Is this thing true about Returnil?

[lolpop]

-{ Quote: "My problem is the fact that they eventually write sub-systems on your machine that allows them to turn your computer into a bot-net computer if they decide to do so." }-

http://sites.google.com/site/pointprophetic/returnil-virtual-system-rvs-computers-security-danger

Is that true or the author doesn't know what he's talking about?

because he said stuff that don't make sense to me (maybe because I'm not expert enough to understand those things), such as this one:
-{ Quote: "Normally they do this within the 32 bit format and it is very hard to detect. However since I use layered security blocking Returnil from the Svchost at the third or forth layer I noticed they would eventually write a 16-bit sub-system ..." }-

[trjam]

Probably

[BlueZannetti]

-{ Quote: "Is that true or the author doesn't know what he's talking about?" }-The latter.

Blue

[Coldmoon]

Hi lolpop and welcome to the forums :)

Just so the message is not lost I want to reinforce Blue's reply:

The author of that article doesn't know what he is talking about and there is nothing in RVS 1x, 2x, or 3x that could be used for such a nefarious purpose.

The very thought of doing anything to compromise our customer's security or to abuse our user base in any way would be so alien as to cause the person having such a thought to break out in convulsions of horror.

We all came out of the early privacy/security communities and traditional antimalware/antivirus industries to create a new approach to winning the war on malware, not to engage in the very same activities that we are fighting against.

Words however are never a measure of one's true nature so we encourage everyone to try, test, and stress our software to determine its good intent and effectiveness for themselves.

Kind regards
Mike and the rest of the Returnil Team

[lolpop]

-{ Quote: "I fear Returnil has made some bad choices and agreements with China to allow their system to be used for surveillance as well as bot-netting computers around the world." }-

This one can't be true either, can it?

[Meriadoc]

ROFL;D ahh laughable

[lolpop]

lol,
I thought it's me who can't understand those stuff.

turned out that the author was just crapping things up.

[CloneRanger]

First off, i would be astounded if ANY of the claims turned out to be true.

But have ANY of us actually done indepth tests to verify, one way or another, what is claimed ? I doubt it, i know havn't, nor do i have the tools/skills with which to do it properly.

Have Returnil had the RVS apps/code FULLY checked since this was announced ? If so what did they find ?

Where is Returnil coded ? Is it in China, partly or in full ?

Returnil Launches Website in Chinese to Support Expansion in China
http://www.afterdawn.com/news/press_releases/press_release.cfm/8748/returnil_launches_website_in_chinese_to_support_expansion_in_china

Chinese RVS www - http://www.returnilvirtualsystem.com/zh-cn

It could be resonable to "assume" that updates/connections "might" be within China ? Even if the're not, does any version/s of the app have, or ever had, any IP/s to China for whatever reason/s, even ligit ?


A few "possible" coincidences for illustration purposes.


-{ Quote: "Originally Posted by pointprophetic

However since I use layered security blocking Returnil from the Svchost at the third or forth layer I noticed they would eventually write a 16-bit sub-system because they could not get into my system otherwise. It is always aggressive and it is always leads to a private ip address in China." }-

Posts 5 and 6 in here - http://www.wilderssecurity.com/showthread.php?t=276773 show malware Installer1.exe invoking ntvdm.exe to try and circumvent my system and gain entry via 16-bit code.

-{ Quote: "Originally Posted by pointprophetic

Since Returnil is becoming very popular in many countries this policy of aggressively entering your machine disabling all restore capabilities gives me pause. In fact if you try to restore using your regular restore features of your operating system, your machine once completely hacked you will normally get the blue screen of death." }-

There is a known issue with System Restore points on XP
http://www.wilderssecurity.com/showthread.php?t=270069

System Restore - All gone, Again - http://www.wilderssecurity.com/showthread.php?t=268969

System Restore MAJOR FAILURES - http://www.wilderssecurity.com/showthread.php?t=248174


So until such a time we receive FULL answers, where does that leave us ? Well we either rely on what Returnil says, or we don't !

It should at least calm any doubters if we could know for certain :thumb:

[Coldmoon]

Hi CR,
There is no conspiracy so you can throttle back on the hyperbole...

Let me just share some facts that might be useful here:

1.) RVS does not communicate with a private IP address in China. However, Returnil does have a web site in China, as well as in the US, Russia, and other countries.

2.) RVS does not open any ports on the user's computer. However, some editions of the product include remote management capabilities which have been implemented from the beginning in a way that does not require RVS to open ports that could become a back door - period.

3.) RVS is not packaged/integrated in China. Though some components of the product are developed in China, others are developed in Russia as well as other countries.

4.) RVS is released only after passing stringent internal QA/QC review, which includes strict security auditing at all stages of development.

5.) RVS is in the process of obtaining certifications by third-party organizations which provide independent opinions regarding the product quality and security.

Given our internal cross-checking and verification of all components and code, with outside, independent testing and verification required to obtain a wide range of certifications, what possible reason would we have to do as this "reviewer" suggests? The author has no understanding of our software and has insufficient technical knowledge to perform accruate testing regardless of what program he is "investigating".

Mike

[CloneRanger]

Hi Mike, no hyperbole, just questions.

Re

1 = :thumb:

2 = -{ Quote: "However, some editions of the product include remote management capabilities which have been implemented from the beginning" }-

Really, which versions, and why ?

-{ Quote: "in a way that does not require RVS to open ports that could become a back door - period." }- = :thumb:

3 = -{ Quote: "Though some components of the product are developed in China" }- Right.

4 = :thumb:

5 = :thumb: Great let us know when this happens, and what the results are please.

-{ Quote: "Given our internal cross-checking and verification of all components and code, with outside, independent testing and verification required to obtain a wide range of certifications
" }- = :thumb:

Nothing like hearing it, straight from the horses mouth = :thumb:

If this was left unchallenged, doubts "may" have lingered in peoples minds about the allegations, which i presume, you would prefer them not to. I'm brave enough to step forward and ask. I hope you appreciate my sound reasons for doing so, and i appreciate your swift response :thumb:

You already know how much i liked RVS, when i used it, despite the issues i've had with it in the past. I know that you're working on, from what you've told me, and all will be well very soon, i hope :)

[Coldmoon]

-{ Quote: "Really, which versions, and why ?" }-

Enterprise Premier and Classic are products that rely on remote management within a network. If you have 100 client computers, you are not going to want to walk to each one just to interact with the software, you use a management console to do that from a central office or server.

Mike

[CloneRanger]

-{ Quote: "Originally Posted by Coldmoon

Enterprise Premier and Classic are products that rely on remote management within a network. If you have 100 client computers, you are not going to want to walk to each one just to interact with the software, you use a management console to do that from a central office or server." }-

Those remote management capabilities = Fine = :thumb:

Thanks

[caspian]

-{ Quote: "First off, i would be astounded if ANY of the claims turned out to be true.

" }-

PHEWWW! That sure is a relief. Because I was beginning to wonder if this was a sign of the End Times. You know, much like locusts, wars, and rumors of wars etc...:argh:

[CloneRanger]

@caspian
-{ Quote: "
I was beginning to wonder if this was a sign of the End Times" }-

Not as far as Returnil is concerned, i'm also relieved to be informed :thumb:

But the End Times sure are coming make no mistake :( In fact they are already under way, and have been for some time. Only now are more and more people witnessing signs etc for themselves as every day goes by. See the links in my SIG link for reliable info etc etc on All this ;)