False Positive - Mac Space Reviver

[AshishParihar]

Hi Malwarebytes Team,

 

This is regarding the false detection of Mac Space Reviver by Malwarebytes Anti-Malware.

Mac Space Reviver is a genuine app for Mac, lets you scan and clean all the duplicate files including photos, music, videos & a lot more on Mac. This app does not modify any existing system settings, nor does it inject ads or hijack browsers. It is not involved in any kind of malicious activities. Our company is not only losing millions of users but our reputation and web traffic is also getting affected because of this  detection. We have suffered tremendous financial loss due to this. Please have this detection removed ASAP.

Details of the product are as follows:

File Name: msr_msite.pkg

Download URL:  http://cdn.macspacereviver.com/msr/builds/msr_msite.pkg

 

Regards,
Ashish Parihar

[miekiemoes]

Hi,

I'll have someone from the Mac team look into this

[treed]

This actually is not a false positive. Based on behaviors we have seen from PCVARK/Techyutils products, we consider them to be PUPs (potentially unwanted programs).

To be more specific about what we've seen, see the following for details on the most egregious violation, which involves a program that we consider to be malware:

https://blog.malwarebytes.com/threat-analysis/2016/08/pcvark-plays-dirty/

Since we have seen malware bundled with a PCVARK app and signed with a PCVARK/Techyutils certificate, we are actually inclined to treat all such products as PUPs.

[AshishParihar]

Hi Thomas,

I was not expecting this kind of answer by Malwarebytes Moderators. considering all the PCVARK products as PUPs (potentially unwanted programs) is not a right decision.

Mac Space Reviver doesn't do anything wrong with the users machine. its a simple application to clean duplicates.

I am still looking for a Product specific Review.

 

Regards,

Ashish Parihar

[treed]

Ashish,

Do you have an explanation for why we found what we consider to be malware, signed with a Techyutils certificate, being installed by an Advanced Mac Cleaner installer? Keeping in mind that we've found evidence showing that Techyutils and PCVARK are the same entity?

Or why we frequently see things like fake Adobe Flash Player installers that install your products? (See the screenshots below of two different examples, one from June and one from July.)

These reasons are more than enough to qualify under our PUP criteria:

https://www.malwarebytes.com/pup/

[AshishParihar]

Thomas,

I am here for Mac Space Reviver only.

Why you are not talking about Mac Space Reviver and its behavior on users machine ? if there are reasons for Mac Space Reviver to qualify under PUP criteria, please let me know those reasons. PUP does not mean potentially unwanted company. its a application specific criteria.

Regards,

Ashish

 

[treed]

As the article I referred you to says, we found Mac Space Reviver being distributed from a scam site owned by your company (macfileopener.com), that is associated with malware (OSX.FakeFileOpener) created by your company.

[AshishParihar]

Thomas,

After Reading that article I came to know about this issue. Mac Space Reviver is no longer distributed from any such site. Please investigate this again and remove the detection. I hope the outcome of your investigation will be application specific.

Regards,

Ashish Parihar

 

 

[AshishParihar]

Thomas,

I am waiting for the result of your latest investigation.

Regards,

Ashish Parihar

[treed]

We will not be changing our detections of PCVARK/Techyutils products at this point. Your company is guilty of distributing what we consider to be actual malware. We believe that it is our customers' right to know that programs from a company distributing malware are probably not trustworthy.