Home Malware Programs Browser Hijackers RewardsArcade

RewardsArcade

Posted: March 27, 2013

Threat Metric

Ranking: 11,571
Threat Level: 2/10
Infected PCs: 13,533
First Seen: March 27, 2013
Last Seen: October 5, 2023
OS(es) Affected: Windows


RewardsArcade by 215 Apps (Awesome Apps) is a Browser Helper Object (BHO) categorized as adware and detected as Adware.RewardsArcade that may be installed into the Internet Explorer Web browser. Adware.RewardsArcade may monitor web pages for possible affiliate merchant partners. Adware.RewardsArcade lets PC users know when there are coupons by showing a counter in the top right of websites. Adware.RewardsArcade may lead to serious performance issues to the PC by installing numerous plug-ins and add-ons to the Web browser and Windows. Adware.RewardsArcade may insert ads directly by making changes to websites based on the PC user's surfing activity. When the computer user installs the plug-in, it may also have a background process that may attempt to disable other 'conflicting' extensions that might interfere with it, including other competing products and some security programs (in the program's EULA, computer users may actually agree to this) 'By installing the Plugin, you consent to the Plugin in disabling other conflicting software and we understand you have chosen to use our software to customize your social media pages over other available software packages'.

Aliases

OneStepSearcher.AO [AVG]Adware/OneStep [Fortinet]Win32.SuspectCrc [Ikarus]Trojan/Win32.HDC [AhnLab-V3]Zwangi [Sophos]TR/Boigy.2.275 [AntiVir]Gen:Variant.Adware.Boigy.5 [BitDefender]Win32:Susexp [Trj] [Avast]a variant of Win32/Adware.OneStep.AS [NOD32]Artemis!89442E64547C [McAfee]Suspicious file [Panda]PSW.Banker6.AHVI [AVG]W32/Banker.YLW!tr.spy [Fortinet]Trojan-PWS.Banker6 [Ikarus]Win32:Spyware-gen [Spy] [Avast]
More aliases (55)

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%PROGRAMFILES%\RewardsArcade\RewardsArcade.dll File name: RewardsArcade.dll
Size: 523.26 KB (523264 bytes)
MD5: bdf12e8af557a41ec045e52f3c192ee7
Detection count: 6,162
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES%\RewardsArcade
Group: Malware file
Last Updated: June 16, 2019
C:\Program Files (x86)\RewardsArcade\RewardsArcade.dll File name: RewardsArcade.dll
Size: 522.75 KB (522752 bytes)
MD5: df2bb724e9aa18e58808bf8e911885c5
Detection count: 4,745
File type: Dynamic link library
Mime Type: unknown/dll
Path: C:\Program Files (x86)\RewardsArcade\RewardsArcade.dll
Group: Malware file
Last Updated: December 18, 2020
%PROGRAMFILES%\QuestScan\questscan.dll File name: questscan.dll
Size: 1.01 MB (1019904 bytes)
MD5: 89442e64547c284acd2a97913e880c08
Detection count: 9
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES%\QuestScan
Group: Malware file
Last Updated: March 29, 2013
C:\Windows\SysWOW64\OSSMTP.dll File name: OSSMTP.dll
Size: 131.58 KB (131584 bytes)
MD5: 47c30d7bf7342a8475a2826adc73f466
Detection count: 7
File type: Dynamic link library
Mime Type: unknown/dll
Path: C:\Windows\SysWOW64\OSSMTP.dll
Group: Malware file
Last Updated: March 30, 2022
%ALLUSERSPROFILE%\Antes_e_Depois_da_Fama.html.exe File name: Antes_e_Depois_da_Fama.html.exe
Size: 415.23 KB (415232 bytes)
MD5: 069abb2e5fafa1955130140aa1646492
Detection count: 7
File type: Executable File
Mime Type: unknown/exe
Path: %ALLUSERSPROFILE%
Group: Malware file
Last Updated: March 29, 2013
C:\Program Files\rewardsarcade\RewardsArcade.exe File name: C:\Program Files\rewardsarcade\RewardsArcade.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
C:\Program Files\rewardsarcade\RewardsArcade.dll File name: C:\Program Files\rewardsarcade\RewardsArcade.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
C:\Program Files\rewardsarcade\RewardsArcadeGui.exe File name: C:\Program Files\rewardsarcade\RewardsArcadeGui.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
C:\Program Files\rewardsarcade\Uninstall.exe File name: C:\Program Files\rewardsarcade\Uninstall.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
C:\Program Files\rewardsarcade\UserConfirmation.exe File name: C:\Program Files\rewardsarcade\UserConfirmation.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

CLSID{25514C64-8321-494e-BD3E-3DBAB3F8CEBA}{597A9974-8CB0-4f41-B61F-ED065738A397}{60BE6B2E-F2F5-4404-AA1E-4381D4A6EEA2}{BDA89DCD-8B25-48c7-B1E2-07CA622E0CA8}{E788D914-2C76-4D67-A8CD-ECC7ED0D0748}HKEY..\..\..\..{RegistryKeys}Software\AppDataLow\Software\RewardsArcadeSOFTWARE\Classes\CrossriderApp0000498.BHOSOFTWARE\Classes\CrossriderApp0000498.BHO.1SOFTWARE\Classes\CrossriderApp0000498.SandboxSOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\RewardsArcade-bg.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CompatibilityAdapter\Signatures\RewardsArcade-updater.jobSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CompatibilityAdapter\Signatures\RewardsArcade-updater.job.fpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CompatibilityAdapter\Signatures\RewardsArcade-updater_user.jobSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CompatibilityAdapter\Signatures\RewardsArcade-updater_user.job.fpSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110011041198}SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{597A9974-8CB0-4f41-B61F-ED065738A397}SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{11111111-1111-1111-1111-110011041198}SOFTWARE\Mozilla\Firefox\Extensions\crossriderapp498@crossrider.comSOFTWARE\RewardsArcadeSOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\RewardsArcade-bg.exeSOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{11111111-1111-1111-1111-110011041198}SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{597A9974-8CB0-4f41-B61F-ED065738A397}SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions\crossriderapp498@crossrider.comHKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}RewardsArcade

Additional Information

The following directories were created:
%LOCALAPPDATA%\RewardsArcade%LOCALAPPDATA%\Updater498%PROGRAMFILES%\RewardsArcade%PROGRAMFILES(x86)%\RewardsArcade
Loading...