# MA-722.052019: MyCERT Alert - Fake Windows PC Cleaner

**Date:** 06 May 2019  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-722.052019  
**Advisory ID:** MA-722.052019

---

**1.0 Introduction**
MyCERT is aware of the existence of a website pushing a PC cleaner tool for Windows, that it is just a front for the Azorult password and information stealing trojan.
Instead of renting distribution methods such as spam, exploit kits, or being dropped by other trojans, the attackers decided to create a fake Windows utility and an accompanying web site to distribute the trojan instead.
Last month, security research Benkow discovered a website named gcleaner[dot]info that was advertising a Windows junk cleaner tool called G-Cleaner or Garbage Cleaner. The site, which is still up as of this writing, is well made and looks like any other legitimate site promoting a program that they created.
According to the site, G-Cleaner or Garbage Cleaner is a Windows junk cleaner that removes temporary files, broken shortcuts, and unnecessary Registry entries. Overall, it's promoted like all the other system optimization tools that we see regularly being offered.
**2.0 Impact**
AZORult is a trojan that when installed attempts to steal a user's browser passwords, FTP client passwords, cryptocurrency wallets, desktop files, and much more.
**3.0 Affected Product**
• Windows based platforms
**4.0 Recommendations**
• Users should research a site before downloading and installing a program to determine if they have a good reputation and can be trusted.
• It is always suggested that you upload the program to a site like VirusTotal to confirm if it's safe to run.
**5.0 References**
• <https://www.bleepingcomputer.com/news/security/fake-windows-pc-cleaner-drops-azorult-info-stealing-trojan/>
• <https://cyware.com/news/fake-windows-pc-cleaner-drops-azorult-info-stealing-trojan-7d3c1763>
Generally, MyCERT advises the users of this product to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#ff9c869d9a8dc6c6c6bf9c869d9a8d8c9a9c8a8d968b86d19286) or [[email protected]](/cdn-cgi/l/email-protection#600d1903051214200d19030512144e0f12074e0d19)
Phone: 1-300-88-2999 (monitored during business hours)
Handphone: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYT
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://www.mycert.org.my/portal/advisory?id=MA-720.042019) or [Android Users](https://www.mycert.org.my/portal/advisory?id=MA-720.042019)