Virus and Spyware Removal Guides, uninstall instructions

What is peachlandus[.]com?

In most cases, websites such as peachlandus[.]com display fake virus alert pop-ups stating that the visitor's device is infected, compromised, damaged, or harmed in some other way. In summary, they use deceptive methods to trick visitors into downloading and installing a potentially unwanted application (PUA), which supposedly removes viruses, secures the device, etc.

Note that peachlandus[.]com suggests that the device is hacked, may be infected with viruses, browsing activity may be unsecured, and it promotes at least two different PUAs.

What is CryptPethya?

CryptPethya belongs to the family of ransomware called Xorist. It not only encrypts and renames victims' files, but also changes the desktop wallpaper and creates the "HOW TO DECRYPT FILES.txt" file in all folders that contain encrypted files.

CryptPethya renames files by appending its name as the extension (".CryptPethya"). For example, "1.jpg" is renamed to "1.jpg.CryptPethya", "2.jpg" to "2.jpg.CryptPethya", and so on.

What kind of page is 4anime[.]to

As its domain name suggests, 4anime[.]to is a website offering an anime streaming service. There are two problems with this web page: 1) it is a pirate site that illegally distributes copyrighted content, and; 2) it uses rogue advertising networks (containing dubious ads). Neither 4anime[.]to nor other similar websites are legitimate, and should be avoided.

What is the Coinbase email scam?

In most cases, phishing emails are sent by scammers who attempt to trick recipients into providing sensitive, personal information such as credit card details, login credentials (e.g., username, email address, password), social security numbers and other details. Most are disguised as official, important messages from legitimate companies, but these bogus emails should never be trusted.

What kind of malware is NuggetPhantom?

NuggetPhantom is a modularized malware toolkit consisting of three types of modules for deployment, download, and function execution. It targets computers that contain the EternalBlue vulnerability. Research shows that NuggetPhantom is used for cryptohijacking and DDoS attacks.

What is CompellingState?

CompellingState functions as adware and as a browser hijacker. It generates advertisements and modifies browser settings without users' permission. It is also likely to collect browsing-related (and other) information.

Typically, users do not download or install these apps intentionally and, therefore, they are categorized as potentially unwanted applications (PUAs). Note that this app is distributed via a fake installer for Adobe Flash Player.

What is the YOUR IPHONE HAS BEEN COMPROMISED scam?

There are many scam websites designed to display fake virus alerts, pop-up windows that suggest that users' devices are infected. These websites often seem similar to official Apple pages and usually contain a "Remove Virus" button linking users to a supposed security application.

In summary, these bogus web pages are used to trick people into downloading and installing a potentially unwanted application (PUA).

What is search.validexplorer.com?

search.validexplorer.com is the address of a fake search engine. Typically, these URLs appear in browser settings after installation of a browser hijacker. Users often download and install browser hijackers unintentionally and, for this reason, they are categorized as potentially unwanted applications (PUAs).

Note that these apps often promote a fake search engine and collect browsing (and other) data. Note that the app that promotes search.validexplorer.com also adds the "Managed by your organization" feature to Chrome browsers.

What is Lockerxxs?

Lockerxxs belongs to the Xorist ransomware family. It is designed to encrypt victims' files, rename each encrypted file, display a pop-up window/ransom message, and create the "HOW TO DECRYPT FILES.txt" file (another ransom message).

It renames files by appending the ".lockerxxs" extension. For example, "1.jpg" is renamed to "1.jpg.lockerxxs", "2.jpg" to "2.jpg.lockerxxs", and so on.

What is search.accessiblelist.com

search.accessiblelist.com is a fake search engine. Most sites of this type are promoted via browser hijackers, apps that modify browser settings without users' permission.

One app known to promote search.accessiblelist.com is called SkilledSearchAdvise, which not only promotes this site but also adds the "Managed by your organization" feature to Chrome browsers. It is also likely to collect browsing-related (and other) information.