Fake AdwCleaner scareware generates thousands of dollars for scammers

It was reported today that there is a scareware program being distributed that pretends to be the popular AdwCleaner adware cleaning tool, but is in fact nothing more than a scam. Unlike the free and legitimate AdwCleaner tool, this scareware version displays fake scan results and then prompts you to purchase it for $59.99 before you can remove the threats. If you purchase the program, it will then display a page that prompts you to download the registered program, which is nothing more than the legitimate and free AdwCleaner. It is important to note that the only legitimate locations to download AdwCleaner are from ToolsLib or from BleepingComputer.com.

The executables associated with this scareware scam are signed with a digital signature that makes the programs appear more legitimate. This signature, though, is not one owned by Xplode the creator of AdwCleaner. Instead this signature is associated with a company called WAT Software Rotterdam. Whether this is the actual developer of the scareware or if the certificate was stolen is currently unknown. Other clues found in the executable indicate that the real name for this scamware is AdwareBooc. The programming project name was also able to be retrieved and is called c:\Users\PresFox\Documents\Visual Studio 2013\Projects\AdwareBooC\AdwareBooC\obj\Release\AdwareBooC.pdb.

The scam begins when you are browsing the web and are shown a popup that states your computer is infected with adware. This popup contains scary language about how you have adware on your computer and then prompts you to download AdwCleaner to scan your computer and clean these threats:

Once you download and run the program it will install the fake AdwCleaner in C:\Users\<login name>\AppData\Local\6AdwCleaner.exe and execute it. It will also create an autorun entry called AdwCleaner in the Windows Registry so that it is started every time you login to Windows. Once executed the program will perform a scan of your computer and display a variety of detected adware programs. In reality these results are built into the program and everyone who runs this scareware will see the same exact results. If a user clicks on the Clean button, they will be presented with a prompt to purchase the program.

If you click on the Buy Now button, you will be brought to a PayPal page where you can purchase the scamware for $59.99 USD. This PayPal purchase page shows that the owner of the account is going by name of Mardel Innovations.

When anyone purchases the program they will then be shown a page where they can download the full purchased version of the AdwCleaner. In fact, the program they will be downloading is the normal and legitimate AdwCleaner wrapped in the scammers own installer. This is the same program that anyone can download and use for free. Notice the similarities between the legitimate one below and the fake one shown at the top of this page.

This scareware is fairly easy to remove. Simply terminate the 6AdwCleaner.exe process in Task Manager to end the program. Once the program is terminated, delete the HKCU\Software\Microsoft\Windows\CurrentVersion\Run\AdwCleaner Registry key via Msconfig or Autoruns and then delete the C:\Users\<login name>\AppData\Local\6AdwCleaner.exe file. If you would prefer to use a program to remove this infection, Emsisoft Anti-Malware and Malwarebytes both detect this scareware.

Due to a misconfigured website we were able to get access to a detailed report showing how many people have installed the program, clicked on the Scan button, clicked on the Clean button, and have purchased it. From this report we show that this scam has been successful and has generated thousands of dollars for these scammers.

This report only shows activity since February 1st, 2015, but we have found this same scareware on VirusTotal ranging as far back as January 1st, 2015. Therefore it is likely that they have made much more revenue than we know about.

Once again, AdwCleaner should only be downloaded from ToolsLib.net and BleepingComputer.com. If you download it from any other location then you run the risk of becoming infected with adware or possibly something worse.


Known AdwCleaner Scareware Files:

C:\Users\User\AppData\Local\6AdwCleaner.exe

Known AdwCleaner Scareware Registry keys:

HKCU\Software\AdwCleaner
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\AdwCleaner	"C:\Users\User\AppData\Local\6AdwCleaner.exe" -auto

If you look underneath the large blue writing on pic number two you will see ..."Your computer will be scanned .....immideatly ....."   Incorrect spelling.

 

Many scammers are tripped up by their misspelling of English words......unfortunately to their own demise, many people don't read everything when preparing to download 'freebies'.

I look at spelling very very closely before downloading.

Unfortunately, the majority of people are not that diligent. It is why these scams, and rogues in the past, work so well.

Thanks for the info Lawrence.

It's sad to see people doing this sort of thing, however I guess that it was inevitable considering how popular AdwCleaner has become.

I tell you if i was Toolslib i would be flattered that these fools decided to use my legitimate software to scam people, ADW kicks so much ass and these crooks know it.

I tell you if i was Toolslib i would be flattered that these fools decided to use my legitimate software to scam people, ADW kicks so much ass and these crooks know it.

I'm not sure "imitation is the sincerest form of flattery" applies here, seeing that they use a legit program to extort money from innocent users.

By the way, the creator of AdwCleaner is Xplode.

Alex

Edited by Alexstrasza, 14 February 2015 - 01:54 AM.

 now ive got it too.

Edited by RobertHD, 14 February 2015 - 08:25 AM.

 

I tell you if i was Toolslib i would be flattered that these fools decided to use my legitimate software to scam people, ADW kicks so much ass and these crooks know it.

I'm not sure "imitation is the sincerest form of flattery" applies here, seeing that they use a legit program to extort money from innocent users.

By the way, the creator of AdwCleaner is Xplode.

Alex

 

 

I know who Xplode is we have had conversations, but i meant Toolslib the hosting platform from where xplodes (alex) AdwCleaner is hosted and download.

Although a member since 2009, this is my first post. 

 

Good point about misspellings, but as the other member said, most people don't look at such things. In fact, by you and I being on this Site, and actually commenting, I venture to speculate we represent .000001 % of computer users. (Referencing people I know, none know anything about their computers. My brother (who is 70) was victim to a virus scam. When I got that all sorted for him I then wanted to set up his browser. It took about four hours on the phone. The process started when he asked "What is a browser?"

 

Anyway, in the unlikely event that our friends or family might actually listen to our tips, another thing I tell them is to look at grammar and format. On that page the line spacing is off (no paragraph spacing), an error that's not made on legitimate sites (or e-mails).

 

But the last gasp tip I give them, when all else fails, I tell them under no circumstances should they pay anyone. If they screw up to where the supposed legit site wants money, it is a scam. I tell them to close down the computer and give me a call.

 

P.S. My brother, who was very ashamed of himself falling for the scam, would not tell me how much he paid to clean his notebook from the virus. I pulled it out of him, $680!!! He got suspicious when talking to the scammer on the phone so he hung up and immediately called the credit card company. They stopped the charge from going through. So he learned a valuable lesson. Almost might have been a $680 lesson. (I set him up with Comodo and Malwarebytes so he should be OK.)

Edited by BullPooper, 18 February 2015 - 02:22 PM.

Dang. That's insane; I recommend Adw cleaner to lots and lots of people, though I always ensure they download it from the right place.

The hosted version has been updated.

We could really use a BC DNS service, as a part of a BC Safe Computing package with basic backup tutorial. 

 

I hope the Dutch authorities chase this fraudster down and confiscate his ill-gotten funds, for starters.