Threat Database Adware OffersWizard

OffersWizard

By ESGI Advisor in Adware

Threat Scorecard

Ranking: 3,628
Threat Level: 20 % (Normal)
Infected Computers: 42,664
First Seen: December 6, 2013
Last Seen: September 18, 2023
OS(es) Affected: Windows

OffersWizard is used to generate advertisements revenue. OffersWizard is a Potentially Unwanted Program. Unlike viruses, malware, worms and Trojans, PUPs are not considered a threat and pose a lesser threat to your computer. However, although OffersWizard can be uninstalled as normal and does not have destructive consequences, its effects may be just as disruptive or irritating as many threats. Because of this, PC malware specialists strongly counsel that PC users remove OffersWizard immediately from the affected computer using the assistance of an ethical anti-malware program that is fully up to date.

OffersWizard Uses Its 'Magical Powers' to Favor Its Creators

OffersWizard is designed to generate revenue. There are various strategies in which OffersWizard may be used to make money for a third party at your expense. Below, security researchers have listed the three main ways in which OffersWizard generates revenue:

  • OffersWizard delivers advertisements to the victim's computer. OffersWizard is associated with pop-up advertisements, sliding advertisements, banner advertisements, video advertisements and in-text marketing links that cause pop-up windows to appear when the affected computer user passes the mouse cursor over them. These types of marketing materials generate advertisement revenue directly at the expense of affected computer users.
  • OffersWizard also causes Web browser redirects. This practice, known as browser hijacking, involves taking over the affected Web browser and redirecting it to determined websites repeatedly. Typically, OffersWizard redirects computer users to websites containing numerous advertisements and sponsored content. This allows marketers to generate revenue from affiliate marketing.
  • OffersWizard may also generate revenue through market research. OffersWizard may gather information about your online habits and Web browser settings. This information may be sold to an outsider and may be part of identity theft and other harmful practices.

Do not let marketers generate revenue at your expense! Security researchers strongly recommend that computer users remove OffersWizard immediately from an affected computer. Once OffersWizard has been uninstalled, it is important to verify that OffersWizard has not exposed the affected computer to other potentially unsafe content by scanning the affected computer with a reliable security program.

Aliases

15 security vendors flagged this file as malicious.

Anti-Virus Software Detection
Sophos Generic PUA JF
Avast Win32:Amonetize-CW [PUP]
Sophos Mal/Generic-L
Kaspersky Trojan-Downloader.Win32.Agent.aadeh
Avast Win32:Downloader-VLT [Trj]
Symantec PUA.Gen
McAfee PUP-Amonetize!38FA2BAF42C2
AhnLab-V3 Malware/Win32.Generic
Sophos Generic PUA NB
Comodo Application.Win32.Amonetize.NZ
Avast Win32:Downloader-VLS [Trj]
AVG Generic_r.PM
Sophos Mal/Generic-S
DrWeb Adware.Downware.6304
Comodo ApplicUnwnt

SpyHunter Detects & Remove OffersWizard

File System Details

OffersWizard may create the following file(s):
# File Name MD5 Detections
1. B9eG190.exe a117d93042eeca4e50cf6c8ebb3e8eda 4,486
2. e6OffersWizard66.exe 0646ef6df57bd5f5a7c6cf588e4cd9e1 4,231
3. L2h.exe 605594217cbb8354e8775e6d5d1dcf53 3,779
4. nethtsrv.exe 35608d966d4170cb1e7db6cbca7f3483 871
5. nethtsrv.exe 54c4553332aba68332dc050a600ab357 836
6. nethtsrv.exe ff13bdb494f6503961a234ebf8c82c9c 812
7. nethtsrv.exe 70a46a4ca8b5ab117ba499ed9c9b490d 658
8. nethtsrv.exe 2f6cc4f79d7fe782063caed6872b4c03 620
9. nethtsrv.exe df8f1f569a4610372140d88c7db62830 615
10. nethtsrv.exe e9044724c08fdbede0ab2d002eb19755 562
11. nethtsrv.exe 0aca0104dcad366dcabcbc0d8b8c3397 546
12. nethtsrv.exe 13e790020222fbf3e5e222cdf5a00fc6 521
13. nethtsrv.exe a4cebdb043eea12c2a7623797a52e0ff 515
14. nethtsrv.exe 27e781cc02153ee785c7f72506da68e3 502
15. 190.dll c57f160f4f68b467e8f9d30a06625794 498
16. nethtsrv.exe 842a3d831a79c00b191299e90e8c0942 492
17. nethtsrv.exe 32c6baa7bcd239d011821de0e14b6473 484
18. nethtsrv.exe bf3521310c48a41f41280817527ef314 308
19. nethtsrv.exe d8acc7d84d45f29b43d90b968595b9e9 298
20. nethtsrv.exe 4fffa8e0679cfc81ceb968b5e7711771 255
21. nethtsrv.exe e484eef0495d799771c59e42361b44ef 251
22. nethtsrv.exe a36e55b3f9d3320d6f2473d4d6d6183b 238
23. nethtsrv.exe 6413112ebb356a6d7d805cf2114537e4 237
24. nethtsrv.exe 9fd5d4d8f880d69ab824b4a6e8678cfe 232
25. B9eG190.exe dec6bf6338138379eac5220d434ae807 13
26. e6OffersWizard66.exe 7eb7f61e6f34a9ec18ad568aa1e00076 11
27. L2h.exe 6c06ccf468a5b114d5236eee282a391a 10
More files

Registry Details

OffersWizard may create the following registry entry or registry entries:
Regexp file mask
%WINDIR%\SysWOW64\hfnapi.dll
SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OffersWizard update
Software\OffersWizard
SYSTEM\ControlSet001\Enum\Root\LEGACY_NETHFDRV
SYSTEM\ControlSet001\services\nethfdrv
SYSTEM\ControlSet001\services\NetHttpService
SYSTEM\ControlSet002\Enum\Root\LEGACY_NETHFDRV
SYSTEM\ControlSet002\services\nethfdrv
SYSTEM\ControlSet002\services\NetHttpService
SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETHFDRV
SYSTEM\CurrentControlSet\services\nethfdrv
SYSTEM\CurrentControlSet\services\NetHttpService

Trending

Most Viewed

Loading...