Security → These companies that mislead our users of VLC Player

Category: English / Tag: VideoLAN, VLC / Add Comment
Some thoughts about the people who use the name of VLC media player to spread adware/spyware while infringing the VideoLAN‘s intellectual property and brand…

At VideoLAN we’re really fed up with all those websites/companies that are tricking our users to download malware and violate our IP by distributing misleading versions of VLC without conforming to the GPL license.

What bothers us the most is that many of them are bundling VLC with various crapware to monetize it in ways that mislead our users by thinking they’re downloading an original version. This is not acceptable. The result is a poor product that doesn’t work as intended, that can’t be uninstalled and that clearly abuses its users and their privacy. Not to mention that it also discredits our work as volunteers and that it’s time-consuming, time that is not invested in the development.

Of course this situation is not specific to VLC, other open source products are affected by this scourge and there’s not much we can do about it. They have the money to buy adwords, we don’t. Sadly, as a non-profit organization we don’t have the money to sue them.

We’re constantly trying to enforce our IP to protect our users, in the meantime tell people around you that VLC media player is and will always be free of any charge and for your own security always download it from the official website www.videolan.org.

FYI these are the two biggest companies who use VLC to distribute their crap:
- pinballcorp.com
- eorezo.com / tuto4pc.com

But there are many more:

»blog.l0cal.com/2011/07/0 ··· r-users/

Someone call Anonymous.. They'll take care of 'em..

i saw something similar mentioned in recent posts at the "spyware sucks" blog, where crapware is bundled with legitimate programs:

»msmvps.com/blogs/spyware ··· ult.aspx

Really makes me angry..I use and support this player. Told a friend to try it out and she got a bad one full of malware last week.

I fully support his statement on his blog. And I hope his statement and this posting here at BBR draws some positive results.
VLC is high quality open source software... and I'm thankful to them that there is a Windows version of said software.
I also gave this software to my sister to watch a specific movie she downloaded that was unwatchable on any other player except VLC.

Yes its important to tell people TO ONLY DL THIS PROGRAM FROM THIER WEBSITE!!

Im sorry your friend got a bad one

IMO the best place to download ANY program, is directly from the program author's website.

Some of the linked sites look specifically set up to deceive. And someone not familiar with "v l c" does a search, happens upon a "poisoned link" (or whatever you call an artificially highly ranked search link) & they're had.

from the origanal source this is a great program I use it and love it.

Similarly, some year back I sent this email to "WinRAR":

quote:

---

I'm trying to help someone with "Intervalhehehe" virus.
Googling it appears associated with "winrar".

Now I know what WinRAR is, so I figure they downloaded a warez version or something.

Googling also points out that some say they downloaded "win-rar", which I know "not" to be WinRAR.

Now I also know of »www.rarlabs.com, so when I see a site »www.win-rar.com, I immediately think that it is the bogus site, just spoofing, playing on your name, distributing malware from there.

But looking more closely, perhaps »win-rar.com is legit (after all, that is where I'm sending the email). And it looks like someone is squatting on »www.winrar.com.

Anyhow, IMO, it could be an unfortunate & losing situation for you. I hope not.

But given that everything these days is suspect, the squatter, not allowing you to use "your" name, ... it just adds confusion.

I did a whois on »www.win-rar.com expecting it to come up the same as »www.rarlabs.com, but that is not the case.

If nothing else ... if nothing else what? I was going to say that »www.rarlabs.com (that is what I know as WinRAR from days of old, that is where I would start if I were to download WinRAR) should make it clear & explicit that www.win-rar.com is the sales arm of »rarlabs.com (if that is what it is). But then I think, who else "knows" of rarlabs.com. Certainly not the casual user, so while placing a notice on rarlabs.com would help, it would not help very many.

Ah, I guess the situation kind of sucks.

Just thought I'd give you my impression since I've now run into this.

---

VideoLAN Calls Out for Help to Protect Users from VLC Scams

VideoLAN, the organization supervising the development of the VLC open source media player is calling out for help from the community to stop scammers who bundle malware with its popular program.

"At VideoLAN we’re really fed up with all those websites/companies that are tricking our users to download malware and violate our IP by distributing misleading versions of VLC without conforming to the GPL license," says Ludovic Fauvet, one of the core VLC developers.

"[...] There’s not much we can do about it. They have the money to buy adwords, we don’t. Sadly, as a non-profit organization we don’t have the money to sue them," he adds.

Fauvet published a list of 25 websites currently distributing VLC together with adware and spyware in an attempt to capitalize from the media player's popularity.

The developer complained on his blog that no one is helping the organization to fight this problem, not even the companies that are in a position to do so. "It’s the role of the Ad-companies to filter malicious requests from their customers. Sadly most of them don’t care," Fauvet said.

However, it seems that his call for help has attracted the attention of quite a few people and Google, which previously ignored the issue, has now offered to help. "We now have a contact at Google. The AdWords issue should be resolved soon," the developer added in a later reply to the discussion.

Mozilla's Mike Shaver also stepped in and offered some guidance, as Firefox is targeted in a similar way. He also promised to look into how StopBadware.org can help, since he is a member of the board of that organization.

Fauvet complained that in his previous discussions with StopBadware, the project refused to add the scam websites to their backlist because they don't meet its criteria for badware. StopBadware's lists are used by Mozilla Firefox and the Google Safe Browsing service to block malicious URLs.

»news.softpedia.com/news/ ··· 96.shtml

On my own forum I recommend, and have links to download, VLC Player from the Video Lan site. Twice now, a new user has joined my site and added a post at in my VLC thread with links to download a fake player. I have caught both within the first day they were posted and removed them and restricted or banned the members who posted those links.

VLC Player should only be downloaded from the Video Lan site, period.

Dave

Yes, but in addition to that, VLC should be contacting the authorities since they know the main perpetrators of this scam. Since two are US based, the district attorney in their respective states and the FTC »www.ftc.gov/ would be good places to start.

For the Paris based one, they should contact the DGCCRF (Direction Générale de la Concurrence, de la Consommation et de la Répression des Fraudes = Directorate General for Competition, Consumer Affairs and Repression of Fraud) »www.economie.gouv.fr/dgccrf

Complaining about it in forums isn't going to do much.

Domain Name: PINBALLCORP.COM

[REGISTRANT]
Organisation Name: Pinball Corp
Contact Name: William Freeman
Address Line 1: 3600 136th Place SE
Address Line 2:
City / Town: Bellevue
State / Province:
Zip / Postcode: WA 98006
Country: US
Telephone: +1.0114252791177
Fax:
Email: wfreeman@pinballcorp.com

[ADMIN]
Organisation Name: Safenames Ltd
Contact Name: International Domain Administrator
Address Line 1: PO Box 5085
Address Line 2:
City / Town: Milton Keynes MLO
State / Province: Bucks
Zip / Postcode: MK6 3ZE
Country: UK
Telephone: +44.1908200022
Fax: +44.1908325192
Email: hostmaster@safenames.net

[TECHNICAL]
Organisation Name: International Domain Tech
Contact Name: International Domain Tech
Address Line 1: PO Box 5085
Address Line 2:
City / Town: Milton Keynes MLO
State / Province: Bucks
Zip / Postcode: MK6 3ZE
Country: UK
Telephone: +44.1908200022
Fax: +44.1908325192
Email: tec@safenames.net

domain: eorezo.com
reg_created: 2004-03-19 11:07:07
expires: 2012-03-19 15:07:07
created: 2004-03-19 17:07:08
changed: 2010-12-02 13:18:40
transfer-prohibited: yes
ns0: ns1.eorezo.com 62.23.9.120
ns1: ns2.eorezo.com 62.23.9.122
ns2: ns3.eorezo.com 91.121.20.200
owner-c:
nic-hdl: HJ381-GANDI
owner-name: haurais jl
organisation: haurais jl
person: Jean-Luc Haurais
address: 631 Keats CT Palo Alto US CA
zipcode: USCA
city: US CA
country: United States of America
phone: +65.650565816
fax: +65.650565816
email: a9493f47b95b7efa5f056173b92b6e5e-533437@contact.gandi.net
lastupdated: 2010-01-13 14:26:56
admin-c:
nic-hdl: HJ32-GANDI
organisation: ''
person: haurais jl
obfuscated: Obfuscated by Gandi
address: (Gandi) 15 place de la Nation
zipcode: (Gandi) 75011
city: (Gandi) Paris
country: (Gandi) France
phone: (Gandi) +33.170377666
fax: (Gandi) +33.143730576
email: 2e5dc6b0215b18c78f376ad6b515a6d7-34110@contact.gandi.net
lastupdated: 2011-07-08 17:16:31
tech-c:
nic-hdl: HJ32-GANDI
organisation: ''
person: haurais jl
obfuscated: Obfuscated by Gandi
address: (Gandi) 15 place de la Nation
zipcode: (Gandi) 75011
city: (Gandi) Paris
country: (Gandi) France
phone: (Gandi) +33.170377666
fax: (Gandi) +33.143730576
email: 2e5dc6b0215b18c78f376ad6b515a6d7-34110@contact.gandi.net
lastupdated: 2011-07-08 17:16:31
bill-c:
nic-hdl: HJ32-GANDI
organisation: ''
person: haurais jl
obfuscated: Obfuscated by Gandi
address: (Gandi) 15 place de la Nation
zipcode: (Gandi) 75011
city: (Gandi) Paris
country: (Gandi) France
phone: (Gandi) +33.170377666
fax: (Gandi) +33.143730576
email: 2e5dc6b0215b18c78f376ad6b515a6d7-34110@contact.gandi.net
lastupdated: 2011-07-08 17:16:31

domain: tuto4pc.com
reg_created: 2010-06-07 03:02:59
expires: 2013-06-07 03:02:59
created: 2011-06-07 09:03:31
changed: 2011-07-05 16:35:09
transfer-prohibited: yes
ns0: ns2.agence-exclusive.com
ns1: ns1.agence-exclusive.com
owner-c:
nic-hdl: FR2781-GANDI
owner-name: Tuto4PC.com GROUP
organisation: Tuto4PC.com GROUP
person: Franck ROSSET
address: 14 rue Lincoln
zipcode: 75008
city: Paris
country: France
phone: +33.158365542
fax: ''
email: 1e410bb0ed78c3ad1991e840f32ad33f-1339048@contact.gandi.net
lastupdated: 2011-07-05 17:04:24
admin-c:
nic-hdl: FR2781-GANDI
owner-name: Tuto4PC.com GROUP
organisation: Tuto4PC.com GROUP
person: Franck ROSSET
address: 14 rue Lincoln
zipcode: 75008
city: Paris
country: France
phone: +33.158365542
fax: ''
email: 1e410bb0ed78c3ad1991e840f32ad33f-1339048@contact.gandi.net
lastupdated: 2011-07-05 17:04:24
tech-c:
nic-hdl: DK883-GANDI
organisation: ~
person: David Keita
address: 12bis avenue du général de gaulle
zipcode: 95100
city: Argenteuil
country: France
phone: +33.685921967
fax: ''
email: 442104b254591e0b0d3ce5b6772b5a64-dk883@contact.gandi.net
lastupdated: 2010-05-26 20:15:15
bill-c:
nic-hdl: FR2781-GANDI
owner-name: Tuto4PC.com GROUP
organisation: Tuto4PC.com GROUP
person: Franck ROSSET
address: 14 rue Lincoln
zipcode: 75008
city: Paris
country: France
phone: +33.158365542
fax: ''
email: 1e410bb0ed78c3ad1991e840f32ad33f-1339048@contact.gandi.net
lastupdated: 2011-07-05 17:04:24

right...and you can also get Skpye, Avast, WinZip, Open Office, and lots more with crap attached at eorezo.com

»www.google.com/#hl=en&su ··· &bih=633

30-day site report for: eorezo.com
Surf with caution
During the last 7 days potentially active threats were detected on a subdomain. However, no threats were detected on the main site.

»www.avgthreatlabs.com/si ··· ezo.com/

Problem is 10 websites that are similar to eorezo.com and they do it with tags.