Virus and Spyware Removal Guides, uninstall instructions

What is Trg ransomware?

Our researchers found the Trg ransomware-type program while checking out new submissions to VirusTotal. This program encrypts data and demands payment for the decryption; it also belongs to the Xorist ransomware family.

After we launched a sample of Trg on our test machine, it encrypted files and appended their names with a ".trg" extension. For example, an original filename like "1.jpg" appeared as "1.jpg.trg", "2.png" as "2.png.trg", etc.

Once this process was completed, a ransom note was displayed in a pop-up window and created in a text file titled "КАК РАСШИФРОВАТЬ ФАЙЛЫ.txt". This message was in Russian, and it is worth mentioning that if the system does not have the Cyrillic alphabet - the text in the pop-up will be unreadable.

What kind of page is stayundercontrol[.]online?

We investigated the stayundercontrol[.]online website and found two things: this page runs the "McAfee - Your PC might be infected with 5 viruses!" scam and wants to show notifications. Our team discovered stayundercontrol[.]online while inspecting websites that use rogue advertising networks. Pages of this type are rarely opened on purpose.

What kind of scam is "Your Password Has Been Changed"?

While investigating this email, we found that it is a scam email disguised as a letter from an email service provider. Scammers send this email to lure recipients into clicking a link and providing a password on the opened phishing website. This email should be ignored.

What kind of page is roclin[.]click?

Our researchers discovered the roclin[.]click rogue website during a routine inspection of questionable sites. Roclin[.]click promotes scams, pushes browser notification spam, and redirects visitors to different (likely unreliable/malicious) webpages.

Most users access such sites via redirects caused by pages that use rogue advertising networks.

What is SharedEnumerator?

While checking out new submissions to VirusTotal, our research team found a rogue app called SharedEnumerator. After we inspected this piece of software, we determined that it operates as adware and belongs to the AdLoad malware family.

What kind of email is "Your Email Was Suggested By Your Customer"?

Our analysis of the "Your Email Was Suggested By Your Customer" spam letter revealed that it operates as a phishing scam. It attempts to deceive recipients into disclosing their email account log-in credentials by claiming that their company may be eligible for a project.

What kind of software is UnlimitedBolt?

UnlimitedBolt is one of the untrustworthy applications designed to generate annoying advertisements. Software that shows ads is called adware (or advertising-supported software). Most adware is promoted and distributed using questionable (often deceptive) methods. Our team discovered UnlimitedBolt on a shady website offering to update supposedly outdated software.

What kind of scam is "Update Windows Defender"?

While examining suspicious pages, we found another page of this kind running a pop-up scam. This site uses a scare tactic to distribute malware. Its purpose is to lure unsuspecting visitors into believing that their computers are infected and executing a downloaded malicious file.

What kind of page is protectyour-device[.]com?

Our research team found the protectyour-device[.]com rogue webpage while checking out untrustworthy sites. This page promotes deceptive material, pushes spam browser notifications, and redirects visitors to other (likely dubious/malicious) websites.

Most users enter pages like protectyour-device[.]com through redirects caused by sites that employ rogue advertising networks.

What is IndexerPortal?

IndexerPortal is a piece of rogue software that our research team discovered while investigating new submissions to VirusTotal. After inspecting this app, we determined that it is adware belonging to the AdLoad malware family. IndexerPortal is designed to run intrusive ad campaigns, and it may have other harmful abilities.