Virus and Spyware Removal Guides, uninstall instructions

What kind of page is posto[.]click?

While examining posto[.]click, our team found that this page runs the "McAfee - Your PC is infected with 5 viruses!" scam and wants to deliver its notifications. It uses deceptive marketing to trick visitors into purchasing legitimate computer security software. We discovered posto[.]click while investigating pages that use rogue advertising networks.

What kind of scam is "Elon Musk Twitter Giveaway"?

After examining this website, we concluded that it is a fake crypto giveaway scam page that offers to send cryptocurrency to a specified wallet and get twice as much back. Scammers behind this scam impersonate Elon Musk (use a fake Twitter page) to d deceive users. It is a complete scam that should be ignored.

What is Chromnius?

Chromnius is a rogue browser based on the Chromium open-source project. Our research team discovered this piece of software while inspecting suspicious software-promoting websites.

After installing this application on our test machine, we determined that it operates as adware and has qualities that are typical for browser hijackers. Furthermore, it is highly likely that Chromnius collects private information. Due to the fact that most users download/install this untrustworthy browser unintentionally, it is also classified as a PUA (Potentially Unwanted Application).

What kind of malware is Tuis?

Tuis is one of the ransomware variants belonging to the Djvu family. Cybercriminals use it to encrypt files. Tuis not only encrypt files but also appends the ".tuis" extension to filenames and creates a ransom note (the "_readme.txt" file). We discovered this ransomware while checking the VirusTotal website for recently submitted malware samples.

An example of how Tuis renames files: it changes "1.jpg" to "1.jpg.tuis", "2.png" to "2.png.tuis", "3.exe" to "3.exe.tuis", and so forth. It is important to mention that before encrypting files, threat actors behind Djvu ransomware attacks often use information stealers (like Vidar and RedLine) to gain sensitive information.

What kind of malware is Tury?

Tury is one of the Djvu ransomware variants. It encrypts files and appends its extension to filenames. We discovered Tury inspecting malware samples submitted to the VirusTotal site. It appends the ".tury" extension to filenames and drops the "_readme.txt" file (a ransom note) on the desktop.

An example of how Tury modifies filenames: it renames "1.jpg" to "1.jpg.tury", "2.png" to "2.png.tury", "3.exe" to "3.exe.tury", and so forth. It is known that Djvu ransomware is often distributed alongside information stealers such as Vidar and RedLine.

What kind of application is ArchievesOriginal?

ArchievesOriginal is an application that generates intrusive advertisements. It is an advertising-supported app (adware). Our team discovered ArchievesOriginal while examining websites claiming that some of the installed software is outdated. Like most advertising-supported apps, ArchievesOriginal is promoted and distributed using shady methods.

What kind of page is allcontrolpc[.]com?

While checking out suspicious websites, our research team discovered the allcontrolpc[.]com rogue page. It runs scams, promotes spam browser notifications, and causes redirects to different (likely unreliable/harmful) sites.

Allcontrolpc[.]com and pages akin to it are typically entered via redirects caused by websites that use rogue advertising networks.

What is Searchpoweronline.com?

Searchpoweronline.com is both the name of a browser hijacker and the URL of a fake search engine. This software makes modifications to browsers in order to promote illegitimate search engines. Furthermore, the Searchpoweronline.com browser hijacker likely spies on users' browsing activity.

What is CrownVanirty?

CrownVanirty is a piece of rogue software that our researchers discovered during a routine inspection of new submissions to VirusTotal. We determined that this application operates as advertising-supported software (adware) and belongs to the AdLoad malware family.

What kind of page is finchi[.]click?

During the examination of the finchi[.]click page, we found that it runs the "McAfee - Your PC is infected with 5 viruses!" scam and wants to show deceptive notifications. The purpose of this site is to trick visitors into purchasing an antivirus subscription. This page should be ignored. None of the messages displayed by it are real.