Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Fake AdwCleaner scareware generates thousands of dollars for scammers


  • Please log in to reply
12 replies to this topic

#1 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,613 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:11:31 PM

Posted 12 February 2015 - 06:51 PM

It was reported today that there is a scareware program being distributed that pretends to be the popular AdwCleaner adware cleaning tool, but is in fact nothing more than a scam. Unlike the free and legitimate AdwCleaner tool, this scareware version displays fake scan results and then prompts you to purchase it for $59.99 before you can remove the threats. If you purchase the program, it will then display a page that prompts you to download the registered program, which is nothing more than the legitimate and free AdwCleaner. It is important to note that the only legitimate locations to download AdwCleaner are from ToolsLib or from BleepingComputer.com.


fake-adwcleaner.jpg


The executables associated with this scareware scam are signed with a digital signature that makes the programs appear more legitimate. This signature, though, is not one owned by Xplode the creator of AdwCleaner. Instead this signature is associated with a company called WAT Software Rotterdam. Whether this is the actual developer of the scareware or if the certificate was stolen is currently unknown. Other clues found in the executable indicate that the real name for this scamware is AdwareBooc. The programming project name was also able to be retrieved and is called c:\Users\PresFox\Documents\Visual Studio 2013\Projects\AdwareBooC\AdwareBooC\obj\Release\AdwareBooC.pdb.

The scam begins when you are browsing the web and are shown a popup that states your computer is infected with adware. This popup contains scary language about how you have adware on your computer and then prompts you to download AdwCleaner to scan your computer and clean these threats:


fake-alert-page.jpg



Once you download and run the program it will install the fake AdwCleaner in C:\Users\<login name>\AppData\Local\6AdwCleaner.exe and execute it. It will also create an autorun entry called AdwCleaner in the Windows Registry so that it is started every time you login to Windows. Once executed the program will perform a scan of your computer and display a variety of detected adware programs. In reality these results are built into the program and everyone who runs this scareware will see the same exact results. If a user clicks on the Clean button, they will be presented with a prompt to purchase the program.


purchase-prompt.jpg



If you click on the Buy Now button, you will be brought to a PayPal page where you can purchase the scamware for $59.99 USD. This PayPal purchase page shows that the owner of the account is going by name of Mardel Innovations.


paypal-purchase-page.jpg



When anyone purchases the program they will then be shown a page where they can download the full purchased version of the AdwCleaner. In fact, the program they will be downloading is the normal and legitimate AdwCleaner wrapped in the scammers own installer. This is the same program that anyone can download and use for free. Notice the similarities between the legitimate one below and the fake one shown at the top of this page.


legit-adwcleaner.jpg



This scareware is fairly easy to remove. Simply terminate the 6AdwCleaner.exe process in Task Manager to end the program. Once the program is terminated, delete the HKCU\Software\Microsoft\Windows\CurrentVersion\Run\AdwCleaner Registry key via Msconfig or Autoruns and then delete the C:\Users\<login name>\AppData\Local\6AdwCleaner.exe file. If you would prefer to use a program to remove this infection, Emsisoft Anti-Malware and Malwarebytes both detect this scareware.

Due to a misconfigured website we were able to get access to a detailed report showing how many people have installed the program, clicked on the Scan button, clicked on the Clean button, and have purchased it. From this report we show that this scam has been successful and has generated thousands of dollars for these scammers.


installs.jpg


This report only shows activity since February 1st, 2015, but we have found this same scareware on VirusTotal ranging as far back as January 1st, 2015. Therefore it is likely that they have made much more revenue than we know about.

Once again, AdwCleaner should only be downloaded from ToolsLib.net and BleepingComputer.com. If you download it from any other location then you run the risk of becoming infected with adware or possibly something worse.


Known AdwCleaner Scareware Files:

C:\Users\User\AppData\Local\6AdwCleaner.exe
Known AdwCleaner Scareware Registry keys:

HKCU\Software\AdwCleaner
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\AdwCleaner	"C:\Users\User\AppData\Local\6AdwCleaner.exe" -auto


BC AdBot (Login to Remove)

 


#2 Jimizlad

Jimizlad

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:31 PM

Posted 12 February 2015 - 08:15 PM

If you look underneath the large blue writing on pic number two you will see ..."Your computer will be scanned .....immideatly ....."   Incorrect spelling.

 

Many scammers are tripped up by their misspelling of English words......unfortunately to their own demise, many people don't read everything when preparing to download 'freebies'.



#3 RobertHD

RobertHD

  • Members
  • 348 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Somewhere in Oz
  • Local time:02:01 PM

Posted 13 February 2015 - 06:00 AM

I look at spelling very very closely before downloading.


Robert James Crawley Klopp


#4 Grinler

Grinler

    Lawrence Abrams

  • Topic Starter

  • Admin
  • 43,613 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:11:31 PM

Posted 13 February 2015 - 09:21 AM

Unfortunately, the majority of people are not that diligent. It is why these scams, and rogues in the past, work so well.

#5 GT500

GT500

    Authorized Emsisoft Representative


  • Security Colleague
  • 137 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Fortville, Indiana, USA
  • Local time:11:31 PM

Posted 13 February 2015 - 04:04 PM

Thanks for the info Lawrence. :wink:

It's sad to see people doing this sort of thing, however I guess that it was inevitable considering how popular AdwCleaner has become.

For we wrestle not against flesh and blood, but against principalities, against powers, and against the worldly governors, the princes of the darkness of this world...


#6 Bluediamond

Bluediamond

  • Members
  • 38 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:NASA
  • Local time:03:31 AM

Posted 14 February 2015 - 01:27 AM

I tell you if i was Toolslib i would be flattered that these fools decided to use my legitimate software to scam people, ADW kicks so much ass and these crooks know it.



#7 Sintharius

Sintharius

    Bleepin' Sniper


  • Members
  • 5,639 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:The Netherlands
  • Local time:04:31 AM

Posted 14 February 2015 - 01:54 AM

I tell you if i was Toolslib i would be flattered that these fools decided to use my legitimate software to scam people, ADW kicks so much ass and these crooks know it.

I'm not sure "imitation is the sincerest form of flattery" applies here, seeing that they use a legit program to extort money from innocent users.

By the way, the creator of AdwCleaner is Xplode.

Alex

Edited by Alexstrasza, 14 February 2015 - 01:54 AM.


#8 RobertHD

RobertHD

  • Members
  • 348 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Somewhere in Oz
  • Local time:02:01 PM

Posted 14 February 2015 - 08:25 AM

 now ive got it too.


Edited by RobertHD, 14 February 2015 - 08:25 AM.

Robert James Crawley Klopp


#9 Bluediamond

Bluediamond

  • Members
  • 38 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:NASA
  • Local time:03:31 AM

Posted 15 February 2015 - 02:39 AM

 

I tell you if i was Toolslib i would be flattered that these fools decided to use my legitimate software to scam people, ADW kicks so much ass and these crooks know it.

I'm not sure "imitation is the sincerest form of flattery" applies here, seeing that they use a legit program to extort money from innocent users.

By the way, the creator of AdwCleaner is Xplode.

Alex

 

 

I know who Xplode is we have had conversations, but i meant Toolslib the hosting platform from where xplodes (alex) AdwCleaner is hosted and download.



#10 BullPooper

BullPooper

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:San Francisco
  • Local time:07:31 PM

Posted 18 February 2015 - 02:19 PM

Although a member since 2009, this is my first post.  :thumbsup2:

 

Good point about misspellings, but as the other member said, most people don't look at such things. In fact, by you and I being on this Site, and actually commenting, I venture to speculate we represent .000001 % of computer users. (Referencing people I know, none know anything about their computers. My brother (who is 70) was victim to a virus scam. When I got that all sorted for him I then wanted to set up his browser. It took about four hours on the phone. The process started when he asked "What is a browser?" :smash: :scratchhead: :ranting: :blink:

 

Anyway, in the unlikely event that our friends or family might actually listen to our tips, another thing I tell them is to look at grammar and format. On that page the line spacing is off (no paragraph spacing), an error that's not made on legitimate sites (or e-mails).

 

But the last gasp tip I give them, when all else fails, I tell them under no circumstances should they pay anyone. If they screw up to where the supposed legit site wants money, it is a scam. I tell them to close down the computer and give me a call.

 

P.S. My brother, who was very ashamed of himself falling for the scam, would not tell me how much he paid to clean his notebook from the virus. I pulled it out of him, $680!!! He got suspicious when talking to the scammer on the phone so he hung up and immediately called the credit card company. They stopped the charge from going through. So he learned a valuable lesson. Almost might have been a $680 lesson. (I set him up with Comodo and Malwarebytes so he should be OK.)


Edited by BullPooper, 18 February 2015 - 02:22 PM.


#11 chromebuster

chromebuster

  • Members
  • 899 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:the crazy city of Boston, In the North East reaches of New England
  • Local time:11:31 PM

Posted 26 February 2015 - 03:44 PM

Dang. That's insane; I recommend Adw cleaner to lots and lots of people, though I always ensure they download it from the right place.


The AccessCop Network is just me and my crew. 

Some call me The Queen of Cambridge


#12 Grinler

Grinler

    Lawrence Abrams

  • Topic Starter

  • Admin
  • 43,613 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:11:31 PM

Posted 15 May 2015 - 09:11 AM

The hosted version has been updated.

#13 Fremont PC

Fremont PC

  • Members
  • 115 posts
  • OFFLINE
  •  
  • Local time:08:31 PM

Posted 15 May 2015 - 10:15 AM

We could really use a BC DNS service, as a part of a BC Safe Computing package with basic backup tutorial. 

 

I hope the Dutch authorities chase this fraudster down and confiscate his ill-gotten funds, for starters.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users