Rescroller Chrome Extension

The Rescroller Chrome Extension that you may be offered to install after clicking on an ad is classified as adware. You may be induced to believe that the Rescroller Chrome Extension allows you to customize the look and feel of the scrollbars on the sites you visit. However, Rescroller does not perform as you might expect. Computer security researchers alert that the Rescroller Chrome Extension is not to be mistaken with the 'Rescroller' app by David Watkins on Chrome.google.com/webstore/detail/rescroller/ddehdnnhjimbggeeenghijehnpakijod. The Rescroller adware is presented to users via h[tt]p://jinlun007[.]com/cixv/?&type=media, which is flagged as an untrusted site. Loading h[tt]p://jinlun007[.]com/cixv/?&type=media triggers an audio recording of a male voice that says 'Click the add button to install extension' but the description on jinlun00 does not appear to be related to the Rescroller Chrome Extension. The app description shown on h[tt]p://jinlun007[.]com/cixv/?&type=media reads:

'One Click Button enables you to browse the internet without letting search providers track your history. One Click Button Chrome extension is free to download directly from the Chrome Web store. Our basic version of the service will be offered free of charge. By clicking ‘Add To Chrome,’ you agree to the Terms of Use and Privacy Policy and to change Chrome's Default Search.'

A quick look at the Terms of Use and Privacy Policy published on jinlun007[.]com/other.php?taskid=100180&tmpid=100012&extIds=100286&pageindex=terms.html and jinlun007[.]com/other.php?taskid=100180&tmpid=100012&extIds=100286&pageindex=privacy.html reveals that PC users are lead to install a tool called PrivSearch. We have mentioned the name PrivSearch in our article on the SrchUSk browser hijacker, where we discussed the browser redirects it performs. SrchUSk is known to reroute users via Privsearch[.]club to Search[.]hr and finally load Yahoo.com. Privsearch[.]club is a redirect-gateway and the PrivSearch services promoted on jinlun007[.]com are not what you would expect from a reliable search service like Google and its competitors. The Rescroller adware might connect to Privsearch[.]club and show advertisements in your browser from untrusted ad publishers. The Rescroller Chrome Extension behaves like the Image Downloader Chrome Extension and the 'Ipasta' Chrome Extension. The commercial content generated by Rescroller may be presented as floating ad boxes, pop-up windows and banners. Affected PC users may experience redirects to Yahoo and product pages on insecure online stores. It is best to remove the Rescroller Chrome Extension with the assistance of a trusted anti-spyware instrument and block access to pages like jinlun007[.]com.