Virus and Spyware Removal Guides, uninstall instructions

What kind of websites are sec-tl?

While browsing dubious sites, our researchers discovered a family of rogue webpages sharing the "sec-tl" domain. Pages belonging to this group differ by the number in their domain – sec-tl-129-b[.]buzz is an example.

The purpose of these webpages is to trick visitors into enabling browser notification delivery. Additionally, rogue pages can redirect users to other (likely untrustworthy/hazardous) websites.

Most visitors access sites like those from the sec-tl group via redirects caused by websites that employ rogue advertising networks.

What kind of website is goodtosearch.com?

Goodtosearch.com is an illegitimate search engine. This site cannot provide search results, so it redirects to other fake or genuine search engines. Websites of this kind are often endorsed by browser hijackers. Goodtosearch.com has also been observed featuring in redirection chains caused by browser-hijacking software.

What kind of software is EasySearch?

While inspecting a Torrenting website that uses rogue advertising networks, our researchers discovered a deceptive page endorsing a rogue installer. The setup contained the EasySearch browser extension. Upon analysis, we learned that it is a browser hijacker. EasySearch modifies browser settings to promote fake search engines.

What is the fake "Valorant Skin Giveaway"?

We have inspected the site (valbox[.]live) and concluded that it is a scam website promoting a fake giveaway. The purpose of this scam web page is to trick individuals into disclosing personal information. Users should avoid providing any details on dubious sites to avoid potential consequences.

What kind of page is uponminunan[.]com?

During our analyzis of uponminunan[.]com, we discovered that it is a fraudulent website that uses a clickbait technique to trick visitors into allowing it to deliver notification to their devices. We also found that uponminunan[.]com can redirect visitors to other web pages. Therefore, users should avoid uponminunan[.]com and not agree to receive its notifications.

What kind of website is doktox.com?

Doktox.com is a fake search engine. While this page is capable of providing search results, they are inaccurate and may include sponsored and possibly harmful content. Websites of this kind are commonly promoted (via redirects) by browser hijackers.

Our researchers discovered doktox.com when analyzing an installer obtained from a deceptive webpage. This setup contained the EasySearch browser hijacker.

What is gotoyahoo.com?

While analyzing gotoyahoo.com, we found that it is a fake search engine promoted via browser hijackers (extensions like Image Size Info). Fake search engines and extensions promoting them should be avoided. If they are present within browser settings and (or) added to browsers, they should be removed.

What kind of page is videov-click[.]com?

Our researchers found videov-click[.]com while browsing dubious websites. This rogue page endorses browser notification spam and redirects users to different (likely untrustworthy/hazardous) sites. Most visitors enter webpages like videov-click[.]com via redirects generated by websites utilizing rogue advertising networks.

What kind of malware is King?

King is a ransomware variant from the Proton family. Our team discovered King while inspecting malware samples submitted to VirusTotal. This ransomware encrypts files, appends an email address and the ".king" extension to filenames, and creates a file named "#Read-for-recovery.txt" (a ransom note). Also, King changes the desktop wallpaper.

An example of how King ransomware changes filenames: it renames "1.jpg" to "1.jpg.[king_ransom1@mailfence.com].king", "2.png" to "2.png.[king_ransom1@mailfence.com].king", and so forth.

What kind of page is topimg[.]click?

During our analysis of topimg[.]click, we found that the page aims to deceive visitors into permitting it to send notifications. Topimg[.]click displays misleading content to receive this permission. Sites like topimg[.]click should be avoided/not visited.