Call for help: domain dispute

[Mark]

Hi folks.

It's my turn to ask for help now! Are there any legal eagles here who might be able to offer suggestions (note, I'm not asking for "legal advice") as to what I can do. Alternatively, has anyone else had a similar issue in the past?

It turns out someone has recently registered the ClamXav domain name with the .org extension instead of my .com. They've put up a phony web page with details about software called "Mac AntiVirus" loosely using some of the text content from my own site. When you click the download button, you're taken away to another site for something called "MacKeeper".

I haven't yet investigated the contents of the actual download to see what nasties it might contain.

According to Wikipedia, the Domain Name Resolution process can cost around $1000 - $2000 just to start proceedings!

Does anyone have any ideas what steps I might be able to take to stop this please?

Many thanks for any suggestions.

Mark

[alvarnell]

It turns out someone has recently registered the ClamXav domain name with the .org extension instead of my .com. They've put up a phony web page with details about software called "Mac AntiVirus" loosely using some of the text content from my own site. When you click the download button, you're taken away to another site for something called "MacKeeper".

Sorry, I can't help with the legal issue here, but I do know that their US offices are located about fifteen minutes away from my house in Sunnyvale, CA. They also have a European office in Kiev, Ukraine. Looks like you'll be needing international legal opinions. Edit: The site that you saw is phony, also. The real MacKeeper site is http://mackeeper.zeobit.com/

I had occasion to call them one night when one of your users complained that MacKeeper had caused issues with the installation and running of ClamXav. I asked the support tech that I spoke with if they were using the clamav engine as their AV tool and was told no. She told me the engine they were using, but I've forgotten what it was as I had never heard of it.

I'd be happy to try and speak with them about this if you think it would do any good, but I'm guessing that it wouldn't.

[mundkur]

I thought the forum may find it useful to see what I could glean from the "WhoIs" database – with the identity and e-mail of the owner of domain clamxav DOT org protected from disclosure, it smells fishy right away.

Domain ID:D161442546-LROR
Domain Name:CLAMXAV.ORG
Created On:08-Feb-2011 16:28:04 UTC
Last Updated On:08-Feb-2011 16:28:05 UTC
Expiration Date:08-Feb-2012 16:28:04 UTC
Sponsoring Registrar:eNom, Inc. (R39-LROR)
Status:CLIENT TRANSFER PROHIBITED
Status:TRANSFER PROHIBITED
Registrant ID:30e72e663403e518
Registrant Name:WhoisGuard Protected
Registrant Organization:WhoisGuard
Registrant Street1:8939 S. Sepulveda Blvd. #110 -
Registrant Street2:
Registrant Street3:
Registrant City:Westchester
Registrant State/Province:CA
Registrant Postal Code:90045
Registrant Country:US
Registrant Phone:+1.6613102107
Registrant Phone Ext.:
Registrant FAX:+1.6613102107
Registrant FAX Ext.:
Registrant Email:
Admin ID:30e72e663403e518
Admin Name:WhoisGuard Protected
Admin Organization:WhoisGuard
Admin Street1:8939 S. Sepulveda Blvd. #110 -
Admin Street2:
Admin Street3:
Admin City:Westchester
Admin State/Province:CA
Admin Postal Code:90045
Admin Country:US
Admin Phone:+1.6613102107
Admin Phone Ext.:
Admin FAX:+1.6613102107
Admin FAX Ext.:
Admin Email:

Perhaps Al Varnell can try his luck with the phone number listed? I was wondering whether Mark has registered ClamXav as a Trademark or if the fact of over 6 years' usage establishes his right to it as a Trademark and, if so, would have thought trade mark infringement an easier way to get remedial action rather than domain name registration. Anyway, using Mark's credibility and goodwill from ClamXav to go about even legitimate activity seems reprehensible to me.

[alvarnell]

I thought the forum may find it useful to see what I could glean from the "WhoIs" database – with the identity and e-mail of the owner of domain clamxav.org protected from disclosure, it smells fishy right away.

I was able to glean a bit more by doing a TraceRoute and looking up the resulting IP address. I provided the results to Mark by PM. Both www.clamxav dot org and www.mac-keeper dot com are owned by the same site provider in Southern California while www.MacKeeper.com is being served out of Montreal, Canada. The installer you download from either of the latter sites are identical and actually come from MacKeeper.

The installer is a bit unusual in that it's actually just a small shell that downloads MacKeeper.app over the internet and places it in your Application folder. I'm assuming that launching the application installs the remaining pieces that it needs after asking for your password. I did not attempt that.

[mundkur]

alvarnell said

The installer is a bit unusual in that it's actually just a small shell that downloads MacKeeper.app over the internet and places it in your Application folder. I'm assuming that launching the application installs the remaining pieces that it needs after asking for your password.

The fact that clamxav.org only provides a "Review" of ClamXav and all downloads seem to point only to MacKeeper's application for a trial run, suggests that MacKeeper are only using the fame and universal acceptance of Mark's application to push a few gullible surfers into buying their product with its claimed bells and whistles instead of a straight-forward virus scanner that is for free and effective. Should prove harmless in the long run. My 2P worth!
They really believe in the pull of ClamXav – see the YouTube video at http://www.youtube.com/watch?v=ecljSl9GDvI uploaded just a day ago.

[alvarnell]

They really believe in the pull of ClamXav – see the YouTube video at http://www.youtube.com/watch?v=ecljSl9GDvI uploaded just a day ago.

I see there is a place at the bottom to file a legal complaint against the video that Mark might be able to take advantage of.

[Mark]

They really believe in the pull of ClamXav – see the YouTube video at http://www.youtube.com/watch?v=ecljSl9GDvI uploaded just a day ago.

I see there is a place at the bottom to file a legal complaint against the video that Mark might be able to take advantage of.

That's how I found out about it - I've got a Google Alert setup to alert me to any mention of ClamXav online. I got all excited when I saw someone had put together a swish-looking video...until it dawned on me what they'd actually done, about 10 seconds in.

Where's the link to file a complaint, Al? I don't see it at all. Searching within the page shows up nothing.
[edit: never mind, I figured it out through their help docs]

[Mark]

They really believe in the pull of ClamXav – see the YouTube video at http://www.youtube.com/watch?v=ecljSl9GDvI uploaded just a day ago.

I see there is a place at the bottom to file a legal complaint against the video that Mark might be able to take advantage of.

Could I possibly ask you (and anyone else reading this) to log in to YouTube and flag the video as spam please?

[Mark]

They really believe in the pull of ClamXav – see the YouTube video at http://www.youtube.com/watch?v=ecljSl9GDvI uploaded just a day ago.

Could I possibly ask you (and anyone else reading this) to log in to YouTube and flag the video as spam please?

This video has been removed as a violation of YouTube's policy against spam, scams, and commercially deceptive content.

I see we've won round one. Let's hope subsequent rounds are this easy...

[alvarnell]

Disregard. I thought the web site had been taken down, but it was just off-line for awhile this afternoon.

[mac.ph]

@Mark :

Your problem will be that you don´t registered ClamXav as a trademark and I think you can´t because Sourcefire has that already done for clamav.

Mac-Keeper can bring up a software which is based on clamav and use a name which is to confuse with ClamXav and you can do nothing ... only if they don´t respect / hold the GPL. I mean maybe you can do ... do you have the money for that ... do you like to invest that money / time for that ?

You can contact dreamhost.com (they provide the nameservers and normally they are also the registrar of the domain), WordPress (the blog is from them) and unmetered.org.uk (the download of the 2.1.dmg is stored there) to explain your situation and ask to delete the content.

If you don´t had disallowed to provide tutorials / screenshots about ClamXav and to provide .dmg images for download you can do nothing.

Has anyone checked the SHA1 of the 2.1 dmg from there ?

[mac.ph]

http://www.youtube.com/watch?v=zd7YXcja ... ideo_title

[alvarnell]

Mac-Keeper can bring up a software which is based on clamav and use a name which is to confuse with ClamXav and you can do nothing ... only if they don´t respect / hold the GPL. I mean maybe you can do ... do you have the money for that ... do you like to invest that money / time for that ?

Actually, it's not based on clamav at all. I called their tech support a couple of months ago to confirm that they are using a totally different AV scanner.

Has anyone checked the SHA1 of the 2.1 dmg from there ?

It's not the 2.1 dmg at all, it's exactly the same installer package you get by downloading it from mackeeper.zeobit.com/download.

I just checked and the downloaded .pkg has changed but still seems to work in a similar manner to the way it did before. You download a tiny installer shell and in the process it now downloads the real MacKeeper application installer to a temp file. None of the support files are installed until you launch the Application itself.

[alvarnell]

http://www.youtube.com/watch?v=zd7YXcjadks&feature=channel_video_title

It's back. I flagged it as Spam/Fraud. Mark can say it Infringes on his Rights.

[mundkur]

I joined alvarnell, marking the video as having misleading text. Mark should flag the video as infringing his rights.