Virus and Spyware Removal Guides, uninstall instructions

What kind of page is captchawizard[.]top?

After conducting our investigation, our team identified captchawizard[.]top as an untrustworthy website that uses deceptive methods to trick visitors into granting permission for notifications. It is common for users to come across websites like captchawizard[.]top inadvertently. We discovered it during an examination of other suspicious websites.

What kind of malware is Minas?

Minas is the name of a cryptocurrency mining malware. It is based on the legitimate XMRIG application designed to mine Monero cryptocurrency. Malware within this classification puts enormous strain on infected machines – thus endangering system and hardware health.

What kind of page is akice-co[.]in?

Our researchers discovered the akice.co[.]in rogue site during a routine inspection of untrustworthy websites. It is designed to promote browser notification spam and, at the time of research, used fake CAPTCHA verification for this purpose. Additionally, this page can redirect visitors to different (likely unreliable/dangerous) websites.

Most visitors to webpages like akice-co[.]in enter them through redirects caused by sites that use rogue advertising networks.

What kind of software is Best Wallpapers?

While investigating dubious webpages, our researchers discovered the Best Wallpapers browser extension. It is endorsed as a tool that displays browser wallpapers.

After installing this extension on our test machine, we learned it is a browser hijacker. Best Wallpapers modifies browser settings to promote (via redirects) the search.wallpaperhomepage.com illegitimate search engine.

What kind of application is DoubleCache?

Our research team discovered the DoubleCache application while investigating new submissions to VirusTotal. After analyzing this piece of software, we determined that it is adware. It is worth noting that DoubleCache is part of the AdLoad malware family.

What is Adfuhbazi ransomware?

Adfuhbazi is a ransomware-type program that our researchers discovered while reviewing new submissions to the VirusTotal website. This malicious program is part of the Snatch ransomware family.

On our testing system, Adfuhbazi encrypted files and appended their filenames with a ".adfuhbazi" extension. To elaborate, a file originally named "1.jpg" appeared as "1.jpg.adfuhbazi", "2.png" as "2.png.adfuhbazi", and so on for all of the encrypted files.

After this process was completed, a ransom note titled "HOW TO RESTORE YOUR ADFUHBAZI FILES.TXT" was created. Based on the message therein, it is clear that this ransomware targets large entities rather than home users.

What kind of page is online-deal[.]click?

Upon examining online-deal[.]click, we found that it is a deceptive website running a scam similar to "Your PC is infected with 5 viruses!". Additionally, online-deal[.]click wants to show notifications. We discovered online-deal[.]click while inspecting various pages that use rogue advertising networks.

What kind of page is checkrobotpage[.]online?

In our examination of pages associated with dubious advertising networks, we encountered checkrobotpage[.]online. Our findings revealed that this website uses a clickbait strategy to mislead visitors into granting notification permission and redirects them to fraudulent websites. Therefore, it is recommended to refrain from accessing checkrobotpage[.]online.

What kind of malware is JSOutProx?

JSOutProx is a JScript-based Remote Access Trojan (RAT). Malware within this classification operates by enabling remote access and control over infected machines. RATs tend to be highly multifunctional pieces of software capable of performing various actions.

JSOutProx has been in use since at least as early as 2020. Attacks featuring this RAT were observed targeting the government and finance related entities based in India. JSOutProx infections predominantly originated from malspam campaigns.

What kind of malware is ObserverStealer?

ObserverStealer is an information-stealing malware. It is available for purchase at a price of $150 per month, targeting Windows operating systems from Windows 8.1 to Windows 11. The creators of ObserverStealer claim that the malware is still in Beta, indicating ongoing development and potential for further enhancements by the cybercriminals involved.