Why "false" positive are detected?

[Nicam]

The following are legit programs, why IObit Security wants to remove them?

 

C:\Program Files\SpyNoMore

 

C:\Program Files\RegClean

 

C:\Program Files\RegistryTool

 

Additionally I have downloaded D.exe from Symantec to check whether W32.Downadup was present in my PC. This program too has been reported as positive to remove.

 

A way to remove the "competitors"

[snoopy2010]

RegClean

 

RegClean is a rogue registry cleaner application that is usually downloaded and installed onto your computer by a Trojan finding its way through browser security holes. As soon as it is installed it will display notifications of non-existent and overemphasized system errors in order to trick you into purchasing the full version. RegClean is a clone of ErrorSweeper.

 

Type: Rogue AntiSpyware Programs

 

RegClean created the following directories, files, paths:

 

* %AppData%\RegClean

* %AllUsersProfile%\Start Menu\Programs\RegClean

* %ProgramFiles%\RegClean

 

RegClean creates the following registry entries:

 

* Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\RegClean

[enoskype]

Thanks snoopy2010,

 

Hi Nicam,

FYI, a quote from Should You Trust SpyNoMore to Remove Spyware from Your PC? :

If you know what spyware is, you know that it can be harmful and needs to be removed. SpyNoMore is a program that was once a rogue, and now claims to be an authentic program. Should you use it to scan your computer? Many people have had problems with it, and get no response when they attempt to contact the company.

 

I have no idea about the Registry Tool's source (which company?) and content, so I can't make any comment.

 

Competitor or not, does not matter if a software is rogue!!!

 

Interesting reading and images about rogue software: Rogue Security Software – Evolution, Protection and Awareness

 

Cheers.

[itsmejjj]

Many fake anti-spyware programs can even place infections on your pc when there were none before. What you need is reliable software that removes 100% of the threats on your pc, and restores security.

thank a bunch for this..link.i always was under the impression thy were ok.

 

RegClean. and found it a bit of a shock to see..this ..

itsmejjj

[snoopy2010]

Hi itsmejjj

 

Reg Clean is a rogue

 

Created Files

 

* %CommonDesktop%RegClean*.lnk

* %Windir%Tasks\RegClean Scheduled Scan.job

* %CommonDesktop%RegClean.lnk

* %Windir%Installer\{940E0B1E-6164-497A-8A3F-33E92523752C}

* %ApplicationData%Microsoft\Internet Explorer\Quick Launch\RegClean.lnk

* %Desktop%RegClean.lnk

*

 

Created Folders

 

* %CommonStartMenu%Programs\RegClean

* %ApplicationData%RegClean

* %ProgramFiles%RegClean

* %Windir%Installer\{D6938AFF-30C4-409C-B667-3F6503750BB8}

* %Windir%Installer\{7AE3A7B4-E475-48B1-A961-770E90675914}

*

 

Registry Entries

 

* Key: HKEY_CURRENT_USER\software\regclean

* Value:

* Data:

* Key: HKEY_CLASSES_ROOT\installer\features\ffa8396d4c03c9046b76f3563057b08b

* Value:

* Data:

* Key: HKEY_CLASSES_ROOT\installer\products\ffa8396d4c03c9046b76f3563057b08b

* Value:

* Data:

* Key: HKEY_CLASSES_ROOT\installer\upgradecodes\8e650c92721b8364bb774e25145c382a

* Value:

* Data:

* Key: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\installer\upgradecodes\8e650c92721b8364bb774e25145c382a

* Value:

* Data:

* Key: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{d6938aff-30c4-409c-b667-3f6503750bb8}

* Value:

* Data:

* Key: HKEY_LOCAL_MACHINE\software\regclean

* Value:

* Data:

* Key: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run

* Value: regclean

* Data:

* Key: HKEY_CLASSES_ROOT\installer\features\4b7a3ea7574e1b849a1677e009769541

* Value:

* Data:

* Key: HKEY_CLASSES_ROOT\installer\products\4b7a3ea7574e1b849a1677e009769541

* Value:

* Data:

* Key: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{7ae3a7b4-e475-48b1-a961-770e90675914}

* Value:

* Data:

* Key: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\installer\folders

* Value: c:\documents and settings\all users\start menu\programs\regclean\

* Data:

* Key: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\installer\folders

* Value: c:\program files\regclean\

* Data:

* Key: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\installer\folders

* Value: c:\windows\installer\{7ae3a7b4-e475-48b1-a961-770e90675914}\

* Data:

* Key: HKEY_CLASSES_ROOT\installer\features\e1b0e0494616a794a8f3339e523257c2

* Value:

* Data:

* Key: HKEY_CLASSES_ROOT\installer\products\e1b0e0494616a794a8f3339e523257c2

* Value:

* Data:

* Key: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{940e0b1e-6164-497a-8a3f-33e92523752c}

* Value:

* Data:

* Key: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\installer\folders

* Value: c:\windows\installer\{940e0b1e-6164-497a-8a3f-33e92523752c}\

* Data:

* Key: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\regclean_is1

* Value:

* Data:

* Key: HKEY_CLASSES_ROOT\installer\features\ad24529d1331b714bb11e1aa34a304f9

* Value:

* Data:

* Key: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\installer\folders

* Value: c:\windows\installer\{d92542da-1331-417b-bb11-1eaa433a409f}\

* Data:

* Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

* Value: RegClean

* Data: C:\Program Files\RegClean\RegClean.exe -boot

 

RegClean is a scam and should be treated as such: do NOT download or buy it

found and cleaned by

malwarebytes , emsisoft, McAfee, iobit 360 ect

[Nicam]

Thanks snoopy2010,

 

Hi Nicam,

FYI, a quote from Should You Trust SpyNoMore to Remove Spyware from Your PC? :

 

 

I have no idea about the Registry Tool's source (which company?) and content, so I can't make any comment.

 

Competitor or not, does not matter if a software is rogue!!!

 

Interesting reading and images about rogue software: Rogue Security Software – Evolution, Protection and Awareness

 

Cheers.

 

 

Thanks everyone,

 

Here is where those so called "anti-spy" programmes are not to be trusted. Furthermore wasting money for a license too.

 

RegClean is 100% Microsoft legit programme. I got it since 1998 and initially used on Windows 95. I did download it from Microsoft and I still have the original install bundle. RegClean works "perfectly" even with Windows 2008

 

SpyNoMore is another legit program that has an excellent heuristic protection that both notify you if a programme try to modify the registry and intercepts a malware during your Internet browsing.

 

RegistryTool is a another registry clean but I have found out that it destroys your registry rather than fix it.