Virus and Spyware Removal Guides, uninstall instructions

What kind of email is "Zoho WorkDrive"?

Our examination of the "Zoho WorkDrive" email revealed that it is spam. It is presented as a notification concerning a shared Zoho WorkDrive link. It must be emphasized that this fake email is in no way associated with the Zoho Corporation or any of its products and services. This is a phishing campaign that targets log-in credentials.

What kind of software is Downloading Pro Media?

While inspecting dubious sites, our researchers discovered the Downloading Pro Media browser extension. It is promoted as a tool for downloading a wide variety of content and managing downloads. Our analysis revealed that Downloading Pro Media is advertising-supported software (adware).

What kind of malware is BurnsRAT?

BurnsRAT is malware that allows cybercriminals to access the infected computer remotely. This type of malware is known as a Remote Administration Trojan. Threat actors were observed using BurnsRAT as a tool to deploy other malicious software. If BurnsRAT is present in the system, it should be eliminated immediately to prevent potential damage.

What kind of email is "Contract/Inheritance/Winning Payment"?

After reading this "Contract/Inheritance/Winning Payment" email, we determined that it is spam. It claims that the recipient did not receive their contract, inheritance, or prize payment – and to withdraw it, they must provide their details.

The information in this email is false and in no way associated with any genuine entities. This is a phishing campaign that targets personally identifiable data.

What kind of scam is "Viruses Have Been Detected On Your Phone"?

We have examined this scam and concluded that it involves fake warnings to trick unsuspecting users into downloading a specific application. Falling for such scams can expose users to privacy and security risks. Thus, it is important to recognize and avoid these scams.

What is the fake "Blockchain.com Money Transfer"?

While investigating spam emails, our researchers discovered the "Blockchain.com Money Transfer" scam. It masquerades as Blockchain.com – a cryptocurrency financial services company that provides various crypto-related services, including an exchange platform and digital wallet.

This fake site claims that the user has an incoming Bitcoin transfer and they need to pay a commission to receive it. Thus, victims are tricked into paying scammers.

What kind of page is initiatehighlyoriginalthe-file[.]top?

We have reviewed initiatehighlyoriginalthe-file[.]top and found that it displays misleading content to lure visitors into permitting it to show notifications. Allowing notifications from sites like initiatehighlyoriginalthe-file[.]top can expose users to scams and other risks. It is recommended to avoid initiatehighlyoriginalthe-file[.]top.

What kind of page is tonbaks[.]com?

Our team has inspected tonbaks[.]com and found that it displays questionable content and wants to show notifications. Accepting notifications from sites like tonbaks[.]com can expose users to various scams and other threats. Therefore, users should avoid tonbaks[.]com and not allow it to send notifications.

What kind of malware is MAGA?

MAGA is ransomware from the Dharma family. It is designed to encrypt files, display a ransom note in a pop-up message (and create another ransom note as a text file, "MAGA_info.txt"), and rename files. Our team discovered MAGA during examination of malware samples submitted to VirusTotal.

MAGA renames files by appending the victim's ID, an email address, and the ".MAGA" extension. For example, it changes "1.jpg" to "1.jpg.id-9ECFA84E.[MAGA24@cyberfear.com].MAGA", "2.png" to "2.png.id-9ECFA84E.[MAGA24@cyberfear.com].MAGA", and so forth.

What kind of page is boasaikaipt[.]com?

Our research team discovered the boasaikaipt[.]com rogue page while browsing websites. Upon examination, we learned that this webpage promotes browser notification spam and redirects users to other (likely untrustworthy/hazardous) sites.

The majority of visitors to pages like boasaikaipt[.]com access them via redirects caused by websites utilizing rogue advertising networks.