Virus and Spyware Removal Guides, uninstall instructions

What kind of page is buyrondureonline[.]com?

Our research team discovered the buyrondureonline[.]com rogue page while investigating suspicious websites. It operates by promoting browser notifications spam; at the time of research, it did so by using fake CAPTCHA verification. Additionally, this webpage can redirect visitors elsewhere (likely untrustworthy/dangerous) sites.

Users primarily access pages like buyrondureonline[.]com via redirects caused by websites that use rogue advertising networks, misspelled URLs, spam notifications, intrusive ads, or installed adware.

What is SystemConfig?

While inspecting new submissions to VirusTotal, our research team discovered the SystemConfig application. Our analysis of this app revealed that it operates as adware and belongs to the AdLoad malware family. SystemConfig is designed to display advertisements and may have additional harmful functionalities.

What kind of page is aluationiamcur[.]com?

Aluationiamcur[.]com is a rogue webpage that we discovered while investigating suspicious sites. It is designed to promote browser notification spam and redirect users to different (likely dubious/dangerous) websites. Users typically access pages like aluationiamcur[.]com via redirects caused by websites that use rogue advertising networks.

What kind of email is "Reconfirm Shipping Documents"?

Our examination of the "Reconfirm Shipping Documents" email revealed that it is spam. This scam letter requests the recipient to reconfirm the attached documentation. The two attachments are phishing files that record the information entered into them.

What kind of email is "McAfee FINAL WARNING"?

After inspecting this "McAfee FINAL WARNING" email, we determined that it is spam which operates as a phishing scam. The letter is presented as a warning from McAfee regarding detected threats on the recipient's device. This spam mail aims to deceive recipients into disclosing their email account log-in credentials.

It must be stressed that this letter is in no way associated with the actual McAfee Corp.

What kind of scam is "Your Account Expiry"?

Upon examination, we have identified that this email is a phishing scam that masquerades as a notification from an email service provider. Its objective is to trick recipients into visiting a fraudulent website and revealing sensitive information. Consequently, we advise recipients to ignore this email.

What kind of malware is Evil Extractor?

Evil Extractor (EvilExtractor) is a tool utilized for stealing sensitive data from users in Europe and the U.S. It is marketed by Kodex, a company that charges $59 per month for its use. Despite being advertised as a legitimate tool, Evil Extractor is predominantly promoted on hacking forums to attract threat actors.

The tool features seven attack modules, including ransomware, credential extraction, and bypassing Windows Defender.

What kind of email is "Blockchain.com - Verify Your Device"?

After inspecting the "Blockchain.com - Verify Your Device" email, we determined that it is fake. This spam letter states that a suspicious sign-in has been observed on the recipient's Blockchain.com account and requires them to verify their device. The goal of this scam mail is to extract users' account log-in credentials through a phishing website.

It must be emphasized that this email is in no way associated with the actual Blockchain.com cryptocurrency financial services company.

What kind of malware is VoNiX?

VoNiX is one of the ransomware variants belonging to the Xorist family. We discovered VoNiX while inspecting malware samples submitted to VirusTotal. Our investigation revealed that apart from encrypting files, VoNiX changes the desktop wallpaper, displays an error message, and creates the "HOW TO DECRYPT FILES.txt" file.

The text file, pop-up message, and desktop wallpaper contain the same ransom note. An example of how VoNiX modifies filenames: it changes "1.jpg" to "1.jpg.VoNiX", "2.png" to "2.png.VoNiX", and so forth.

What kind of scam is "You Could Be In Trouble With The Law"?

After conducting an investigation, we have determined that the email in question is a sextortion scam, designed to deceive recipients into thinking that they must pay a specified amount of money to the sender to prevent the release of embarrassing material. We strongly advise recipients to disregard this email and any similar ones.