Virus and Spyware Removal Guides, uninstall instructions

What kind of email is "Anti-Fraud International Monitoring Group Compensation"?

We have examined this email and determined that it is a scam. The scammers behind this letter pretend to be Mrs. Amina Mohammed, Deputy Secretary-General of the United Nations. Their goal is to trick recipients into believing they are eligible for significant monetary compensation.

What kind of application is Nature NewTab Extension?

We found that NewTab Extension is a browser extension that promotes naturenewtabextension.com by hijacking a web browser. Naturenewtabextension.com is a fake search engine that does not provide unique results. Users often unintentionally download and install/add browser hijackers.

What kind of malware is TgToxic?

TgToxic is the name of an Android banking malware. It is a malicious program that seeks to acquire finance-related information.

This malware has been active in Southeast Asia as early as July 2022. The initially observed campaigns targeted Taiwanese users and later expanded to Thailand and Indonesia. Various social engineering techniques were implemented in TgToxic's proliferation, including (but not limited to) graphic adult-oriented content lures, smishing, and cryptocurrency-centric scams.

What kind of page is porptogred[.]com?

Our team has investigated porptogred[.]com and learned that it is an unreliable website that displays a misleading message to trick visitors into agreeing to receive notifications. Visitors often inadvertently access sites like porptogred[.]com. We found porptogred[.]com while inspecting pages that use dubious advertising networks.

What kind of malware is Adrianov?

While examining malware samples submitted to VirusTotal, we discovered a ransomware variant based on Chaos ransomware dubbed Adrianov. This variant encrypts data, modifies filenames of all encrypted files, changes the desktop wallpaper, and drops the "andrianov.txt" file containing contact, payment, and other information.

Adrianov appends the ".1iyT6bav7VyWM5" extension to filenames (the extension may vary depending on Adrianov's variant). For instance, it renames "1.jpg" to "1.jpg.1iyT6bav7VyWM5", "2.doc" to "2.doc.1iyT6bav7VyWM5", etc.

What kind of malware is PixPirate?

The PixPirate is a dangerous Android banking Trojan that has the capability to carry out ATS (Automatic Transfer System) attacks. This allows threat actors to automatically transfer funds through the Pix Instant Payment platform, which numerous Brazilian banks use.

In addition to launching ATS attacks, PixPirate can intercept and delete SMS messages, prevent the uninstallation process, and carry out malvertising attacks.

What kind of page is starvardsee[.]xyz?

We discovered starvardsee[.]xyz while examining websites that use rogue advertising networks. After analyzing starvardsee[.]xyz, we determined that it displays misleading content to gain permission to show questionable notifications and redirects users to other untrustworthy pages.

What kind of page is sossiotron[.]com?

Our researchers found the sossiotron[.]com rogue page during a routine inspection of suspicious websites. This webpage operates by promoting spam browser notifications and redirecting users to different (likely unreliable/malicious) sites. Users typically enter pages through redirects caused by websites that use rogue advertising networks.

What kind of page is advnotmoney[.]com?

While investigating questionable sites, our researchers discovered the advnotmoney[.]com rogue webpage. It is designed to promote spam browser notifications and redirect visitors to other (likely unreliable or malicious) websites.

Pages like advnotmoney[.]com are most commonly accessed via redirects caused by sites that use rogue advertising networks, spam notifications, intrusive ads, or installed adware.

What kind of page is advertizmenttoyou[.]com?

Advertizmenttoyou[.]com is a rogue page that our researchers discovered while checking out suspicious websites. This webpage pushes browser notification spam. Furthermore, advertizmenttoyou[.]com can redirect visitors to other (likely unreliable/harmful) sites. Most users access such pages through redirects caused by websites that use rogue advertising networks.