Comments on websites
Regtidy 2009
Fri Jul 24 01:50:53 2009 — shazzaFraudulent Security Program site claims
"Boost PC and internet speeds up to 300% "
regtidy.com
Fraudulent Security Program site claims
"Boost PC and internet speeds up to 300% "
regtidy.com
internet speeds up to 300%
Fri Jul 24 03:35:10 2009 — g7wExpires: 2010-07-07
Updated: 2009-07-09
Domain regtidy.com
Date Registered: 2009-7-7
Date Modified: 2009-7-9
Expiry Date: 2010-7-7
DNS1: ns-canada.topdns.com
DNS2: ns-usa.topdns.com
DNS3: ns-uk.topdns.com
Registrant
Private Whois Service
*******PLEASE DO NOT SEND LETTERS******
****Contact the owner by email only****
c/o regtidy.com
N4892 Nassau
Bahamas
Shared IP
-------
Against Intuition - gives us safety through Web of Trust.
WOT Community - gives us security through unity.
Thank you all
G7W
Regarding Regtidy
Fri Jul 24 19:24:00 2009 — Nigel-LewYou folks need to learn how to play fair. I am not even sure where to start so I will post the following:
I am sorry but you folks are not even in the balllpark of correct. For starters, there is no REGTIDY.DLL associated with this application. Its RegTidy.dll Secondlly, here is the response from prevx support:
Thank you, we have marked this item as safe.
Regards,
Prevx Support
You can feel free to qualify this here: http://info.prevx.com/aboutprogramtext.asp?PX5=E4A...
Please learn how to read before you go futzing with someones brand and or reputation.
Nigel
Hello Nigel
Fri Jul 24 20:56:17 2009 — g7wIf we've made a mistake, it will get resolved; much quicker than it would at SA, but now SA will be reviewing a different archive with different files... >> SA
The Prevx link doesn't state "safe" merely Currently being reviewed
there is a difference; and whether or not the file name is all CAPS or HungarianProper is mute - they are the same file.
As for "playing fair'
I see you've quickly removed the .DLL from the archive and packed it into the new installer.
MD5: 685a7f81d107270e544e8d75aba78307 - ThreatExpert
MD5: 7fe660be6bfefc16514fd96846b12db6 - ThreatExpert
Now this looks suspicious to me; comparing apples to oranges.
I need to see if anyone has a test machine they can install this on, sandboxed and see the results... I have both files available if anyone has the time, PM me.
-------
Against Intuition - gives us safety through Web of Trust.
WOT Community - gives us security through unity.
Thank you all
G7W
....
Fri Jul 24 22:01:43 2009 — MysteryFCMFire me an e-mail ;o)
steven @ my domain (the it-mate.co.uk one, not the hosts-file.net one)
Regards
Steven Burn
Ur I.T. Mate Group / hpHosts
it-mate.co.uk / hosts-file.net
HI
Fri Jul 24 21:44:43 2009 — Nigel-LewHi, sorry. I was a bit wound up when I woke up to this mess. It would seem that the sophos link has nothing to do with the dll in question. It has been protecting against it since 07 yet this app has been in the wild for like a week now.
They may very well have repacked it. I have provided them with a range of suggestions but they are all usability and business model related.
I run a marketing firm. I am not a programmer. That said, I would not have taken the job if it was a dodgy app or I did not believe in the developers.
We do also run a full blown IT firm. I am not making this stuff up ;)
cept for days like this I prefer brand management and marketing lol....
At any rate, I have scanned this stuff repeatedly with a wide range of things. It is fine.
I did not invent the prevx response either. I sent that off to them first thing this morning.
thanks,
Nigel
Fraudulent software can be marked as 'clean'
Sat Jul 25 16:49:26 2009 — Tonor» At any rate, I have scanned this stuff repeatedly with a wide range of things. It is fine.
Unfortunately, as is often the case with fraudulent software, many scanners will report the files as clean. I have submitted files for analysis only to be told there's no malicious code in the file.
The virus analysts are often correct when they say there is no malicious code, but it's how the file gets classified that's important in cases like this. Many will eventually tag the applications as a fraud tool.
...
Sat Jul 25 13:43:38 2009 — MysteryFCMCare to explain why you've got awards on your site, for sites that don't have your software listed? (e.g. Softpedia). This is dishonest at best, and downright fraudulent at worst.
Secondly, you claim you believe in the application, suggesting you've actually tested it - yet you claimed regtidy.dll was not present?? Both the installer itself, and the following, show otherwise;
http://www.threatexpert.com/report.aspx?md5=7fe660...
Third, care to explain why the application has references to RegConvoy (registryconvoy.com - 97.74.144.68) - another rogue application? And interestingly, another application that claims to be the recipient of a Softpedia award when in actuality, the application is not listed at Softpedia - making the award claim absolute rubbish.
*******************************************************
Registrant:
Lin Fan
China ShangHai MingHangQu
ShangHai, ShangHai 200000
China
Registered through: GoDaddy.com, Inc. (http://www.godaddy.com)
Domain Name: REGISTRYCONVOY.COM
Created on: 11-Jun-09
Expires on: 11-Jun-10
Last Updated on: 11-Jun-09
Administrative Contact:
Fan, Lin regconvoy@gmail.com
China ShangHai MingHangQu
ShangHai, ShangHai 200000
China
+86.021364656 Fax --
Technical Contact:
Fan, Lin regconvoy@gmail.com
China ShangHai MingHangQu
ShangHai, ShangHai 200000
China
+86.021364656 Fax --
Domain servers in listed order:
NS03.DOMAINCONTROL.COM
NS04.DOMAINCONTROL.COM
*******************************************************
I'll let you explain this before I go into the rest .....
I should note, we do actually know what we're doing ;o)
Regards
Steven Burn
Ur I.T. Mate Group / hpHosts
it-mate.co.uk / hosts-file.net
Rated Registryconvoy too,
Sat Jul 25 15:24:29 2009 — shazzaThanks MysteryFCM.!
registryconvoy.com
See http://www.malwareurl.com/search.php?domain=&s=reg...
http://www.malwareurl.com/search.php?domain=&s=reg...
...
Sat Jul 25 15:55:58 2009 — MysteryFCMAlways a pleasure ;o)
Regards
Steven Burn
Ur I.T. Mate Group / hpHosts
it-mate.co.uk / hosts-file.net
interesting
Sat Jul 25 19:35:16 2009 — g7wregtidy.com is an exact duplicate of registryconvoy.com
RegTidy
RegistryConvoy
hmph
Sat Jul 25 18:47:52 2009 — Nigel-LewWell, like I have tried to intimate before, this app has been rectified of suspect behavior based on my marketing assertions(not it being malware). It is also being re-branded due to some other nitwit marketing firm from a while ago.
"Care to explain why you've got awards on your site:"
Well aside from the fact that they can only push my change orders so quickly and its NOT MY SITE no, I don't care to respond to that. It does not make the app malware, it simply indicates they need to continue implementing my changes so I can do it right.
This is what I do for a living, you folks can feel free to proceed with the witch hunt. I can use the cash ;)
Nigel
"I can use the cash"
Sat Jul 25 19:47:16 2009 — phantazmWe're not in it for the money...
.
Sat Jul 25 19:56:21 2009 — evilfantasyI can use the cash ;)
And you will lie and cheat people to get it.
If you are a respectable PR firm you wouldn't take anybody like these scammers on as a client. You and they are one in the same, which I have a feeling is closer to the truth then what you lead on. A company like Regtidy isn't going to pay a PR firm to do their dirty work when they can (and do) do it themselves.
Hi
Sat Jul 25 19:58:30 2009 — Nigel-LewHi, my job is brand management. That is what I was referring to. Its abundantly clear that most of you folks don't do this for money.
I do however handle this sort of IT stuff, I am looking at the flippen source code as we speak. I think I have a much better handle on what said file does than noobs and folks that don't know how to sandbox an app or run a VM.
And like I said, you folks provided me with weeks of damage control, for that, I thank you kindly :)
Nigel
Errr .......
Sat Jul 25 20:15:05 2009 — MysteryFCMMay want to research who you're insulting before insulting them ..... I deal with malware and malicious sites on a daily basis (and as of recently, also do this for a living (previously I did it as a hobby)). I'm more than capable of telling the difference between a legit app and a rogue one - and this is a rogue one.
Allow me to point you to my definition of rogue;
http://forum.hosts-file.net/viewtopic.php?f=23&t=1...
As for;
"It does not make the app malware, it simply indicates they need to continue implementing my changes so I can do it right."
I think you'll find it actually indicates they've got a serious lack of ethics as dishonesty is not something that legit folks go for.
And no, I don't buy your rebranding story either - both domains were created within the past few weeks. Aside from the dates, legit companies don't rebrand due to some idiotic marketing company messing around - they fix the problem by firing the company, then depending on what happened, apologise and explain what happened.
Regards
Steven Burn
Ur I.T. Mate Group / hpHosts
it-mate.co.uk / hosts-file.net
you folks don't do this for money
Sun Jul 26 03:24:55 2009 — g7wIts abundantly clear that most of you folks don't do this for money.
WOT - Web of Trust is a free browser add-on.
WOT Forum participation is voluntary.
FYI many Opensource products are superior to those [comparable] that are purchased through the marketplace simply because there is no motive for profit to hinder the product's quality.
-------
Against Intuition - gives us safety through Web of Trust.
WOT Community - gives us security through unity.
Thank you all
- G7W
I think I have a much better handle on what said file does than
Sat Jul 25 20:15:21 2009 — evilfantasyHow do you think we run these untrusted applications?
Your just digging a deeper hole every time you post. You don't know software development but you can read source code? Give me a break!
I run a marketing firm. I am not a programmer.
I just ran this software. 397 "critical errors" in my registry?
Run it on your computer then get back to us. Well, scratch that. You wouldn't tell the truth anyway.
Hi
Sat Jul 25 20:42:53 2009 — Nigel-LewIt does not require a programmer to open up a hex editor and check things or have a programmer look at it to confirm my assertions.
"Run it on your computer then get back to us. Well, scratch that. You wouldn't tell the truth anyway."
I can't fathom what would possess you to resort to personal attacks but you are certainly entitled to your opinion. I simply trying to rectify the situation.
Futhermore, showing 397 registry errors is not uncommon for any app.
Nor do I care if you don't buy my re-branding comments. The latter is a much better name, period. That is not rocket science.
I am not going to bother to inquire why making the app and its presentation more usable to the peanut gallery somehow reflects poorly on my ethics.
All I want is the app to work as advertised and not behave dodgy in any way. I am sorry you folks are at issue with that. Any changes I have suggested are largely almost done anyway.
"If you are a respectable PR firm you wouldn't take anybody like these scammers on as a client. You and they are one in the same, which I have a feeling is closer to the truth then what you lead on. A company like Regtidy isn't going to pay a PR firm to do their dirty work when they can (and do) do it themselves."
First off, no they can't or they would not have paid me in the first place. Secondly, I am a reputable firm and have been for 6+years without issue until I kindly attempted to point out that this app does not have a virus in it, malware, or otherwise.
Marketing of said project does not and will not proceed until the issues I have outlined to them get sorted out on their end. Hope that clears things up.
Thanks again,
Nigel
hmph
Sat Jul 25 20:49:56 2009 — Nigel-Lew"And you will lie and cheat people to get it."
Can't respond to that without getting banned from wot but you are welcome to give me ring. I take that stuff seriously, you may want to find someone else to slander Kevin.
866.826.6537
Nigel
Heh
Sun Jul 26 00:20:39 2009 — evilfantasyYour beginning to show your true colors now... ;)
OK
Sat Jul 25 21:02:41 2009 — evilfantasyIf you are not responsible for how RegTidy is built then I will apologize. BUT, you have said in so many words that we are un-intelligent liars (that's how your words strike me) so I didn't really start in with the personal attacks. You did.
We aren't here to show favoritism or any other bias to anybody. We go by facts and they aren't adding up to a legitimate product. When an empty registry key is described as a "critical error" that needs $$$ to fix it is deceit. So we call it that.
Futhermore, showing 397 registry errors is not uncommon for any app.
It's very uncommon on my computer.
We do change ratings when it is obvious we are either wrong or the software/website shows they are willing to clean up their act. So far you haven't done so.
And with that. I'm done here. Good day...
HI
Sat Jul 25 21:43:10 2009 — Nigel-LewUntil I noted that these folks were going to pay me quite well do to this work for them correctly, I did not even consider it. I have absolutely nothing to do with the development of said application. I am however charged with the task of making it function as I deem necessary and marketing it.
An empty reg key is just that and simply something that is unessessary to have around and hence gets picked up.
I have had multiple conversations about conversion rates with companies like webroot(as 6 year affliate) regarding sundry limitations on the apps and what makes folks opt to buy things. I can be fairly certain I am on the right track there.
The app will or already has various options for things like that. I am not party to their time schedule to rectify things but, so I am clear, I instructed them to remove certifications that belong to their other app, fix the application itself of a few odd behaviors and the bulk of my work was spent on the business model itself. This was all done several days ago. A lot of it has already taken place.
This should serve to explain why it keeps getting recompiled.
"un-intelligent liars (that's how your words strike me) so I didn't really start in with the personal attacks. You did"
I did not say anything of the sort, It is not unreasonable to suggest that the guy with the source code might now a bit better about what is going on then someone who can't run sandboxie or vm. Its that simple.
thanks for chiming back in, this is just work to me. I don't take things personally.
At the end of the day I will be happy with things and wind up with a ton a free advertising ;)
Actually, after considering your regkey comment I may have them rethink that. Empty is not an inherent problem but something may still need to be stuck there an hour later if you will.....
Nigel.
Oks, lets settle this.
Sat Jul 25 22:07:42 2009 — MysteryFCMSince you've not brought it up, allow me (aww, and you thought we'd not tested it ourselves) to;
1. It claims errors exist even BEFORE it has actually scanned anything;
http://temerc.com/imgRegTidy_com_-_main_UI.gif
2. It listed over 400 "problems" that either didn't exist and/or, were NOT problems (infact, removal of some of the keys, including some of the EMPTY keys, would have crippled the system).
http://temerc.com/imgRegTidy_com_-_scan_results.gi...
3. It provides no means of saving the results to a log for manual analysis
.... enough said - it IS A ROGUE!
Regards
Steven Burn
Ur I.T. Mate Group / hpHosts
it-mate.co.uk / hosts-file.net
Temerc.com
Sat Jul 25 22:41:20 2009 — shazzaSlightly off topic, but needed to mention that someone has been disagreeing
to all green comments on the scorecard for temerc.com. I've agreed to all ,
but some are still -1
http://www.mywot.com/scorecard/temerc.com
And Prevx agrees
Sat Jul 25 23:21:12 2009 — Tonor» .... enough said - it IS A ROGUE!
Since Nigel mentioned Prevx earlier, I'd like to confirm they do now detect and block regtidy_setup.exe and registryconvoy_setup.exe. ;)
LinaSoft
Sun Jul 26 02:02:21 2009 — g7wand now a Registry Cleaner?
Lin Fan
Shanghai, China
Domain Name: REGISTRYCONVOY.COM
Created on: 11-Jun-09
Expires on: 11-Jun-10
Last Updated on: 11-Jun-09
Lin Fan
Shanghai, China
Domain Name:linasoft.com
Record last updated at 2008-08-26 08:00:44
Record created on 2003/8/24
Record expired on 2009/8/24
J.N.Lew Design Group
Sun Jul 26 01:43:17 2009 — g7wA bit off topic, but since Nigel offered a phone number, I thought I'd toss in a little more information...
jnlew.com - whois
Interesting security page you have Nigel
hxxp://www.jnlew.com/services/computer/online-security
Contact page:
hxxp://www.jnlew.com/company/about
Unfortunately at the domain level all you see is: "New site is coming soon!"
-------
Against Intuition - gives us safety through Web of Trust.
WOT Community - gives us security through unity.
Thank you all
- G7W
Rofl ....
Sun Jul 26 02:01:32 2009 — MysteryFCMDefinately interesting;
"All detection reports come directly to us twice daily while all other software typically updates itself only once daily."
What a load of tosh. Almost all AV's I've used have updated alot more often than once per day (NOD for example, updates atleast 12 times per day!!!, ClamAV allows updating EVERY HOUR)..
"We recommend and offer support for a number of outstanding security utilities"
Err nope, you recommend ONE AV, and it's ONE OF THE WORST!!!
hxxp://www.jnlew.com/resources/Webroot/
... and to top it off, the last time I checked, Webroot's apps were a free SCAN only, requiring you to pay to remove whatever it found.
Regards
Steven Burn
Ur I.T. Mate Group / hpHosts
it-mate.co.uk / hosts-file.net
affiliate
Sun Jul 26 02:14:32 2009 — g7wAffiliate; rename, re-brand, transfer license, fetch/pass updates...
doesn't liutilities do this with their products through digitalriver affiliates?
or am I thinking of paretologic?
-------
Against Intuition - gives us safety through Web of Trust.
WOT Community - gives us security through unity.
Thank you all
- G7W
LOL!
Sun Jul 26 02:47:11 2009 — WarxasI have not been following this thread much, but this struck me as really funny.
"Futhermore, showing 397 registry errors is not uncommon for any app."
That's the most ridiculous statement I've ever heard. God that's funny!