Virus and Spyware Removal Guides, uninstall instructions

What kind of malware is Qepi?

Qepi is ransomware designed to encrypt files, append the ".qepi" extension to filenames, and provide a ransom note ("README.txt"). We discovered Qepi during an analysis of malware samples submitted to VirusTotal. It is important to mention that Qepi is part of the Djvu family and may be distributed together with information stealers like RedLine or Vidar.

Here is an example of how Qepi modifies filenames: it renames "1.jpg" to "1.jpg.qepi"," "2.png" to "2.png.qepi", and so forth.

What kind of page is colorattaches[.]com?

Colorattaches[.]com is a rogue page discovered by our research team during a routine investigation of dubious websites. Upon examination, we determined that this webpage uses fake CAPTCHA verification to push browser notification spam. Additionally, it can redirect users to other (likely dubious/malicious) sites.

Visitors to colorattaches[.]com and similar pages enter them predominantly via redirects generated by websites using rogue advertising networks.

What kind of application is ProjectRootEducate?

While inspecting new file submissions to the VirusTotal site, our research team discovered the ProjectRootEducate app. After analyzing it, we learned that this application is adware from the AdLoad malware family. ProjectRootEducate is designed to generate revenue for its developers through advertising.

What kind of page is datingkoe[.]info?

While investigating suspicious websites, our researchers discovered the datingkoe[.]info rogue webpage. It operates by promoting browser notification spam and redirecting users to other (likely untrustworthy/dangerous) sites.

Most visitors to datingkoe[.]info and pages akin to it access them through redirects generated by websites that employ rogue advertising networks.

What kind of scam is "PayPal Crypto Purchase Invoice"?

We have examined the email and determined that it is a phishing email intended to steal personal information and (or) money from unsuspecting individuals. This scam email is disguised as a notification from PayPal regarding an invoice. Recipients should ignore this email.

What kind of application is OpenProcess?

OpenProcess is a piece of software that is classified as adware. Our researchers found this application during a routine investigation of new file submissions to the VirusTotal platform. OpenProcess belongs to the AdLoad malware family, and it runs intrusive advertisement campaigns.

What is the fake "Grayscale ($GRAY) Airdrop"?

After investigating the "Grayscale ($GRAY) Airdrop", as promoted on event-grayscale[.]com, we determined that it is fake. This scam is an almost perfect copy of the Grayscale platform (grayscale.com).

This bogus giveaway operates as a crypto drainer that siphons cryptocurrency from compromised digital wallets. It must be stressed that this scheme is not associated with any existing platforms or entities.

What kind of application is PublicAnalog?

During our analysis of PublicAnalog we observed that the app functions as adware. While active, it delivers annoying advertisements. It is also common for apps like PublicAnalog to be capable of accessing (and gathering) various data. Thus, it is recommended to uninstall PublicAnalog from affected devices.

What kind of malware is WaveStealer?

WaveStealer (also known as Wave Stealer) is a malware designed to steal information. Its developers are offering the malicious program for sale, and they promote it as a highly versatile tool. WaveStealer targets log-in credentials (usernames/passwords), credit card numbers, cryptocurrency wallets, and other sensitive data.

What kind of website is brandnewsearch.com?

Brandnewsearch.com is the address of a fake search engine. It is endorsed (via redirects) by the Brand New Search rogue browser extension. It modifies browser settings to generate these redirects, and due to this behavior – Brand New Search is categorized as a browser hijacker.