Virus and Spyware Removal Guides, uninstall instructions

What kind of program is Three Seconds AdBlock Lite?

We have examined the Three Seconds AdBlock Lite browser extension and concluded that it functions as adware. When added and active, Three Seconds AdBlock Lite shows various advertisements. Also, this extension can read various data. Thus, users should not trust Three Seconds AdBlock Lite and remove it from affected browsers.

What kind of page is dwhitdoedsrag[.]org?

While investigating suspect sites, our research team discovered the dwhitdoedsrag[.]org rogue webpage. Upon examination, we determined that it promotes browser notification spam and redirects users elsewhere (likely dubious/malicious websites).

Pages like dwhitdoedsrag[.]org are most commonly accessed via redirects caused by sites using rogue advertising networks.

What kind of malware is Xam?

Our researchers found the Xam ransomware during a routine inspection of new file submissions to the VirusTotal platform. Ransomware is a type of malware that encrypts files in order to demand payment for the decryption (data recovery).

We obtained a sample of Xam and executed it on our testing system. The program encrypted files and appended their names with a ".xam" extension. For example, a file initially titled "1.jpg" appeared as "1.jpg.xam", "2.png" as "2.png.xam", and so on for all of the affected files. Once this process was finished, Xam created a ransom note titled "unlock.txt".

What is the fake "USDT NFT Airdrop"?

Upon examining the site (token-usdt[.]com), we discovered that it is a scan website copying tether[.]to. The purpose of the fake page is to trick visitors into believing that they can participate in an airdrop and receive cryptocurrency for free. The ultimate goal is to steal cryptocurrency assets from victims.

What kind of email is "Request To Cancel Your Services"?

After inspecting the "Request To Cancel Your Services" email, we determined that it is spam. This mail falsely claims that the recipient's email account was blocked due to a cancellation request sent to the service provider. The purpose of this fake message is to deceive users into providing their email account log-in credentials to a phishing website.

What kind of scam is "Crude Oil Trade"?

We have inspected the email and concluded that it is a scam offering recipients an investment opportunity. Typically, fraudsters behind such emails aim to extract money and (or) personal information from unsuspecting individuals. This and similar emails should be ignored.

What is the fake "RedStone Community Vote" site?

We have analyzed the vote.redstonecoin[.]network website and found that it hosts a crypto-related scam. The purpose of this deceptive page is to steal cryptocurrency assets from unsuspecting users. It is important to note that vote.redstonecoin[.]network is a copy of the real site, redstone[.]finance.

What is IntegerDrivePrivacy?

While inspecting the application, we found that it is designed to bombard users with intrusive advertisements. Consequently, we have categorized IntegerDrivePrivacy as adware. Users tend to install apps like IntegerDrivePrivacy unwittingly, often unaware of their functionality.

What kind of application is DataUpdate?

While inspecting new submissions to the VirusTotal platform, our researchers discovered the DataUpdate app. After analyzing it, we determined that this application is adware (advertising-supported software). DataUpdate is part of the AdLoad malware family.

What is the fake "BRETT Airdrop"?

We have inspected the 21-brett[.]com web page and found that it hosts a scam posing as a cryptocurrency airdrop held by the real Brett website (brett[.]fyi). Scammers behind the fake page aim to trick individuals into believing that they can participate in a cryptocurrency giveaway. However, victims of this scam are likely to lose their crypto funds.