OVTune is a virus until proven otherwise

memario1214 · Jul 6, 2019

wahoobie said: ↑

Good thing this thread didnt start on Friday

Click to expand...

I'd have nuked it already

Stocklocker · Jul 6, 2019

Once every last Tacoma gets tuned.....it’s over.........

LostHusker · Jul 6, 2019

.jake · Jul 6, 2019

Wow. Just like that. TW membership is minus 1. You have to consider the way he is wired. As a security guy he’s obviously going to take things a little more serious than average Bro’s that just want their truck to behave “better”. Probably should have sat back until OV chimed in but I know, I know, not how it always works. And of all things a mod taking a shot at his credibility with the “past life” blast, which could have been last month for all we know. JFC...

Lawfarin · Jul 6, 2019

Lots of OV circle jerkers are really gonna lose their shit when they stumble upon this thread. (Pun intended)

swtaco10 · Jul 6, 2019

flat_tire[OP] said: ↑

I just read the replies to my post. Wow. Ok ya-all good luck. I'll sign off and out and you can keep drinking the "everythin's fine" cool-aid and fire away at anyone who isn't singing the same song and boo them off the stage.

forget I said anything and deal with it on your own time.
-over and out.
Click to expand...

Kool-aid

tcjacado · Jul 6, 2019

whatstcp said: ↑

and him taking it serious is appreciated because these days you never know. Heck there was an issue with google chromecast devices getting "hacked" earlier this year just for shits and giggles. But suspicions and throw out accusations while not 100% sure is wrong no matter the situation. There is playing it safe and figuring out and then there's posting "OVTune is a virus until proven otherwise".

He still brings up a good point though, someone who knows this type of stuff should check it out as an independent 3rd party because why not? Just to be safe.

Like literally the only problem people really had with the guy is that he is saying OVTune is guilty until proven otherwise. Like bruh what
Click to expand...

Wanna go to the movies and yell "fire" with me??

ksj · Jul 6, 2019

I think your PC anti-virus is alarming on the non-standard way the driver is talking to the hardware, not because of a virus.

Chasespeed · Jul 6, 2019

Stocklocker said: ↑

Once every last Tacoma gets tuned.....it’s over.........

Click to expand...

The fact I was just about to watch this tonight, made this my favorite thread this week

SpeySquatch · Jul 6, 2019

flat_tire[OP] initial post: ↑

I just received my $799 purchase of OVTune, downloaded their application from www.ovtuned.com and immediately my antivirus software quarrantined it as a trojan.

I uploaded the file to virustotal.com and here are the results
p5flash_V1.2.2.exe
https://www.virustotal.com/gui/file...2ee3c9c62729c099c40469129f9bc566426/detection

p5flash_V1.2.1.exe
https://www.virustotal.com/gui/file...161aa9ee1bd2475c39ff80c78afbb86fee3/detection

I have reached out to OVtune and also submitted samples of both files above to Cisco AMP Symantec for deep analysis. I'll post the reports once they come back..
Click to expand...

I’ve had OVtune for over a year with no issues. Claiming it is a virus just because dumbass Windows (or antiviral software) says it is...DOESN’T mean it is. It is the file type and the fact that flash manager is a third party tool.

I would’ve freaked too if I thought otherwise. I work in IT for a multi-billion dollar company and I did my research with the help of some of my “smarter than me” co-workers. Based on the analysis we did, you are fine.

Don’t make claims that you unsure of especially because you are new to the OVtune. He has made an amazing product and it continues to shine

...not to mention he has worked WITH Toyota to help tune some of the Camrys.

Lawfarin · Jul 6, 2019

It’s gonna be super funny when OP realizes his virus software is so sensitive it picked up the dead hooker in the back seat...

Stocklocker · Jul 6, 2019

Chasespeed said: ↑

The fact I was just about to watch this tonight, made this my favorite thread this week
Click to expand...

It’s nice someone knows what it is.

.jake · Jul 6, 2019

whatstcp said: ↑

and him taking it serious is appreciated because these days you never know. Heck there was an issue with google chromecast devices getting "hacked" earlier this year just for shits and giggles. But suspicions and throw out accusations while not 100% sure is wrong no matter the situation. There is playing it safe and figuring out and then there's posting "OVTune is a virus until proven otherwise".

He still brings up a good point though, someone who knows this type of stuff should check it out as an independent 3rd party because why not? Just to be safe.

Like literally the only problem people really had with the guy is that he is saying OVTune is guilty until proven otherwise. Like bruh what
Click to expand...

Maybe he didn’t read the “read this before posting” thread. I mean, everybody knows you can’t go full retard here until 100 posts.

All I guess I’m saying is if his AV triggered then to him something’s not right, and he’s right for being on alert. He came here and raised a concern. Maybe a PM to OV would have been better, but it is Saturday and perhaps he thought he was doing the right thing. I don’t know. We handle our shit pretty cunty in 3rd gen so.

flat_tire · Jul 6, 2019

I hate myself for posting this, I hear the general consensus to piss off from this forum but you people are being idiots

I opened the binaries using IDA Pro, a binary and hex editor. I found several strings in Russian and an email address "quickie@yandex.ru"

A quick relational search using those ooooh amazing "expensive tools" I found this same email address string in many other files flagged as malicious.
https://www.hybrid-analysis.com/search?query=indicatorid:string-63

whatever... I'll crawl back under a rock now where apparently I belong for sharing what I found.

Chasespeed · Jul 6, 2019

Stocklocker said: ↑

It’s nice someone knows what it is.
Click to expand...

Shall we play a game?

memario1214 · Jul 6, 2019

flat_tire[OP] said: ↑

I hate myself for posting this, I hear the general consensus to piss off from this forum but you people are being idiots

I opened the binaries using IDA Pro, a binary and hex editor. I found several strings in Russian and an email address "quickie@yandex.ru"

A quick relational search using those ooooh amazing "expensive tools" I found this same email address string in many other files flagged as malicious.
https://www.hybrid-analysis.com/search?query=indicatorid:string-63

whatever... I'll crawl back under a rock now where apparently I belong for sharing what I found.
Click to expand...

And here's where I step in... @flat_tire I am in no position to say that you are wrong, but there are a lot of people with positive reviews here, hence the kickback you are getting. I have locked this thread for now, but will keep it available to be seen. Please PM me once your results come back in, and I will reopen it for additional discussion. I don't want to see someone throwing a sparkler bomb in an already active dumpster fire.

memario1214 · Jul 7, 2019

Okay this will be the final post on this. I have included responses from both parties, clear and unedited. If you have additional discussion points I recommend that you take them up with the individual players involved. I cannot confirm nor discredit the validity of either of the below quotes.

OVTune said: ↑

Hello everyone.

We want to let everyone know..Because a thread claiming our software is a virus..

Our software is not a virus. However, it can easily be "detected" as a virus due to specific code manipulation methods in place for anti reverse engineering.
The software is packaged and compiled a certain way by our developer to protect the code.
These methods include a signature (email) embedded within.

This is done so that when REing is attempted, you chase your tail, for a while.

The code also uses anti reverse engineering methods that destroy segments on compiling. Making disassembling the code extremely difficult.
Our software queries firmware information, along with hardware information....to get your system ID.
This is not malicious, it's just a method to make a unique ID.
Quickie is the email of my developer. Not malicious.

Our software ALSO queries current processes to ensure that debuggers are not active while using the software. Another anti-RE method.

Some of these methods are ALSO used by viruses. This is why anti viruses will scan it, and say "hey this has signatures of bad stuff."
Doesn't mean that it is.

It's a very efficient way to create a standalone, easy to distribute small packaged utility that is very well protected.

Thanks everyone.
Click to expand...

From @flat_tire to me:

I've asked ovtune for a refund. Ovtune identified quickie@yandex.ru as being their developer. This same email address is associated with known Russian extortion malware.

The binaries create a boot loader hook, access credentials and perform privilege escalation. These are most easily human readable by submitting the files to https://www.hybrid-analysis.com Create a free account and submit the files and see for yourself.

I can think of no reason for this app to deposit a persistence mechanism that remains even after the program has been uninstalled.

Symantec and Cisco APT both came back that these are genuine trojan horse malware files. Here is the report from symantec, cisco says the same but they provide Yara detection signatures for use in our defense systems. The Yara signature is under NDA and Cisco APT IP and can't be shared on a public forum like this. However you can sign up for a free Cisco APT account, submit the same two files. You will get a reduced detail report saying they're malicious, but without the high-level detail.

# Filename MD5 Determination Signature Protection Name RR Seq#
1 p5flash_V1.2.2.exe 2d600ee1c16c273262fd16429711e238 New Threat Trojan Horse 201045

Developer Notes:
1. p5flash_V1.2.2.exe is a non-repairable threat.

# Filename MD5 Determination Signature Protection Name RR Seq#
1 p5flash_V1.2.1.exe f064c5b93b1f8c01d404f04c3bdadc8c New Threat Trojan Horse 201045

Developer Notes:
1. p5flash_V1.2.1.exe is a non-repairable threat.

The latest Rapid Release definitions are available here . (ftp://ftp.symantec.com/public/english_us_canada/antivirus_definitions/norton_antivirus/rapidrelease/)

To check the current sequence number of the Rapid Release definitions click here . (http://www.symantec.com/business/security_response/definitions/rapidrelease/index.jsp)

More information on Rapid release definitions can be found here . (http://www.symantec.com/docs/TECH103326)

Click to expand...

Log in or Sign up

Welcome to Tacoma World!

OVTune is a virus until proven otherwise

#41
memario1214 Hotshot Offroad Moderator Vendor

#42
Stocklocker Well-Known Member

#43
LostHusker Just one day at a time

#44
.jake Ex-Lion Tamer

#45
Lawfarin Who me?

#46
swtaco10 Well-Known Member

#47
tcjacado Well-Known Member

#48
ksj Well-Known Member

#49
Chasespeed Just a monkey with a wrench

#50
SpeySquatch Function over Form

#51
Lawfarin Who me?

#52
Stocklocker Well-Known Member

#53
.jake Ex-Lion Tamer

#54
flat_tire [OP] Well-Known Member

#55
Chasespeed Just a monkey with a wrench

#56
memario1214 Hotshot Offroad Moderator Vendor

#57
memario1214 Hotshot Offroad Moderator Vendor

Products Discussed in

Log in or Sign up

Useful Searches

Welcome to Tacoma World!

OVTune is a virus until proven otherwise

#41 memario1214 Hotshot Offroad Moderator Vendor

#42 Stocklocker Well-Known Member

#43 LostHusker Just one day at a time

#44 .jake Ex-Lion Tamer

#45 Lawfarin Who me?

#46 swtaco10 Well-Known Member

#47 tcjacado Well-Known Member

#48 ksj Well-Known Member

#49 Chasespeed Just a monkey with a wrench

#50 SpeySquatch Function over Form

#51 Lawfarin Who me?

#52 Stocklocker Well-Known Member

#53 .jake Ex-Lion Tamer

#54 flat_tire [OP] Well-Known Member

#55 Chasespeed Just a monkey with a wrench

#56 memario1214 Hotshot Offroad Moderator Vendor

#57 memario1214 Hotshot Offroad Moderator Vendor

Products Discussed in Entire Site Forum: 3rd Gen. Tacomas (2016-2023)

#41
memario1214 Hotshot Offroad Moderator Vendor

#42
Stocklocker Well-Known Member

#43
LostHusker Just one day at a time

#44
.jake Ex-Lion Tamer

#45
Lawfarin Who me?

#46
swtaco10 Well-Known Member

#47
tcjacado Well-Known Member

#48
ksj Well-Known Member

#49
Chasespeed Just a monkey with a wrench

#50
SpeySquatch Function over Form

#51
Lawfarin Who me?

#52
Stocklocker Well-Known Member

#53
.jake Ex-Lion Tamer

#54
flat_tire [OP] Well-Known Member

#55
Chasespeed Just a monkey with a wrench

#56
memario1214 Hotshot Offroad Moderator Vendor

#57
memario1214 Hotshot Offroad Moderator Vendor

Products Discussed in