Virus and Spyware Removal Guides, uninstall instructions

What is the fake "Wallet Guard" website?

While browsing suspect websites, our researchers discovered this fake "Wallet Guard" page (walletguard-a6b.pages[.]dev; could be hosted elsewhere). It is disguised as a free tool for detecting various crypto-centered scams, including drainers.

Instead of providing these services, the bogus webpage operates as a cryptocurrency drainer. In other words, it facilitates the theft of digital assets from compromised wallets. It must be emphasized that the fake "Wallet Guard" is not associated with any existing software, services, or entities.

What kind of malware is Evidence Of Child Pornography?

Evidence Of Child Pornography ransomware is a type of malware designed to encrypt the victim's files. Also, this ransomware provides two ransom notes ("READ ME !.txt" and "[username]_GUI.html") and appends a random extension to filenames. For example, it renames "1.jpg" to "1.jpg.d3prU", "2.png" to" 2.png.d3prU", and so forth.

What kind of page is strognethipst[.]com?

Our research team discovered strognethipst[.]com while investigating untrustworthy sites. This rogue webpage promotes browser notification spam and generates redirects to different (likely dubious/malicious) websites.

Pages like strognethipst[.]com are most commonly accessed via redirects caused by websites that utilize rogue advertising networks.

What is the fake "GetFit Mining" website?

While investigating suspect sites, our researchers discovered this fake "GetFit Mining" webpage – getfitmining.pages[.]dev (note that this scam could also be hosted on other domains). It is presented as a blockchain platform that offers users various rewards and purchase opportunities.

This scheme operates as a cryptocurrency drainer. Victims of this scam experience financial loss. It must be emphasized that regardless of potential visual similarities to existing platforms, this fake page is not associated with any of them.

What kind of page is thoabsoul[.]com?

Upon examining thoabsoul[.]com, we concluded that it is an untrustworthy website hosting a fraudulent survey. Also, thoabsoul[.]com aims to receive permission to send notifications to devices. Users should not grant sites like thoabsoul[.]com permission to show notifications and avoid visiting them.

What kind of page is srmadsmebook[.]org?

Our team has inspected srmadsmebook[.]org and discovered that it is one of the numerous websites designed to trick visitors into agreeing to receive their notifications. Once visited, srmadsmebook[.]org presents misleading content to lure visitors into permitting it to show notifications.

What kind of malware is Moon?

During an examination of malware samples uploaded to VirusTotal, our team discovered a ransomware variant known as Moon. This ransomware encrypts files and renames them by appending a string of various characters and the ".moon" extension to filenames. Also, Moon drops a ransom note named "README.txt".

An example of how Moon modifies filenames: it changes "1.jpg" to "1.jpg.{BA3484B5-A99A-8A49-AD7D-5C03B1A5A254}.moon", "2.png" to "2.png.{BA3484B5-A99A-8A49-AD7D-5C03B1A5A254}.moon", and so forth. It is worth noting that this ransomware is identical to other variants, such as Pwn3d, Orbit, Anyv, MoneyIsTime, and Beast.

What kind of page is protectedscans[.]com?

We have inspected protectedscans[.]com and found it to be a misleading website. On protectedscans[.]com, visitors are presented with a fake warning and a request to show notifications. Websites like protectedscans[.]com should never be visited or allowed to send notifications.

What kind of scam is "Moving Funds To Your Account"?

Our research has shown that it is a scam email offering recipients a large sum of money in return for cooperation. Typically, scammers behind scams like this (known as advance-fee scams) seek to trick recipients into sending them money and (or) personal information. It is advisable not to respond to such emails to avoid potential issues.

What kind of page is webtetradslive[.]com?

Webtetradslive[.]com is a rogue page discovered by our research team during a routine investigation of suspicious websites. After inspecting the webpage, we determined that it endorses browser notification spam and redirects visitors to different (likely unreliable/dangerous) sites.

Users primarily access pages like webtetradslive[.]com via redirects generated by websites that employ rogue advertising networks.