Virus and Spyware Removal Guides, uninstall instructions

What kind of site is top-search.xyz?

Our examination has revealed that top-search.xyz is a fake search engine. Such search engines are usually promoted through browser hijackers, which users unknowingly install on computers or add to browsers as apps. As a result, the browser settings are modified without their knowledge or consent.

What kind of malware is Fleckpe?

Fleckpe is a recently discovered Android Trojan family found on Google Play, which secretly subscribes victims to paid services. This Trojan primarily affects users in Thailand. It has been active since the start of 2022 and is continuously updated with new capabilities.

What kind of page is oneettinlive[.]com?

While examining websites that utilize illegitimate advertising networks, our team found oneettinlive[.]com, an untrustworthy webpage that presents visitors with deceitful material to trick them into enabling browser notifications. Typically, users do not intentionally visit sites like oneettinlive[.]com.

What kind of application is Quick Close Tab?

While testing the Quick Close Tab extension, we found that it is supposed to close the current tab in a context menu but shows advertisements. Thus, we classified Quick Close Tab as adware. It is worth noting that our team discovered Quick Close Tab on a deceptive website.

What kind of malware is Foty?

During our examination of malware samples submitted to VirusTotal, we came across a ransomware variant belonging to the Djvu family, dubbed Foty. This ransomware encrypts files and adds the ".foty" extension to the filenames. Additionally, Foty also leaves a ransom note file called "_readme.txt".

As part of the Djvu ransomware family, Foty may be distributed alongside other malware like RedLine or Vidar, which are known to steal user information. An example of how Foty changes filenames: it renames "1.jpg" to "1.jpg.foty", "2.png" to "2.png.foty", and so forth.

What kind of page is nongloths[.]com?

Our research team discovered the nongloths[.]com rogue page while inspecting suspicious websites. It is designed to promote spam browser notifications and redirect users to different (likely unreliable/dangerous) sites. Users typically enter webpages like nongloths[.]com through redirects caused by sites that employ rogue advertising networks.

What kind of page is nkingwitheaam[.]com?

Nkingwitheaam[.]com is a rogue website that we discovered during a routine inspection of suspicious pages. It is designed to promote browser notification spam and redirect visitors to other (likely untrustworthy/harmful) sites. Users typically access webpages like nkingwitheaam[.]com via redirects caused by sites using rogue advertising networks.

What is Tropical Horizons Wallpapers?

Our researchers found the Tropical Horizons Wallpapers browser extension while inspecting deceptive websites. This piece of software promises to display tropics-themed wallpapers. However, our investigation revealed that Tropical Horizons Wallpapers operates as a browser hijacker, i.e., it makes alterations to browser settings in order to promote (via redirects) the search.tropicalhorizonext.com fake search engine.

What kind of email is "Improvements To All Our e Mail Servers"?

Our inspection of the "Improvements To All Our e Mail Servers" email revealed that it is spam. It falsely claims that the mail servers are undergoing upgrades, which if not implemented – will result in the recipient's email account getting deactivated. This scam letter aims to steal account log-in credentials through a phishing website.

What is Homerun Extension?

While investigating deceptive websites, our research team discovered the Homerun Extension. This browser extension is endorsed as a tool that allows for easy access to the latest sports news and other content.

Our analysis of this piece of software revealed that it is a browser hijacker. Homerun Extension operates by modifying browser settings in order to promote (via redirects) the search.homerun.fun fake search engine.