PDA

View Full Version : Freecorder 6 riddled with hidden Viruses?



donnaldgrogon
08-22-2012, 06:28 AM
I'm a huge fan of Freecorder. The older version worked flawlessly. I downloaded Freecorder 6 after purchasing a new computer. Freecorder 6 is riddled with spyware. During install the option to install add-ons are provided, however, these check boxes are for show only as the spyware is installed regardless. The install hijacked my IE, Firefox and Chrome. A virus scan discovered 40 Funmoods files throughout my computer including the registry. Trying to uninstall was a nightmare.

I've sent several messages to Applian requesting an explanation. Applian has not responded.

Fortunately Windows 7 can be restore to factory settings. I have one old computer with an older version of Freecorder and I'm looking for a way to transfer it to my new computer. I have no intention of using new Applian software until I hear their response.

Here is what you get with Freecorder 6

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org
Database version: v2012.08.14.03
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
[administrator]
8/14/2012 8:31:33 AM
mbam-log-2012-08-14 (08-31-33).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra |
Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 196992
Time elapsed: 2 minute(s), 51 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 26
HKCR\TypeLib\{D7EE8177-D51E-4F89-92B6-832EC40800} (PUP.Funmoods) -> No action
taken.
HKCR\CLSID\{75EBB0AA-4214-4CB4-90EC-E37ECD04F7} (PUP.Funmoods) -> Quarantined and
deleted successfully.
HKCR\funmoods.funmoodsHlpr.1 (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\funmoods.funmoodsHlpr (PUP.Funmoods) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper
Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} (PUP.Funmoods) -> Quarantined and
deleted successfully.
HKCR\CLSID\{75A4D144-506D-4BE5-81DB-EC7DE7F840} (PUP.Funmoods) -> Quarantined and
deleted successfully.
HKCR\TypeLib\{960DF771-CFCB-4E53-A5B5-6EFBE6E706} (PUP.Funmoods) -> Quarantined
and deleted successfully.
HKCR\esrv.funmoodsESrvc.1 (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\esrv.funmoodsESrvc (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\CLSID\{965B9DBE-B104-44AC-950A-8A5F9FF439} (PUP.Funmoods) -> Quarantined and
deleted successfully.
HKCR\escort.escortIEPane.1 (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\escort.escortIEPane (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> Quarantined and
deleted successfully.
HKCR\TypeLib\{4E1E9D45-8BF9-4139-915C-9F833D5921} (PUP.Funmoods) -> Quarantined
and deleted successfully.
HKCR\funmoods.dskBnd.1 (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\funmoods.dskBnd (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\CLSID\{A9DB719C-7156-415E-B49D-BAD03E4F13} (PUP.Funmoods) -> Quarantined and
deleted successfully.
HKCR\funmoodsApp.appCore.1 (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\funmoodsApp.appCore (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9} (PUP.Funmoods) -> Quarantined and
deleted successfully.
HKCR\f (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\Typelib\{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3} (PUP.Funmoods) -> Quarantined
and deleted successfully.
HKCR\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191} (PUP.Funmoods) -> Quarantined
and deleted successfully.HKCU\Software\Google\Chrome\Extension s\bbjciahceamgodcoidkjpchnokgfpphh
mbam-log-2012-08-14 (08-31-33)
(PUP.Funmoods) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Google\Chrome\Extensions\bbjciahceam godcoidkjpchnokgfpphh
(PUP.Funmoods) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uni nstall\funmoods (PUP.Funmoods) ->
Quarantined and deleted successfully.
Registry Values Detected: 2
HKLM\SOFTWARE\Microsoft\Internet
Explorer\Toolbar|{A4C272EC-ED9E-4ACE-A6F2-9558F29EF3} (PUP.Funmoods) -> Data:
Funmoods Toolbar -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet
Explorer\Toolbar\{A4C272EC-ED9E-4ACE-A6F2-9558F29EF3} (PUP.Funmoods) -> Data: ->
Quarantined and deleted successfully.
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 2
C:\Program Files (x86)\Funmoods\1.5.23.22 (PUP.Funmoods) -> Quarantined and deleted
successfully.
C:\Program Files (x86)\Funmoods\1.5.23.22\bh (PUP.Funmoods) -> Quarantined and
deleted successfully.
Files Detected: 13
C:\Program Files (x86)\Funmoods\1.5.23.22\bh\escort.dll (PUP.Funmoods) ->
Quarantined and deleted successfully.
C:\Program Files (x86)\Funmoods\1.5.23.22\funmoodssrv.exe (PUP.Funmoods) ->
Quarantined and deleted successfully.
C:\Program Files (x86)\Funmoods\1.5.23.22\escorTlbr.dll (PUP.Funmoods) ->
Quarantined and deleted successfully.
C:\Program Files (x86)\Funmoods\1.5.23.22\escortApp.dll (PUP.Funmoods) ->
Quarantined and deleted successfully.
C:\Program Files (x86)\Funmoods\1.5.23.22\escortEng.dll (PUP.Funmoods) ->
Quarantined and deleted successfully.
C:\Users\Kenneth\Downloads\applianflv.exe (PUP.BundleOffers.IIQ) -> Quarantined and
deleted successfully.
C:\Users\Kenneth\Downloads\gimp_958.exe (PUP.BundleOffers.IIQ) -> Quarantined and
deleted successfully.
C:\Users\Kenneth\Downloads\SoftonicDownloader_for_ secure-folder.exe
(PUP.ToolbarDownloader) -> Quarantined and deleted successfully.
C:\Users\Kenneth\AppData\Local\funmoods.crx (PUP.Funmoods) -> Quarantined and
deleted successfully.
C:\Users\Kenneth\Local Settings\Application Data\funmoods.crx (PUP.Funmoods) ->
Quarantined and deleted successfully.
C:\Program Files (x86)\Funmoods\1.5.23.22\escortShld.dll (PUP.Funmoods) ->
Quarantined and deleted successfully.
C:\Program Files (x86)\Funmoods\1.5.23.22\FavIcon.ico (PUP.Funmoods) -> Quarantined
and deleted successfully.
C:\Program Files (x86)\Funmoods\1.5.23.22\uninstall.exe (PUP.Funmoods) ->
Quarantined and deleted successfully.
(end)
Page

Jeff Lenney
08-23-2012, 12:24 AM
Hi Donald

I'm certain these are false positives, I'm going to check with our programmers on this and will follow up once I find out more!

Debbie McCormick
08-23-2012, 03:40 PM
Hi there. Sorry to hear you had some trouble. The Freecorder installer does not contain viruses. In order to keep Freecorder free, you are presented with a few offers during the install process. You can decline them all and still enjoy Freecorder. To do this you must select the "custom install" (rather than the default), un-select the check-boxes and click each decline button as they are presented to you. You'll then have only Freecorder and none of the other offers.

donnaldgrogon
09-02-2012, 05:49 AM
I suppose the reason this upsets me so is because I've used freecorder for years. The very best screen capture program I know of. These are not false positives. At this point I trust Malwarebytes more than Applian Technologies. Do you think installing software, unrelated to freecorder, in 43 locations throughout my computer is "false positives"? Please, you would be better off admitting you have Trojans in your software than to lie. Trick me into installing malware and admit it and we have the possibility of a future relationship. Lie to me and I'll out you every opportunity I get.

You should try installing freedorder 6 using Custom with boxes unchecked. It doesn't make any difference. Freecorder installs what you have programmed it to install regardless of Custom install.

I have no problem with you paying for software via advertisements. I would pay for freecoder but at this point I don't trust you. Offer me as many add-ons as you wish and let me decide which one's seem worthwhile. Don't offer the option to pass on the install add-ons and then install them anyway.

I'll pass your comments along to Malwarebytes.

Debbie McCormick
09-03-2012, 02:42 PM
The offers certainly do not install if you decline them AND un-check the boxes. This has been tested thoroughly. Freecorder 6 is wrapped in an installer that does give you options to install third-party programs (that's how we keep it free). However, these have been vetted and are indeed virus-free. It's certainly possible that users would not want or like the additional software, and that's totally fine. That's why you're presented with an option to not install them. In testing, we have not been able to replicate the situation that you describe. However, if you'd like to provide us with a video screencast of your install process that shows something different, we'd be happy to take a look at it and present it to the install vendor. We want Freecorder's install experience to be as transparent as possible.

donnaldgrogon
09-04-2012, 05:27 AM
The check boxes are window dressing that have no function other than to give the consumer the belief that these add-on's will not be installed. You will continue to be the subject of many forums complaining about Freecorder. It's a real shame. You will continue to receive these complaints until you make a decision to remove them.

As for me, I no longer care. I searched through some of my old computers and there it was. An old version of Freecorder without the malware. It works great and thank you for providing the software.

Cheers.

Anandgyan
09-15-2012, 09:31 AM
I concur with Donaldgrogon, for even though I was really adamant in not checking the boxes for the toolbar, my antivirus still acted up during the installation
and it was troublesome to remove both version of Freecorder on my pc, I was quite satisfied with Freecorder 4 and the upgrade to the version 6 did not bring the expected better performances, quite the contrary. Until I become dissatisfied with its replacement software I might return to an older version of Freecorder.

Adware/Yontoo.E.1 was sniffed out by Avira.

donnaldgrogon
09-15-2012, 03:42 PM
It is said when eating Crow it is best served when fresh. I missed that boat and now must eat dry old crow.

To Debbie McCormick, Director of Technology and Jeff Lenney, Technical Support I offer my humble apology. I was wrong and yyou have no idea how that crow stick in my throat. However, I was wrong and I believe when wrong you have to correct the wrong.

My problem was not reading instructions. I was un-checking the boxes for the add-on when all I had to do was click on "Decline" I just revised the Freecorder 6 download and discovered this simple way on installing Freecorder without the extras.

Not only did I upgrade to Freecorder 6, it works flawlessness.

Again, you have my humble apology for my undeserved rant. I've noticed others claiming these same issues. Please feel free to provide my serving of crow for them to review.

Anandgyan
09-17-2012, 06:31 AM
My problem was not reading instructions. I was un-checking the boxes for the add-on when all I had to do was click on "Decline" I just revised the Freecorder 6 download and discovered this simple way on installing Freecorder without the extras.

Not only did I upgrade to Freecorder 6, it works flawlessness.

Again, you have my humble apology for my undeserved rant. I've noticed others claiming these same issues. Please feel free to provide my serving of crow for them to review.

Am I ever glad for you.

I'm tempted to give it another chance and whenever
this strikes again I shall come back and let you know how it went.

Thanks for your update

~~~

Okay, did read the precisions about [Declining] which I did properly and my antivirus did not react as previously. All looked good until I went and tried to preserve this interview from YouTube only to get once more this "The URL scheme is not supported" message. I have uninstall Freecorder 6. Maybe one day I'll try to return to the version no.4 but so far I'll stay with my current choice for it did download that interview aforementioned.

ForgeAus
12-05-2012, 08:58 AM
Hi there. Sorry to hear you had some trouble. The Freecorder installer does not contain viruses. In order to keep Freecorder free, you are presented with a few offers during the install process. You can decline them all and still enjoy Freecorder. To do this you must select the "custom install" (rather than the default), un-select the check-boxes and click each decline button as they are presented to you. You'll then have only Freecorder and none of the other offers.

I'm sorry, but those checkboxes didn't work at all in my case ... I specifically told it not to install both, and it went ahead and hijacked my browsers (both Firefox and IE) anyway.. the Freecorder toolbar component itself I have had no problems with its mostly the new tab replacement page I didn't want (still don't) and can't seem to remove ...

drcucumber
12-05-2012, 06:55 PM
freecorder 6 has ruined a fresh windows install. Don't tell me that it is some other program, because like i said, it is a fresh install, and there are no others.
I installed crapcorder and immediately my browsers are hijacked by claro-search redirects, and everything is slowed down.
I don't care what your excuse is. If you think it is my fault for 'accepting' this crapware, then sorry for assuming that applian were not trying to trick me. Congratulations. You managed to do it. Well done.

Jeff Lenney
12-06-2012, 12:26 AM
Hi Guys

Please submit any freecorder requests at http://freecorder.com/ for assistance - thank you