Virus and Spyware Removal Guides, uninstall instructions

What kind of page is bellpepa.co[.]in?

Bellpepa.co[.]in is a rogue page discovered by our researchers during a routine inspection of suspect websites. Upon investigation, we determined that this webpage promotes browser notification spam and generates redirects to different (likely untrustworthy/hazardous) sites.

Most visitors enter bellpepa.co[.]in and similar pages via redirects caused by websites utilizing rogue advertising networks.

What kind of email is "Your Transaction Has Been Released"?

After reading this "Your Transaction Has Been Released" email, we determined that it is spam. This fake message states that the recipient's funds have finally been released, and they are urged to contact the sender with their details for further information on how to claim the exorbitant sum. Once contacted, the scammers may request additional personal data or to send them money.

What kind of malware is HaroldSquarepants?

While browsing files submitted to the VirusTotal website, our researchers found the HaroldSquarepants ransomware. It is part of the GlobeImposter ransomware family. Like most programs within this classification, HaroldSquarepants encrypts data and demands ransoms for its decryption.

On our testing system, this ransomware encrypted files and added a ".247_haroldsquarepants" extension to their filenames. To elaborate, a file originally named "1.jpg" appeared as "1.jpg.247_haroldsquarepants", "2.png" as "2.png.247_haroldsquarepants", etc.

After this process was completed, HaroldSquarepants created a ransom-demanding message in an HTML file titled "how_to_back_files.html".

What kind of malware is GonzoFortuna?

GonzoFortuna is a ransomware-type program discovered by our research team during a routine inspection of new submissions to the VirusTotal platform. This malicious program belongs to the MedusaLocker ransomware family. GonzoFortuna is designed to encrypt data and demand payment for the decryption.

On our testing machine, GonzoFortuna appended the names of encrypted files with a ".gonzofortuna" extension. For example, a file initially titled "1.jpg" appeared as "1.jpg.gonzofortuna", "2.png", "2.png.gonzofortuna", and so on.

After the encryption process was completed, ransomware created a ransom note in an HTML file named "How_to_back_files.html". Based on the message therein, it is evident that GonzoFortuna targets companies and uses double-extortion tactics.

What kind of page is dr23[.]biz?

We have inspected dr23[.]biz and found that its purpose is to obtain permission to show notifications through deception. This website uses clickbait to trick visitors into agreeing to receive its notifications. Users should avoid visiting sites like dr23[.]biz and never grant them permission to send notifications to avoid potential risks.

What kind of scam is "Coca Cola Survey"?

While investigating suspicious sites, our researchers discovered this "Coca Cola Survey". It is a survey-type scam in which users are asked to complete a questionnaire for a reward from Coca-Cola.

It must be emphasized that this scheme is in no way associated with the actual Coca-Cola Company. This scam may trick victims into revealing sensitive information or sending money to scammers.

What kind of page is creritaprets[.]com?

After reviewing creritaprets[.]com, we found it to be a fraudulent site designed to trick users into allowing it to send notifications. It employs a clickbait technique to accomplish this. To minimize the risk of online threats, users should avoid visiting sites like creritaprets[.]com (and never permit them to show notifications).

What kind of page is earthshaper[.]top?

We have examined earthshaper[.]top and discovered that it is a fraudulent site created to lure visitors into accepting its request to show notifications. Earthshaper[.]top uses a technique known as clickbait to achieve this. Users should avoid visiting web pages like earthshaper[.]top to avoid exposure to online threats.

What kind of malware is Annoy?

Our research team discovered the Annoy ransomware while investigating file submissions to the VirusTotal platform. Malicious software within this class encrypts data and demands payment for the decryption.

On our testing system, Annoy encrypted files and altered their filenames. Original titles were appended with an ID assigned to the victim in curly brackets and the ".annoy" extension. For example, a file initially named "1.jpg" appeared as "1.jpg.{FBDC1672-D8E4-6322-BAAA-BCC19668745C}.annoy".

Once the encryption process was completed, Annoy ransomware created a ransom note in a text file titled "README.TXT".

What kind of page is daynitroglass[.]com?

We have inspected daynitroglass[.]com and discovered that it employs clickbait to obtain permission to send notifications to users (to their devices). If permitted, daynitroglass[.]com may display deceptive notifications to trick users into visiting untrustworthy websites and (or) taking other actions.