19 Jul
I have Kaspersky Internet Security 2009 installed but fully deactivated as I don’t want it to interfere the way I use my computer. So I enabled, updated it and ran a full scan. Found some threats, clean it but problem still there. So I tried Webroot SpySweeper, Ad-Aware, SpyBot, SuperAntiSpyware and SpywareTerminator but NONE, I say again, NONE was able to remove the spyware on my computer. Ran HijackThis but couldn’t find anything suspicious. Ran DeepMonitor and couldn’t find any hidden process. Ran AIMFix, wasn’t able to detect any generic virus. Ran a few rootkit removers but found nothing.
I didn’t want to give up and reinstall Windows because of this spyware, so had to continue trying. I found CaSIR on my laptop, ran a quick scan and amazingly the spyware is gone!
CaSIR (Common And Stubborn Infections Remover) is an on-demand malware removal software. It is specially designed to remove the most common and stubborn infections from your computer. It can remove their running processes, their bodies, their registry entries and any other leftovers!

CaSIR doesn’t randomly search for CaSIs (Common and Stubborn Infectors), but it goes directly to the areas that a specific CaSIs infects and removes it from there, hence, it does its job in mere seconds!
Most importantly, CaSIR does more than that. It has a GENERIC and strong technique that allows it to do the following:
Removes the common restrictions made to your computer by those infectors which none of the AVs deal with. Removes the illegitimate services frequently used by those infectors. Recognizes and instantly kills and deletes any running process that is disguising itself among the legitimate system services. Removes any scripts used by those infectors to autorun. Removes any autostarting registry entries related to the illegitimate services he detects. Deals with all your storage medias (Fixed, floppy, removable…) and cleans them up all if need be. Cleans up your system registry so no more spy keys, garbage activities or messages keep asking for already deleted files. Signatures are fully updatable, once you download the software, all you need to do is to download the new definitions frequently and you’re up-to-date and ready-to-go.
That’s all the pros about CaSIR. Here comes the cons. CaSIR is free to scan and detect malware infection on your computer but to remove it, you’ll have to buy it at the price of USD14.95. I found two keygenerators for CaSIR (Casir.2.2.keygen-SND.zip and casir.2.2.keygen-tsrh.zip) but it doesn’t work. I believe the author of CaSIR has updated the key generation algorithm. For those that can afford it, please donate or purchase CaSIR and support the author because he needs the money to pay for kid’s “Gluten-Free Food”. His little boy Yasseen was born a year ago with a rare genetic disease called “Celiac disease”. When people with celiac disease consume gluten, a protein found in all forms of wheat (including durum, semolina, and spelt), rye, oats, barley and related grain hybrids such as triticale and kamut, the absorptive villi in the small intestine are damaged, preventing the absorption of many important nutrients.
[ Download CaSIR | Buy CaSIR ]
: Copying this article to your website is strictly NOT allowed. However, if you like this article, you can use the HTML code below to directly link to this article.
How to clean Brontok Virus Auto Removal Spy Sheriff Spyware Remove ANY MSN Virus with MSN Virus Removal Software and MSNFix GMER is a Powerful Rootkit Detector and Remover Hide or Remove “Safely Remove Hardware” Tray Icon How To Clean and Remove JambanMu, Alman or Almanahe Virus ICQ 6.0 Build 5352 with Banner-Remover is Out!
Have computer technical problems? Get FREE help from Raymond.CC FORUM
57 Responses for "CaSIR – A Very Effective Stubborn Computer Virus Infection Remover"
this has also worked well for me and i found out about it about 2 motnhs ago when i was frantically searchiing to remove some virus whose name i do not recall. kaspersky foudn it but it wouldntdelte but this software really works! i acutally bought it and it was a great buy! also donated about 5$ <.<~ great software though.
From the same company, there’s another popular thing called RRT (Restriction Remover Tool) which is free & is very handy.
I think you are not supposed to link to that site – i get a warning & then it redirects correctly.
I’ve used these softwares before and their great. RRT, DRT, SRT, PRT and are host of others from the same author. They removed all the remnants of viruses that attacked me. Please buy CASIR. It’s work the $15. I’ve tried the keygens and they don’t work
What are we going to do when the hackers and virus spreaders start exploiting our processors? Then surely
we are doomed…
Raymond – where’s Malwarebytes in your arsenal? I don’t know if it would have helped here, but it frequently removes stuff others don’t.
Anxious to try this. Someone mentioned his RRT – it’s nice, but it may be the single most irritating “buy me” I’ve ever had.
sam
The fact that this software NAGS so much when using it as a demo completely turned me off from purchasing it.
We were first greeted by a “This file doesn’t belong to the site you came from ” message when clicking the download link, followed by the grim “Your IP address has been logged” message.
Why come down on an interested user with an iron fist? Can’t we try the demo without being made to feel like we are being forced to purchase the software? Simply closing the “you need to register” screen sends me to the developers home page, over and over and over again.
This software acts like malware in that regard.
ComboFix often removes many difficult infections as well.
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
You beat me to it… Remove the download link raymond… or relink it to yours
Dear Raymon
As usual, I am speechless when I find an article about one of my programs written by you in your website, I have nothing to say to thank you.
There’s only one comment, please update the [Download CaSIR] link and change it from :
http://en.sergiwa.com/modules/mydownloads/visit.php?cid=2&lid=6
Into:
http://en.sergiwa.com/modules/mydownloads/singlefile.php?cid=2&lid=6
Thank you very much
Issam Sergiwa
CaSIR’s author
@ Dany
I have just made my update
CaSIR now doesn’t “NAG” too much, it does “NAG” only once!
The greeting message has been removed as I have just added Raymond.cc to my trusted sites….
You know there’s tons of web sites linking directly to files and images on my website which consumes my bandwidth seriously, the leach reached a degree that I am not able to pay for more bandwidth so I prevented any site to leech my files, but not Raymond site because he is doing me a HUGE favor by writing an article about my programs in his blog which deserves more than giving him an unlimited leach links.
Raymond didn’t tell my he’s going to link to my site other wise I would had put his site to the trusted zone before you noticed that greeting message!
Hope this helps
iSergiwa
by the way, there is an Arabic line at the program screen, right at the end, that says if you use this one you agree not to crack it or use a keygen , ….. thought to let u know
thanks anyway Raymond
Never thought You would do this Raymond.This is classified as a Rogue antivirus program by most of the top AVs. Infact Avira blocks the download saying the installer itself is a trojan!!!Infect myself to get rid of another infection?No thanks.I don’t think so.
This is a rip-off company! After going through the wringer to get the activation code, I could not find the product on my computer. I e-mailed them, and asked for my money back. So far they have not answered me.
@Me: I’ve scanned CaSIR with 33 types of antivirus and only 4 AVs detected it as “suspicious file”. You can take a look at the report here.
http://www.virustotal.com/analisis/cf9787e3b8de89661a6ce46dcc9e25f0
CaSIR is definitely safe and I can guarantee that it is a false positive by Avira. I wouldn’t write about rogue software that would tarnish my website’s reputation.
@Issam: Great job for making CaSIR not to nag so much. By the way, drop me an email, I would like to discuss something with you.
Hi raymond,
No offense at my previous post mate.I see that at virustotal, avira doesn’t detect it as a threat.When trying to download from the casir link you posted,I don’t get a flag either.
But,when trying to download from download.com,I get the following warning
[IMG]http://i33.tinypic.com/1zvcp61.png[/IMG]
You may want to check this out,not for the name of your blog,but for the trust we have in you.
Just from virustotal.
http://www.virustotal.com/analisis/35532761e4f25632caa2bef7d67e980b
what say?
Loaded CaSIR demo. Found two trojans. Purchased CaSIR and registered. CaSIR removed the trojans. Ran CaSIR again and it found no trojans but “fixed security holes and will do so whenever run”. Immediately afterward ALL programs stopped working. All startup programs (Zonealarm, Avira AntiVir, etc) will not load. Quickstart icons associations went bad. Desktop icons went bad. XP asks what file to use to open the programs, then asks to run the programs, then faults back to the ‘which program do you want to use”. Looks to me that CaSIR fixed a ’security hole’ and removed all program associations. Anybody have an idea how to undo this?
What a great deal!!! a $99.95 program for only $14.95. This virus blocked regedit, Taskmgr and restore among ther things. It blocked every other virus checker and turned off anything that might allow me to download any program that might help me. Ithad a timer that turned off internet explorer and firefox. sergiwa was the only program that overcame the blockage and attacked the virus. Unfortunately, the virus was repetitive and kept coming back. Sergiwa sent me a program that logged all the viruses actions but the virus blocked the return log. I sent the log back to sergiwa on another computer and he built a program and updated his program. VIRUS DEFEATED!!!
I KNOW OF NO OTHER COMPANY THAT WOULD STICK WITH A CUSTOMER UNTIL THE PROBLEM WAS SOLVED LIKE MR. SERGIWA DID WITH ME.
I wonder how well Casir would work on the Vundo malware. I found this one very hard to remove from my wife\’s computer. Even the VundoFix tool did not help.
In the end it was ComboFix run in safe mode that helped remove this nasty malware.
@me
The link Raymond posted is on my website which means that I can update anything or fix any bug immediately, but the one you downloaded CaSIR from is not mine, and I’m not responsible for it.
With every activation email I say to my clients:
Please note that this activation code is for CaSIR v2.2 that had been downloaded from Sergiwa.com and will not work with the other versions from other websites.
Nevertheless, the copy you download from CNET is clean too but I do not recommend it because it was protected with ACProtect; an Anticrack software, it uses many poly morphing and protecting routines to protect CaSIR from being cracked but it obviously is making a bad job and that’s why I stopped using it.
Also, you may noticed that your virustotal link shows that only 9 AVs (mostly nobody Avs) detects CaSIR as malicious and that is for the reasons I mentioned above (the protector, the packer…) because CNET too wouldn’t accept a rogue software that would tarnish their website’s reputation.
You may ask me why I didn’t update the CNET version of CaSIR too? actually I did, but they don’t do the update immediately, I will need to wait for about 30 days to got CaSIR updated on CNET too!
I know your type of users “Me”, all you want is to protect users from deception, but don’t worry, there’s Kaspersky, McAfee, Symantec, Raymond, and me who are all united to protect you and all the users
Thank you very much for your comments
@Wutziz
This is because you updated CaSIR database from Sergiwa.com but you didn’t update CaSIR executable you download from CNET, you should contact me and I’ll fix your problem in seconds!
However, for every one who didn’t read the instructions carefully and had the file association problem after running CaSIR, please do the following..
Copy and paste the following reg script (without the dashs lines) in a new text file named: fixasc.reg and doubleclick it
———————————————–
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\batfile\shell\open\command]
@=”\”%1\” %*”
[HKEY_CLASSES_ROOT\cmdfile\shell\open\command]
@=”\”%1\” %*”
[HKEY_CLASSES_ROOT\comfile\shell\open\command]
@=”\”%1\” %*”
[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@=”\”%1\” %*”
[HKEY_CLASSES_ROOT\piffile\shell\open\command]
@=”\”%1\” %*”
———————————————————
After that, please delete any previous copies of CaSIR and go download it again from Sergiwa.com, If you downloaded CaSIR from CNET, please Please do *not* update it’s databse, instead, go download the whole software (the executable & the database) from the link Raymond posted above…
http://en.sergiwa.com/modules/mydownloads/singlefile.php?cid=2&lid=6
This will remain until the CNET team publish and synchronize their version with Sergiwa.com version.
Thank you
@Bob
It was my obligation to serve you even if I stayed awake day and night until you got rid of that nasty virus, I thank you very much for your supporting words
THANK YOU ALL
Hi Issam,
That explains the confusion I had.Many thanks for explaining that.Keep up the good gob!
I downloaded the file directly from this link:
http://en.sergiwa.com/modules/mydownloads/singlefile.php?cid=2&lid=6
I first ran it in the trial version and it found \”6\” threats so I went back and PAID for CaSIR. I entered my serial number several times and on each attempt I kept getting told it was THE WRONG NUMBER !!! What is this a rip off???
I then did what \”trenless \” said and downloaded \”ComboFix\”
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
This worked wonders and Guess What?? It picked up \”31\” different threats…a heck of a lot more than CaSIR did!! And it was FREE…Thanks \”trendless\”
And I\’m STILL waiting to hear from Sergiwa for a REFUND!!!
Mr. Sergiwa
I´m all for believing that your program does what you say it does but come on….If I run your demo it says that Security Center Corrupted Settings and Default startup folder infection and demands that I open your homepage again and again and again until I have to start Task Manager to close the _amn thing. There is no clue to what the infection is just that it\’s infected who is to say this is not a false positive it wouldn\’t be the first time and this constant nag to buy. I\’m all for buying programs that I need no question about that but your demo might be a little more simple to use and a little more informative. Best wishes.
PLEASE let me update my post about the trouble I had with CaSIR. Issam was very quick to fix my issue as he states above in his comments. Of COURSE I crapped a big brick when my system stopped working BUT that was a natural reaction and I DIDN\’T panic. I posted here looking for a fix and I also emailed the author who very quickly jumped on the issue. I have nothing but PRAISE for a $15 program that will detect and remove TWO trojans that Avira AntiVir free and AdAware missed. The problem was caused by doing a couple of things out of order that COULD be done out of order. Issam immediately changed it so it wouldn\’t happen again. I intend to load CaSIR on all of my machines and use it regularly. I will also recommend CaSIR to anyone I help with computer issues. Happy endings!
@Wutziz,detected 2 trojans?LOL mate.If you do a scan with 50%of antispys,which are trial,it will of couse detect “trojans”.Get a life.That’s the way they make you pay.This Guy of course is “still getting there”,keeping on solving issues as they occur with poor people who paid/used trial.No thanks.There are reputed softs who know what they are doing.(Maybe Raymond is getting a cut-off from the sales?)Just kidding.(I know Raymond won’t allow this post.He ain’t Jesus Christ)
Just to let you know, the keygen works. You have to paste the ID that pops up as your name, and then copy the new generated key as the Authorization Key.
@Raymond
>> Ran HijackThis but couldn’t find anything suspicious
I feel that HijackThis is falling behind as it is not developed since long time.
I remember there is video in Sysinternal site of Mark Russinovich talking about Autoruns \”competition\” with HT who is better.
In the last year I think Autoruns is better. It is not easy to use like Hijackthis and is more for experts, but much better.
I use HT for simple cases for quick fix.
Recently a maleware infection of \\\”Vista Antivirus 2008\\\” and you could see location of 2 trojan files in Autoruns but not in HT.
@Che lee: No I am not getting anything from CaSIR. Just because this tool is shareware and you guys immediately think that I might be getting a cut from the sales? Then you’re wrong. I don’t get a single cent from it and CaSIR has helped me removed a virus that wasn’t easy to remove. So I am just sharing with you on this tool. Like it, buy it. Don’t like it, forget it. No one force you to buy.
@Mary
God you’re the most rush person I have ever met, you wrote this entry before you even wait for two seconds until you receive my reply to your email, now after you read my email you KNOW why you got the “SORRY WRONG NUMBER” message? yes dear, it’s because my name is not “the Eye of Sauron” and your CaSIR ID is not the “Lord of the Rings”, CaSIR ID is calculated based on your hardware and you didn’t send me your CaSIR ID as instructed millions of times so I couldn’t send you the correct key, you were using the wrong number, it was the serial number of the purchasing invoice. After receiving your CaSIR ID I immediately sent you your CORRECT key but you didn’t even reply to thank me, neither here, nor by email, instead you jumped here and told the whole world that you requested a refund just because you didn’t listen, Mary.. you were NOT listening!
@IceJoki
Believe me sir, if CaSIR told you that you have “Security Center Corrupted Settings” or “Default startup folder infection” then it’s TRUE, because the AVs remove the malware bodies but they don’t remove the malware lefovers and that’s why CaSIR is different, if you happened to be infected by a virus that changes your default startup folder to run it’s bodies instead of your normal programs the AV would remove only the virus bodies but wouldn’t remove what the virus changed, thus, a virus after a virus until you end up with your computer fed of malware settings, thus, the corrupted security center settings may be dangerous because it may lead to your being uncovered to future infections!
Unlike the AVs, CaSIR deals with a virus as the following…
Kills the active parts of the virus.
Bury the virus bodies after killing it.
Removes the virus settings it added to your system.
Hope I was more informative,thank you for your comment, it was a real feed back.
@Che lee
You know that CaSIR doesn’t use the famous FUD term (Fear, Uncertainly, Doubt), CaSIR is honest and it’s not one of those “50%” of antispys that detect tons of malware on your system and force you to buy when your are free of malware. If you are 100% sure that your pc is free of malware go download CaSIR and give it a try, it will NOT detect any thing!
Raymond is NOT getting anything from CaSIR, simply because of two reasons:
1. There are tons of people like “DimSum” who instructs people and teaches them how to use keygen and cracks to steal the others money, and that’s why CaSIR sells not more than few bucks per month!
2. Raymond is far far away from being that cheap, he’s the most sophisticated and honest guy I have ever met, he didn’t even ask my permission to write his article about CaSIR, do you know why? he didn’t do that just because he was afraid I would think he is asking my permission to “indirectly” ask for a cut-off. Instead, he asked me why not making CaSIR freeware, but I told him that if I made it freeware, my little boy Yasseen would starve to death because the few dollars I got from CaSIR every months are dedicated to feed Yasseen!
Thank you, and thanks to every one for reading and being patient
Issam Sergiwa
CaSIR’s author
ReHi Mr. Sergiwa
Thanks for your informative reply NOW I know a little more about this ever increasing problem of computer infections and to @Che lee remarks I think they tell all you want to know about the person (very cheap shot).Thanks again.
I took a chance on this program and bought it, ran it and too my knowledge my computer is clean. I had a little problem getting the right activation code in which was resolved in a few minutes by the people in the sales department so if nothing else they a A+ grade for service and hopefully this is the beginning of long and good relationship. Thanks Mr. Sergiwa and hopefully your son is in good health.
IceJoki
Hello all,
Let me tell you about my experience with CaSIR. As a new thing on the web I was very excited to give it a try especially after the first reviews from the warez sites. I remember having the same problem as Ray BUT only after installing this soft! The problem I removed quickly and painlessly by deleting some infections with Ad-Adware SE NOT 2007! then erase all the internet files stored on my comp (e.g. catche, cookies, index.dat etc.) and eventually uninstalled the software. The problem was gone, so was CaSIR. Reading all those praising comments I will give it another try ALTHOUGH I know my computer is clean and a reason for a preinstall would be more than welcome for me ^^ I start cleaning like hell and eventually learn a lot of new stuff with each new infection.
So I will give it a try BUT would never buy it if no proper description of the problems found is present!
Nothing personal and the whole life story is quite touching BUT 15$ isn’t all affordable for everyone (and I’m not being cheap here).
Best of luck,
Rage
I bought the software $15. Run it on 2 machines. Vista and XP Pro.
Both machines are NOW DEAD!
Be Careful with this software and the company. Something is not right about them. I will let you know when I have more info
Jo
Dear Issam and Raymond,
Don’t be disheartened by the people who spit venom on you.
@Mr.Lee,it is so wrong on your part to accuse people without any proof.Shame on you.
@caSIR,I tried the trial version,but I have one suggestion.It nags too much.Looks like it found some infection,but I can’t read it.The register window props up as I try to scroll down.Can you fix it?Also,do you plan to have a realtime shield to caSIR anytime soon?That will be a great product!!!
Regards,
Joe
Sorry for double post.@Issam,I forgot to tell you something,it tells me infection with windows firewall???If the trial program can specify what type of infection, that will be great.Say,the problem is that windows firewall is disabled,because of my Zonealarm,I won’t bother.So can you please make the program specify what it means.Because as u see,not everyone has money to pay,just to find out that it was the firewall disabled.You know what I mean?Again,it is your program,you decide.I can only suggest,because I haven’t paid you:yet!
Guess I will wait,since the program is not being specific about the infection.Thanks to jo.I am sure I am clean,so i am just curious what it found.Unless it tells me what it is,I guess I would not pay.
@IceJoki
Thank you for buying and the supporting words, thank you for the A+ grade, this is more what I really deserve, it\’s just because you\’re nice, honest, and you followed the support team instructions.
@jo
Due to my record, there\’s only one registered client who had such a problem with two XP & Vista pcs after using CaSIR and it must be you, I\’m not going to provide your real identity because I respect my clients privacy!
You didn\’t tell how \”Both machines are NOW DEAD!\”, they are not dead dear, it\’s only the file association problem mentioned above (entry 21) and it happened because you didn\’t follow the instructions, you didn\’t tell how long I stayed with you for two continuous days and nights up to this very moment without getting a rest just to fix your your own mistake, you didn\’t tell that you emailed me back and confirmed that my instructions worked with Vista pc and it\’s now working normally, you didn\’t tell that you did another mistake by running CaSIR in the XP pc with file association problem in safe mode when it\’s mentioned in the software instructions that not to run CaSIR in safe mode, you didn\’t tell that windows xp pc now passed the BSD and I\’m still with you trying to fix the other issues caused by your being not listening to my instructions!
God jo I\’m killing my self trying to help you for mistakes you did I have nothing to do with but you are not cooperating, instead, you come here and say that there\’s something not right with me? THANK YOU JO, THANK YOU VERY MUCH.
@Joe,
If you take a look at the \”Top incoming search terms for this post\” below you will know why I\’m disheartened, you can see that 99% of people who come to this post are searching for cracks, serials, keygens of CaSIR, this is really frustrating for any developer, it REALLY is.
Well, as I said before, I did my update and CaSIR now doesn\’t nag too much, it shows the register nag screen only once, maybe you still using the CNET version? if you are, please cease using it as it\’s very old, and go download Sergiwa.com version. However, you still can see what was detected if you open the log file CaSIR generates, please locate the report file named casirrpt.txt in the same folder where CaSIR22.exe is and see the complete history of the detections.
A real time protection is on my future plans, please wish me the best.
CaSIR is particularly designed for windows XP and Vista OSs and has no integration with other security software that run under windows, if it detected your Windows firewall as disabled then it\’s really disabled (please note that CaSIR says \”WINDOWS FIREWALL DISABLED\” not \”ZoneAlarm Firewall is disabled\” so it doesn\’t cheat you), it doesn\’t matter who disabled it, if ZoneAlarm or any other malicious program disabled your windows firewall then CaSIR will inform you and you decide, thus, if you try to install Kaspersky firewall over ZoneAlarm firewall, Kaspersky will inform you that your Windows fire wall is disabled and ask you if you need to use Kaspersky firewall instead, however, if you are currently using ZoneAlarm then it\’s MUST be ZoneAlarm who disabled it and used it\’s own firewall, now you decide whether you want to keep ZA firewall, or you need your windows firewall back. My advice? well, in your case Joe, if CaSIR detected only one infection (Windows firewall disabled infection) and you are using ZA, then I don\’t advice you to buy CaSIR because your computer is clean.
@all readers
The problem with file association happens when a user download CaSIR from CNET and then press the UPDATE button to download the updates from Sergiwa.com, as I can\’t inform all users about that (users who use pirated versions of CaSIR), I have disabled the update server on my website to prevent future conflicts, this will remain active until CNET update their version of CaSIR not later than Aug 5th 2008, this is very important to me, because even if they steal Yasseen\’s money by using pirated versions of CaSIR, I can\’t cause problems to their computers, it\’s my father who taught me that.
Thank you all for reading and being patient
I am sure the developer is not interested to expose to ALL of you the readers the support which he provide by emails.
I will not get personal with the developer as it is not meet my professional standards or the needs of a client to receive FIRST CLASS product with FIRST CLASS support.
We all computer users want to enjoy our computers and not to become victims
I hope you all agree and support
ما يميز برنامج كاسر CaSIR أنة يكسر عجز البرامج الكبيرة بحذفة لأقوى أنواع الفيروسات .
@jo
I agree with every word you said (if I really understood what you said correctly as my English is not that good) except one thing, you are not my victim simply because I have no victims, an I shouldn’t have any, you are my valuable customer.
@usama
Thank you for the supporting words though they are more than what I deserve, but youyou should write them in English dear
any way, here’s what Usama said:
The most great thing about CaSIR is that it removes the most stubborn viruses that no other well-known AVs can remove
Thank you
What a complete and utter waste of programming.
Can you explain all the definitions with any detail as to what they actually cover?
Why are there so many multiple entries in the target lists?
I’ve never seen so many supposed targets aimed at disabling other security apps. Yes, this is fairly common, but not really pervasive.
The log of found items on my system give me no details what so ever. So what am I removing or fixing? Am I supposed to give you money based on the log provided?
Anyone purchasing this is nuts IMHO.
Lets try this again, see if it “sticks’
What a complete and utter waste of programming.
Can you explain all the definitions with any detail as to what they actually cover?
Why are there so many multiple entries in the target lists? I’ve never seen so many supposed targets aimed at disabling other security apps. Yes, this is fairly common, but not really pervasive.
The log of found items on my system give me no details what so ever. So what am I removing or fixing? Am I supposed to give you money based on the log provided?
Anyone purchasing this is nuts IMHO.
I don’t know you but I downloaded CaSIR last weak and used it and until the app shutdown it opened me up 4 Internet explorer browser windows. I hate that. And it detected a trojan which is well known but kaspersky didn’t recognise it. Could it be a false positive?
Dear Issam,
Thank you very much for the advice.Yes,I was using an old version.Just one question.Once I buy it,are the updates gonna be free for life?Or for an year?And if you happen to integrate a realtime shield later,would you provide a free upgrade?
Thanks friend.
@Jo (Entry 39)
I agree with every word you said (If I have understood it correctly as my English is not that good) except only one thing, you are not my victim, simply because I have no victims and I shouldn’t have any!
Thank you
@usama(Entry 40)
Thank you for the supporting words, they are more than what I really deserve, However, you should write them in English.
Usama says that the most great thing about CaSIR is it’s being able to remove the most stubborn viruses that all the well-known AVs can’t remove.
Thank you
@Kevin (Entry 43)
You are using CNET version, please use Raymond link above.
CaSIR is not an ANTIVIRUS, I said that many times, the Trojan CaSIR detected in your computer is not necessary the Trojan body, it may be one of the Trojan’s leftovers Kaspersky doesn’t deal with!
How to know what leftover it is? I’ll answer you:
When CaSIR find an infection on your computer, it shows up the infection in the following way :
XXX – YYY
XXX: is the type of the infection found
YYY: is the infection itself
XXX has 9 different keywords
RNP : Running Process
GFL : Group of Files
SFL : Single File
GFD : Group of Folders
SFD : Single Folder
RKM : Registry Key to be Modified
RKD : Registry Key to be Deleted
RKA : Registry Key to be Added
RSO: Regular System Optimization
Thank you for your feedback
@Joe (Entry 44)
Yes, the updates are FREE for life.
And of course no, developing the real time protection feature needs much much effort than a developing a removal software, but it would be discounts there for upgrading, just wish me the best dear.
Thank you
@TeMerc (Entry 41,42)
I intentionally left you to the end of my entry because I don’t usually reply to persons like you, but I found that I must reply just to explain the technical part of your entry (I’ll ignore your first sarcastic statement about the waste of programming and your not being respecting all the gentlemen here and there who purchased CaSIR as if they are all nuts and you are the only rational and wise man in the world).
>Can you explain all the definitions with any detail as to what they actually cover?
What definitions? Can you be more specific? What did CaSIR detect in your computer?
Email-Worm.Win32.VB.by?
It’s a well known worm once it infects you computer, it cannot be disinfected by any of the well known AV simply because it DISABLES more than 80 different Avs.
Illegitimate system service?
Those are running services and processes that have the same names and properties of Microsoft Windows services and processes but they are fake (not legitimate), they usually named svchost.exe, lsass.exe… Malware authors use this trick to fool the normal users and make them think they are not malicious, malware authors also take the advantage of the bug I discovered in Windows Task Manager, that is when you rename say Calc.exe (Windows calculator) to say svchost.exe , Windows Task Manager wont be able to kill it and it (foolishly) tells you that this is a system service and cannot be killed or it’s dangerous to be killed, so you can see that Windows itself helps the virus process in it’s being hard to be killed! CaSIR detects and removes such infections.
Generic Malicious Script?
Those are malicious .inf/vbs/wsh/htt..etc files that run the malicious parts of the virus (usually .exe/.com/.cmd) when you double clikc on one of your drives (C:, D:…)
Disabled Kaspersky Products Infection?
This means that if CaSIR detects this infection in your computer then you will NEVER be able to RUN/INSTALL/REMOVE/REINSTALL any of Kaspersky Lab products that run under Windows.
Security Center Corrupted Settings?
Explained in Entry # 30
Default startup folder infection?
Explained in Entry # 30
Do you still need more explanations?
>Why are there so many multiple entries in the target lists?
First, obviously, you misunderstand the nature of CaSIR targets listed in the Targets List, those are not individual malicious objects, those are the different portions or the payload of malicious objects, means, if CaSIR says that it detects a “Default startup folder infection?” then it means that CaSIR can remove tons of malicious objects just because they share the same payload, CaSIR now has 155 targets, if you calculated how many malicious objects that share the same 155 payload you will find out that CaSIR is able to remove hundreds of thousands of malicious objects.
Second, the multiple entries in CaSIR targets list means that CaSIR can disinfect your computer from all the malicious objects that target different security solutions of the same company, or the different portions of the same security solution of the same company. Lets take Kaspersky as an example, I (if I would be a smart malware author) can disable the real protection of Kaspersky 7.0 not by deleting or corrupting or restricting avp.exe (I wouldn’t kill Kaspersky using this stupid way), I would let avp.exe runs normally (both GUI & NT Service) but I would alter some other portions of Kaspersky 7.0 that are responsible for the real time protection, so a normal user wouldn’t notice that Kaspersky real protection is dead (though the Kaspersky GUI says it’s alive) , s/he would think that Kaspersky is urning normally but in fact it’s only a red icon on the system tray because I disabled the active feature of it. Those portions appear as “multiple entries” in CaSIR list because they belong to the same company and because I wouldn’t teach any new malware author how to do this trick to disable Kaspersky or any other security software!
By the way, I read what you wrote in your own website, it made me disgusting and I’m not talking about the technical lies about CaSIR you and your two friends said to each others, I’m talking about this line of you in your post of your website:
>I won’t get into the whole ‘please buy my app cuz my kid is sick’ routine.
That was the most disgusting line, first, because you show how you “care” about a father of a sick little boy feelings, I pray to God that you will never have a son with a disease like mine, and second because it’s a big lie, look what my friend Adam wrote about me and I linked to the main page of my website with a big banner:
Issam worked hard for life. He did not beg any one to donate for him, nor did he ask for alms for his kid. He did not beg any one to use his programs. All what he wants from you is to help him by not using pirated versions of his programs.
PLEAS STOP USING PIRATED VERSIONS OF ISSAM’S PROGRAMS!
If it is not for the sake of him, then stop it for the sake of Yasseen.
It’s Issam’s son, but it could be yours!!!
Thank you for understanding.
And TeMerc, thank you for being human!
Thank you and thank you all for reading and being patient
@ Issam:
If you read my post you would have seen the log I posted , so go back and have another look.
What 4 items are ‘disabled in the firewall’, and why would I blindly allow some program to change them without knowing just what was being changed? Or do I get those details once I’ve given you some $$$?
And I stand by my assessment of your product.
In so far as any tragedy befalling me, been there done that, living it as we speak, but you won’t find any mention beyond a few words, nor would I allow anyone to post such details on my site or anywhere if I could.
It’s irrelevant to online activities AFAIC. If I want pity, last place I’m gonna look for it is on the Net.
Everyone has their own way of doing business and providing people support….good luck with yours, but rest assured I’ll be sure to tell anyone to move to something I feel better suits their needs.
I got asked, and i gave my opinion.
#46: I don’t think you understand really what the people are complaining about.
1/ Your trial stuff is a horrible nagware, people hate such stuff. There is a long history of rogue “antimalware” applications that work by annoying people with stupid pop-ups false, exaggerated claims about computer infection.
2/ Worse yet, your application provides ZERO explanation and NO description of a problem. If you claim there’s something infected, you need to SHOW people WHAT exactly is infected and EXPLAIN why is this a problem. Do not say “Windows Firewall Infection”, but tell people what is the actual problem with that and EXPLAIN what actions will be taken to rectify it. Ditto for all other issues your application finds.
A trial version caSIR scan reveals the following infection in my PC.
RKM – Disabled Show Hidden Files/Folders restriction
Buy to remove infection!
RKM – Disabled Show System Files/Folders restriction
Buy to remove infection!
RKM – Disabled Show System Files/Folders restriction
Buy to remove infection!
RKM – Disabled File Extension Names restriction
Buy to remove infection!
RKD – Default startup folder infection
Buy to remove infection!
RKD – W32/SillyFDC-G
Buy to remove infection!
RKA – Security Center Corrupted Settings
Buy to remove infection!
i understood most of it.But a SillyFDC-G infection?Avira premium,SPYWARE DOCTOR,spybot,Eset Online scanner and a Bitdefender Online scan finds nothing.But as Issam said,it couldn’t be remnants of a previous nfection.Because this is a single-user PC and I don’t use removable discs on it usually.Thst is something amazing.Just don’t know it is true or not.
Issue with the software got resolved . 2 computers are back to work after few days delay. I want from the developer to focus more on developing good software and provide great customer service. As a customer his personal life no my interest. GOOD LUCK WITH THIS SOFTWARE AND IF YOU NEED ANY HELP PLEASE FEEL FREE TO CONTACT US!
@JAMES
RKD – W32/SillyFDC-G
Am I supposed to give more details for every virus CaSIR detect? you can find more information about W32/SillyFDC-G worm if you just google it, even Kaspersky and other big Avs don’t give details about a detection, just the name of the virus and the path of the file but when you go search their website for the infection you usually face the “No more details about this threat”
Anyway, one of the activities this worm do is to put itself in startup with two registry entries, you can see that CaSIR reported this infection as RKD, if you follow the legend in CaSIR help page, you will see that it’s a “R-egistry K-ey to be D-eleted”, it’s one of of the two leftovers of W32/SillyFDC-G your AV doesn’t deal with, obvious, your AV had removed the worm body other wise CaSIR would report it as SFL (Single File to be deleted) too, your AV (like all AVs) do not remove the worm registry entry, CaSIR does!
Your log doesn’t seem to be that dangerous, If you have some experience with windows registry you can manage to remove those infections manually (but please be careful, backup your registry database before altering any thing), but if you are too lazy to do so, or you don’t know how to do so, you can purchase CaSIR and he will take care of them for you, that’s it.
Thank you dear sir very much for your real feedback
@Doktor Notor
#1
Again, and for the millionth time, you are using CNET version of CaSIR, I did my update days ago and CaSIR now (Sergiwa.com version) doesn’t give more than only one pop up screen to advice you to buy it, the reason why CaSIR opens an IE window is first to take you to the purchasing page, and second to at least give my website a hit if the you decided not to buy so I can then do my statistics and see how many users used the demo version of CaSIR, not only how many of them downloaded it from my website because I have a download counter of CaSIR on my website. The only ones I can’t know if they are using CaSIR are the ones who purchased CaSIR, the PIRATES, and the users who use PIRATED versions of CaSIR, because once you purchase (or crack) CaSIR, no pop ups or IE windows appear at all, isn’t that a fair enough?
#2
Please kindly read the explanation in my reply to TeMerc bellow, hope this will help
Thank you very much for your sincere feedback
@TeMerc
Again, if you just hadn’t included a technical question on your post I wouldn’t comment as (pardon me) I don’t feel ok when I talk with you and you KNOW why!
You still saying that I want pity? Have I ever asked you (or any one else) to donate for me? (you do, I can see that “make a donate” button on top of your home page) Have I ever beg you to buy my program? Have I ever ask you for alms for my kid? NO SIR, it’s only one thing as stated clearly earlier but you don’t seem to want to get it…
PLEASE DO NOT USE PIRATED VERSIONS OF MY PROGRAMS
It’s my RIGHT to ask you such a thing, you do NOT pity me when you do what I’m asking you, you have to, it’s the morality, the law, the religion, the humanity and all what make us humans makes you do so, and not the pity!
Yes I saw that log, but I thought it wasn’t yours (as the username says), there are three persons in there, are they all YOU with different usernames? I’m confused!
Anyway, as an MVP, you should tell what “Windows Firewall Disabled Infection” means, and as your Microsoft profile says (Your current computing activities focus primarily on malware) you should at least know how could a malicious object disable Windows Firewall or how to pass malicious files say through Windows Update? But I don’t want you to tell as there are many ways of disabling Windows Firewall. CaSIR is not for MVPs sir, it’s for normal users, engineers, architects, doctors, dentists, lawyers..etc who have no knowledge (or no time to have the knowledge) about computer science, set aside the most complicated branch of it; Malware, all they need is a program that can resolve their problem by only one single click! they should stick to the known application? Yes, they sometimes got cheated by new cheap developers? yes, but sir, not all new developers are that cheap!
As an MVP, you should know that a registry script (I’m not going to mention it and I guess you know why) of only three lines could disable your windows firewall in few milliseconds and allows malicious files to pass through windows update, your log shows that such a registry script (or an exe file) had previously applied such a script in your system registry, CaSIR doesn’t care who applied that script (either because your AV removed the script body, or your AV itself is the one that applied it to use it’s one firewall instead), CaSIR only informs you that the script had been applied and it’s still applied and you have to fix this problem and restore the registry entries to their default values, your AV doesn’t care to do that for you, CaSIR does!
So you got asked and you gave your opinion? okay, I’ll tell you what you (and your two friends if there are any) did and wrote on your own website and other websites which was far far away from being “only giving a honest opinion”
The topic started by a user who has a website that is devoted to promoting freeware and asked your opinion about CaSIR and you said that you didn’t read much into it yet but you will.
Another user came after that and stated this:
“The trial is a detect but not remove program. You have to purchase it to remove infections so it doesn’t class as freeware.“
At this point, and after this clear, objective and honest statement, the first person (the freeware guy) got his answer because I guess he just wanted to know whether CaSIR is freeware or not (as an owner of a website that is devoted to promoting freeware).
But you came (or one of your friends) and said: “That’s one strike against this thing.”
Oh God, What a hostile and irrational start!!! I’ve just known that if a program (any program) is not freeware then it is a strike against it!!!
lets see what was the “second strike”… you said:
“See any sort of details as to where exactly these infections are? Registry keys, files, folders?Hello?” and you posted the following log:
RKA – Disabled Windows Firewall Infection
Buy to remove infection!
RKA – Disabled Windows Firewall Infection
Buy to remove infection!
RKA – Disabled Windows Firewall Infection
Buy to remove infection!
RKM – Disabled Show System Files/Folders restriction
Buy to remove infection!
RKM – Disabled Show System Files/Folders restriction
Buy to remove infection!
RKD – Default startup folder infection
Buy to remove infection!
SFL – Trojan.Win32.Small.wv
Buy to remove infection!
RKM – Worm.Win32.AutoRun.dkk (Ahsan Virus)
Buy to remove infection!
RKA – Security Center Corrupted Settings
Buy to remove infection!
RKA – Security Center Corrupted Settings
Buy to remove infection!
You forgot to take a minute or two to read the software help page to know that…
RNP means Running Process
GFL means Group of Files
SFL means Single File
GFD means Group of Folders
SFD means Single Folder
RKM means Registry Key to be Modified
RKD means Registry Key to be Deleted
RKA means Registry Key to be Added
RSO means Regular System Optimization
Now you may ask me why you don’t see more details as to WHERE exactly these infections are? Ok I’ will answer you…
I intentionally hide such details for many reasons:
1. To prevent the other new developers from harvesting my own work and include them in their products (this happened to me many many times in the past without my permissions).
2. To prevent the sick people who name themselves “malware authors” from learning how to do the trick, because if you taught a malware author what and how to DISINFECT, he can easily reverse the process and use it to INFECT.
3. Normal users (whom CaSIR is intended for) don’t usually like programs that give too much details, they like the one who fix their problems with only one click and then shut up, they don’t even have time to read all that details, if they have, they would fix their problems manually why purchasing CaSIR!!!
Now lets move to the “third strike”, you said:
“Third strike, not much of a very large target list now is there“
This has been explained to you before, but you don’t seem to want to get it, those 155 targets are NOT how many malicious object CaSIR can remove, in fact, every one single target of them means thousands of malicious objects
I’ll give you an example: The “illegitimate System service Infection”, it’s counted by you as only one target right? No sir, I want to ask you, how many malicious objects in the wild use the trick of naming itself svchost.exe? of course thousands of them may be more, now take lsass.exe, services.exe, winlogon.exe, csrss.exe, smss.exe, inetinfo.exe, spoolsv.exe…..
CaSIR database has only 155 records but Kaspersky database has 1,001,351 records, does that mean that Kaspersky removes much much more than what CaSIR does? Of course yes, but not that too much you imagine, Kaspersky database includes thousands of records for malicious objects whose names are svchost.exe, lsass.exe, services.exe, winlogon.exe, csrss.exe, smss.exe, inetinfo.exe, spoolsv.exe… CaSIR briefs that huge number by only ONE TARGET! That is “illegitimate System service Infection” And that’s what makes CaSIR different!
Kaspersky uses the classic binary signature method, CaSIR uses the file names method beside the classic binary signature method (only when necessary), this gives CaSIR a huge advantage over Kaspersky in the scan speed, in few seconds CaSIR can detect any malicious object of these thousands because it goes DIRECTLY to them, Kaspersky needs hours to full scan your computer to detect them.
I’ll give you a practical example, lets take a NEW virus that is not included neither in Kaspersky database nor in CaSIR database, and lets say that the virus puts itself on system startup and creates it’s body in C:\whatever\ whatever\whatever\svchost.exe and it’s running and currently active.
Now do a full scan with Kasperksy, wait for bloody hours (depends on how huge your file system is) and then what? Oops! nothing detected!
Now run CaSIR, wait for two or three seconds (no matter how huge your file system is) and then what? BINGO! illegitimate System service Infection DETECTED, and REMOVED!
Now suppose that this virus is one of the nasty malware type that disable tens of Avs, Kaspersky will say buh-bye, and when you try to reinstall it, Oops! ERRORS, ERRORS!
Now run CaSIR, wait for a second or two, restart your computer and then try to install Kaspersky, BINGO!, the installation process started normally!
Lets now move to the “forth strike”, you (or one of your professional friends) said:
—————————–
Wtf are:
Disabled CCleaner Infection
Disabled RegClean Product Infection
Disabled SkyNet FireWall Infection<<<from Terminator movie?
Since when have infections begun to target utilities like this? I’ve not seen one.
SkyNet FireWall is from Terminator movie? Where do Jackie Chan come from then? What a low level of objectivity you have and and what a new type of professionals you are! Ok Forget the professional thing, couldn’t you just like any normal user google Sky NET Personal Firewall? To at least be honest and take your time to test, you would came up with this link:
http://www.matousec.com/projects/firewall-challenge/product-list.php
Scroll down or search for sky.net, you will find what I’m talking about!!! go download it and give it a try, it may be helpful, but oh, my mistake, it’s a Chinese product and I guess you don’t speak a word of Chinese, so leave it alone!
Have you ever heard about a worm called Win32.delf.cc and what it does to your computer? I guess not, this worm when infects your computer you will NEVER be able to RUN/INSTALL/REMOVE/REINSTALL any of more than 80 different security process that belong to the most well-known Avs (Symantec, Kasperksy, McAfee….) and other security tools and utilities like CCleaner, RegClean, HijackThis…. this worm is very old, and I wonder how come you don’t know it disables Ccleaner and RegClean and other utilities like this, all you did is to say: “I’ve not seen one!!!”, really? Ok I’ll make you meet one, I have that worm isolated here in my lap pc, if you want a copy of it for your tests just let me know, but be aware, this is very nasty one, it will even prevent you from booting in safe mode because once you attempt to do so the ugly face of the BSD will shows up. So if you want to remove it manually in safe mode I advice you not to do so, you will have nothing to do but booting in normal mode and looking at the worm stealing your private data and submits them to the worm author! you have nothing to do but to unplug yourself from the net until you find a solution, do you know what’s the solution, it is not one of that well-known Avs because the worm wont let you install any of them! YES sir, the solution is in the top of this page of raymond.cc; CaSIR! In only one minute your computer will be 100% free of this nasty!
Lets now move to the Fifth strike, you said:
“Take a look at some of the comments at Rays blog, Most are not very good.”
Most? Are you sure? Is that the honesty of the MVP? I don’t think so!
Lets move to the sixth strike, you (or one of your friends) said:
“It’s getting added to hpHosts with the FSA classification.”
Is this your way of judging any new program? you add the website of it’s developer to hpHosts thing with the FSA classification before even contact him to ask for more details? (forget that you’re too professionals to contact a fresh developer like me), before you even read the software instructions and help page? forget that, before you even think you might be dealing with something you have no idea about, Is that your professionalism?
Do you think that adding Sergiwa.com to hpHosts with the FSA classification affect my website reputation? Are you smarter than CNET team who hosted and tested my programs and found it free of malware? Are you smarter than Mcafee http://www.siteadvisor.com/sites/www.sergiwa.com team how had their tests of my website and found SAFE? Are you smarter than Kaspersky and all other well-known Avs that don’t use the FUD term who found my program free of malware!
Lets move to the seventh strike, you said:
“It would appear 9\33 av engines call this a number of different things I think he needs to recode that ^%$@# so’s it’s not flagged”
You know that’s because you scanned the CNET version which is packed and protected by ACProtect which appear to some Avs as suspicious, but when you knew you should scan Sergiwa.com version and you found that both VT and Jotti show low detection for it, you said:
“He’s obviously been pretty quick to re-pack/modify it to evade detection …..”
God, how could you say that? Where’s the objectivity? Where is the facts, the evidences!
At last the topic starter (who TRUST your judgment) came and read all what you said, what would he think and what would he say based on your lies about CaSIR?
He of course said:
“Thank you so much TeMerc. I hate it when they do that. It stinks!”
And I bit he didn’t even make his tests because he trusts you did it for him and you gave him the results of your “inventing the atomic bomb”!
And then he left!
What you call this TeMerc? Is it spitting venom on a new developer? I don’t think so, you are not that cheap, you’re professionals, but I can’t find a real reason of that “shower of the lies against CaSIR”, other wise it would be just an ignorance, but you (and your friends) are “REAL” professionals, you are far far away from being a bunch of ignorants, is it the venom thing sirs? Is it? no no it can’t be, I am just a fresh developer, you can’t envy a frsh developer, you are professionals, It must be something I have no idea about, Is it my race? Is it my religion? I don’t think so, it must be something else because race and religion has nothing to do with software developing! SIGH!
Anyways, you know what TeMerc guys? do you know how did you make me feel? I have being dreaming to be an MVP (for Microsoft) one day, it’s just a dream, we all dream, yes I have being dreaming to be an MVP one day, but an MVP that does not only means “Most Valuable Professional”, but also means a person who has the morality, the care about the other’s feelings, the objective way of using the facts to seek the truth, but after what you said and what you did, I thank God I am not an MVP, and I don’t want to be!
Thank you, and thank you all for reading and being patient
Btw, for the record, I too abhor cracked or keygen software.
Regardless of who made it or what product it is for, it’s wrong, but if you’re a developer, it’s something you have to live with.
That comment by Doktor is exactly what everyone is complaining about.In my case,I have “show system files and folders” enabled in the “folder options”.That is about the first 3 so called “infections”.Don’t know about 4 and 5.About #6,W32/SillyFDC-G,I ran scans,manually scanned each and every entees the actual worm could make.Didn’t find anything.@#7,yes my security center is disabled.
So in short,the program tells you about infections,won’t tell you what and where,you pay 15 bucks for it to fix it.And you still don’t know what is fixing.I am still not calling it “rogue” because because Issam will take it personal.
Great tools for “n00bs with money”,so they can fix what is not broken.For people with little knowledge,I suggest we stick with the “not so effective” Anti Viruses.
@TeMerc,I have known you since sometime and I respect your guts calling a cat a cat.
I just pray to God,that “Winantivirus” won’t fix any of Raymond’s infections one day,and he will end up writing about it.If you know what i mean.
@Issam,No.you don’t have to give me details of RKD – W32/SillyFDC-G.I am literate and i can read English,and I can use the site named “google”.All I was wondering is why “those” registry entrys escaped my attention,because I went through all the registry entrys a suspected worm infection could make.Now I see,you are smarter than others.Other suckers just concentrate on just malware.You look at something beyond that.Give me a break dude.Sell that stuff to n00bs,not to geeks.Thanks.
And you whine about people cracking this crap!!Jeez,those crackers need to get a life.
@James (#53 et al.) – Yeah, this product is definitely not targeted at computer-savvy people. I completely distrust claims not backed up by any real information. Won\’t pay money for it, because the application philosophy is just unacceptable to me. And that gets me back to
#51: \”I intentionally hide such details for many reasons\”… See, I don\’t buy this. Every reputable AV vendor puts details on malware/virii on their website and/or their virus database. These details include what the malware alters in registry, which files does it create, which processes does it spawn, what else does it alter on your system, what kind of damage it can produce and what kind of information it might send out etc. OTOH, you tell the users *nothing*.
Your reason #1 is essentially bogus as it applies only to undocumented malware unknown to everyone else. How many such cases does you product cover? Honestly… I\’d say none.
Your reason #2 is a complete misunderstanding of what I\’ve said. I didn\’t want technical details on how your product changes registry entries or delete files or kill processes or whatever, thanks I know how to do that myself, and so do the malware authors apparently. I just want at least basic information about what\’s going to be done. And see – I\’d even have the information if you provided some more useful description of an issue rather than broad, nondescriptive claims. Security by obscurity is a completely broken concept that plain doesn\’t work.
Ad #3 – see above. I won\’t trust a product which says me \”Windows Firewall Disabled\” and the only thing it offers is a big \”Fix\” button. The above is NOT an infection per se, there\’s zillion of valid reasons why users disable it intentionally. \”Disabled Show System Files/Folders restriction\” is also no infection. And yet your product detects these and \”fixes\” them, without even telling anyone any details and explaining why this is a *real* problem as opposed to *legitimate* user configuration? Uh huh…
Your users are too computer-illiterate and wouldn\’t understand it? Fine, then do what everyone does, make it possible to run the thing in Basic and Advanced modes, with the former being the default… But don\’t treat your users like idiots who should trust blindly whatever your products tells.
More than half of the comments here are arguments. If you want to do that, please email each other rather than creating a scene in this article.
In my opinion, CaSIR has worked for me many times and never once created problems. If you are willing to try CaSIR in cleaning your computer, then please go ahead and purchase from Issam. If somehow it doesn’t work or created some problems, I am sure Issam is willing to go the extra mile to help you out.
This post will no longer accept any new comments.