Virus and Spyware Removal Guides, uninstall instructions

What is Tick Tab Clock?

While inspecting rogue websites, our research team found the Tick Tab Clock browser extension. It is presented as a tool that provides aid with time keeping/managing. However, our analysis determined that Tick Tab Clock operates as a browser hijacker. This extension changes browser settings in order to promote the search.ticktabclock.net illegitimate search engine.

What is ConnectedField?

We discovered the ConnectedField application during a routine inspection of new submissions to VirusTotal. On our test system, this app ran intrusive ad campaigns, and due to this behavior - it is considered to be adware. Additionally, ConnectedField belongs to the AdLoad malware family.

What kind of email is "BRITISH CAMELOT ONLINE LOTTERY"?

After inspecting the "BRITISH CAMELOT ONLINE LOTTERY" email, we determined that it is spam operating as a phishing scam. It targets personally identifiable information by claiming that it must be provided to claim the lottery prize that the recipient has won.

It must be emphasized that these claims are false, and this spam mail is in no way associated with the Camelot Group, EuroMillions, or any other legitimate entities.

What kind of page is pushycaptcha[.]live?

Our team examined pushycaptcha[.]live and learned that it displays a deceptive message to lure visitors into agreeing to receive notifications. Additionally, pushycaptcha[.]live redirects to scam websites. We discovered pushycaptcha[.]live while inspecting websites that use rogue advertising networks.

What kind of email is "YоuTubе Suppоrt Shared An Item"?

Our inspection of the "YоuTubе Suppоrt Shared An Item" email revealed that it is spam. Likely targeting users with YouTube accounts, this scam is presented as a notification regarding a copyright-related document shared with the recipients by YouTube Support.

It is most probable that the shared file redirects to a phishing website aiming to obtain the account credentials of said video hosting/sharing platform.

It must be emphasized that this spam mail is in no way associated with the actual YouTube LLC.

What kind of scam is "We Are Using Your Company's Server To Send This Message"?

We inspected this email and found that this is an extortion scam email demanding ransom for not leaking the company's data. Scammers aim to trick recipients into believing that hackers will leak stolen data and damage their reputation if they do not make a payment. This is just a scam. Thus, this email should be ignored.

What is AXLocker ransomware?

AXLocker is a ransomware-type program. Malware of this type is designed to encrypt data (i.e., render files inaccessible) and demand payment for the decryption tools.

Typically, ransomware renames encrypted files - often by appending them with an additional extension. However, on our test machine AXLocker did not alter the filenames of the affected files. After the encryption was completed, this ransomware displayed a ransom note in a pop-up window.

Additionally, AXLocker targets Discord tokens, with which it can then acquire the log-in credentials of these accounts and other data associated with them. The stolen Discord account may then be used to carry out other malicious activity, such as impersonating the owner and asking their contacts for loans, proliferating malware, etc.

What is the "FIFTH THIRD BANK" scam email?

After examining this email, we concluded that it is a fake letter from Fifth Third Bank regarding suspicious account activity. Scammers behind this scam email aim to trick recipients into providing sensitive information on a deceptive website. This email should be ignored.

What kind of page is justpush[.]biz?

While inspecting spam emails, our researchers found one promoting the justpush[.]biz rogue website. This page pushes browser notification spam and redirects visitors to other (likely dubious/malicious) sites.

Aside from spam mail, websites like justpush[.]biz are often accessed via redirects caused by pages using rogue advertising networks, spam notifications, intrusive ads, or installed adware.

What is Search-Monster?

While inspecting rogue webpages, our research team found the Search-Monster browser extension. On our test machine, it modified browser settings to promote the searchmonster.net fake search engine. Therefore, Search-Monster is considered to be a browser hijacker.