burn
Ur I.T. Mate Group / hpHosts
it-mate.co.uk / hosts-file.net
Stretch?
Fri 07 Aug 2009 03:55:21 PM UTC — BobJam"I'm contemplating about rating Mr. Lew's site red for complying (designing/branding) with known Rouge software authors / domains."
While I certainly agree that Nigel appears to be "missing in action" here, and is likely "aiding the enemy", and as such probably deserves a red rating, I'm not so sure the connection warrants rating his site red.
If aiding the enemy was cause for a red rating, then we'd open up a can of worms relative to a lot of mindless marketers.
And, yes, I agree that marketers should be held responsible for their actions, but how far do we go on that?
BTW, did you mean "consorting" instead of "complying"? Pretty much the same thing anyway, but was just curious.
consorting vs. complying
Fri 07 Aug 2009 04:45:22 PM UTC — g7wSince Nigel is reconstructing the site/product to the specifications of the rougue software owner(s) - I'd say that is complying. :-)
Mr. Lew is complying to their demands in exchange for money.
Just as bad as a download site offering the product.
If the download site gets rated red for offering it, why shouldn't a design site get rated red for creating it's web presence?
-------
Against Intuition - gives us safety through Web of Trust.
WOT Community - gives us security through unity.
Thank you all
- G7W
Still not sure, but . . .
Fri 07 Aug 2009 05:00:15 PM UTC — BobJamThat's the good thing about WOT. Each rater can make a judgment call. And you're a very reliable rater, so I suspect others may agree.
Nevertheless, I'm still not sure about this myself. Good argument though.
(BTW, check your profile . . . I sent you a PM)
rating
Fri 07 Aug 2009 05:32:07 PM UTC — g7wI have no intentions on rating Nigel's website; there's no index page, so there's no site to rate. What's "hidden" may very well be outdated stuff he keps online for self usage, I don't know.
The point was If I were to...
I hope people rate sites based upon their experiences and not based on mine, unless it's a call for help such as "Malware - please rate red"
-------
Against Intuition - gives us safety through Web of Trust.
WOT Community - gives us security through unity.
Thank you all
- G7W
Yes, but . . .
Sat 08 Aug 2009 08:09:41 AM UTC — BobJam"I hope people rate sites based upon their experiences and not based on mine"
While most of us do indeed rate sites based upon our own experiences, you have established quite a reputation for skillful digging, plus you're at the top of the heap. So unavoidably, your opinion may bias some, especially noobs . . . maybe unconsciously, nevertheless it is a burden of being so good at investigating.
I'll reiterate . . . the experienced raters here certainly evaluate based on their own experiences.
"It's lonely at the top"
I, A,M, T,H,E,
Sat 08 Aug 2009 07:43:17 PM UTC — ErorGen886I, A,M, T,H,E, L,U,C,O,Z,A,D,E, G,U,Y,
biggest converstion ever lol i wnna get in (unnessacery stuff dont go ruddy posting crap on my board)
Minor update
Fri 04 Sep 2009 12:28:37 AM UTC — Nigel-LewI put the coder of this stuff in touch with a range of vendors I had been speaking with directly to sort the odd behavior issues. Most of them were pretty friendly and were willing to help out.. .some, not so much.
They ultimately refused to fix it so I cut them loose and reported a few things about it to paypal while I was at it. It would appear that is shut down now as well ;)
I meant to get back here pretty quickly once I started hazing folks on their end but have been too swamped.
For what its worth, I submit you folks were accurate about that stuff. Note that they literally pleading with me suggesting that they had no ill will about their application. There lack of willingness to actually address it clearly indicates otherwise. I made it very easy for them to rectify the situation. They were however quite adamant about the fact that they were not crooks. Usually when I pick up on weirdness they just disappear. No one has ever tried to argue the fact with me.
@g7w yes that is accurate. I am in the middle of re-branding the business into several but have a range of fairly important work going on right now. I frankly have not even had time to think about it. I can no longer simply slap a new logo on it. Its really old. I plan on keeping some urls so its beneficial to simply keep stuff hidden there.
As you can imagine, I was having a long week. I am sorry I flew off the handle. I am a reasonably minded individual. I have been at this sort of thing for many years without issue.
N.
Happy ending?
Fri 04 Sep 2009 12:44:27 AM UTC — BobJamLooks like this lengthy struggle may have had a happy ending.
"For what its worth, I submit you folks were accurate about that stuff"
A gracious bow out. My compliments.
I offer
Thu 08 Oct 2009 12:35:46 PM UTC — LiVeRpUdLiAn932I offer my compliments too,
a courageous apology.
1 thing, remove your green comment on regtidy.com..
You'll Never Walk Alone
RegTidy Statement
Tue 03 Nov 2009 07:19:22 PM UTC — RegTidyI'm the staff at RegTidy. Our tool is NOT scareware or malware.
I am not good at English which make us weak to proof our tool. Anyway, if even we do something wrong, it is not on-purpose.
Please tell me, we be HAPPY to correct our tool to contribute the web.
We absolutely oppose malware. It extremely harm respect and long run business.
Please be fair.
--------------------------------------------------------------------------------
As for Nigel-Lew, it is nightmare to cooperate with him.
He contact me actively when he know my tool and
He said he usually be paid $2000 per month to market, but like to do same for me for $500 even for a few of months and do article writting, blog comment, pitch, submit and everything help to market.
After weeks persuade, finaly I paid him, but nightmare start then.
What he did is make some posts here or there, make some calls to anti-maleware company to correct the judgement.
More important is he ALMOST ALWAYS break his promise.
For example:
Contract should be sign before money paid usually. but he said he must pay landlord that day, so i hurry up to pay him. and he promise give me contract and his plan to market in one day.
but he DIDN'T. and i request those again and again. he keep said will be READY SOON. but I NEVER got it.
Such think happen to articles writing, proofreading and other thing he promise do for me.
Finally what make me to decide to ban him on msn as below:
I want him to proofreading my web page writing, he promise again will be done in 1-2 days, but like before, he DIDN'T. and I ask again, and he answer will done soon.
such repeat 2-3 times, i decide ignore him, but few of days he ask me ftp password to proofeading my page, and i already told him 2-3 times(not sure exactly). he even not remember password, how can he promise to correct and upload webpage?
Finally I "understand" this is what is his sincerity for his job.
$500 loss is not much, I lost more precious thing like time and passion to market the tool.
Sorry again for not accurate English, hope you understand.
so
Fri 06 Nov 2009 01:34:29 AM UTC — jpvipRegTidy wrote:
Anyway, if even we do something wrong, it is not on-purpose.
So, let me get this straight, if a person writes a virus just to play around and it gets in to the hands of the wrong person - then the person who wrote it is not at fault?
Accountability is a powerful term, and should be followed. In the security community, we do not point out everything we see. The product deemed malware is considered from a strong opinion from the community - which means you will need a better statement than that and some proof that can back it up.
~DragonMaster Jay, malware researcher,
Admin, helpmyos.com
don't feed trolls
Fri 06 Nov 2009 03:05:17 AM UTC — g7wuntil they learn how to count...
-------
WOT Services Ltd. - gives us safety through Web of Trust.
WOT Community - gives us security through unity.
Thank you all
- G7W