Virus and Spyware Removal Guides, uninstall instructions

What is ScanBox?

ScanBox is the name of malware delivered via malicious websites masquerading as legitimate Australian news websites. Cybercriminals behind it target Australian Government agencies, news media organizations, and global energy and manufacturing sectors. Websites used to distribute ScanBox are sent via email.

What kind of page is tonit[.]click?

Tonit[.]click is a rogue webpage that our researchers discovered during a routine inspection of suspicious sites. It is designed to load deceptive content, promote browser notification spam, and redirect visitors to other (likely untrustworthy/harmful) websites. Most users typically access such sites via redirects caused by rogue advertising networks.

What is Screen Recorder?

While inspecting suspicious websites, our researchers found one promoting the Screen Recorder browser extension. It is presented as a tool capable of recording the screen. However, our analysis revealed that Screen Recorder operates as adware instead.

What kind of application is AssessmentBranded?

After analyzing the AssessmentBranded application (which we downloaded from a deceptive website), our team learned that it shows intrusive advertisements. Therefore, we classified AssessmentBranded as adware. Also, this app can read sensitive information. It is strongly recommended not to install it on computers.

What is JiangLocker ransomware?

JiangLocker is a piece of malicious software categorized as ransomware. It is designed to encrypt data and demand ransoms for the decryption.

After we launched a sample of JiangLocker on our test system, it began encrypting files and appended their filenames with a ".jiang" extension. For example, a file originally titled "1.jpg" appeared as "1.jpg.jiang", "2.png" as "2.png.jiang", and so on.

Once the encryption process was completed, the ransomware changed the desktop wallpaper and created identical ransom notes in the form of a pop-up and "read.ini" file.

What kind of website is threecaptcha[.]com?

After analyzing threecaptcha[.]top, we concluded that it is one of the many untrustworthy pages designed to lure visitors into agreeing to receive notifications. In addition to showing deceptive content, threecaptcha[.]top redirects to scam websites. Thus, threecaptcha[.]top, its notifications, and pages opened by it cannot be trusted.

What kind of website is stronger-protection[.]com?

After examining stronger-protection[.]com, we found that it is one of the deceptive pages that runs the "McAfee - Your PC is infected with 5 viruses!" and asks for permission to show its notifications. Our team discovered stronger-protection[.]com while studying other shady pages that use rogue advertising networks (it is uncommon for such pages to be visited intentionally).

What kind of page is stable-scan[.]com?

Stable-scan[.]com is a rogue webpage that our researchers discovered during a routine inspection of dubious websites. This page is designed to push online scams, promote browser notification spam, and redirect users to other (likely unreliable/malicious) sites.

Visitors to pages like stable-scan[.]com typically access them via redirects caused by websites using rogue advertising networks.

What kind of page is dailysurveyreward[.]online?

Our researchers discovered the dailysurveyreward[.]online rogue webpage while inspecting dubious sites. It is designed to promote scams, push spam browser notifications, or redirect visitors to other (likely unreliable/malicious) websites. Most users access pages of this kind via redirects caused by sites using rogue advertising networks.

What is Motorsports Start?

Our researchers found a deceptive webpage endorsing the Motorsports Start browser extension while inspecting sites that use rogue advertising networks. This piece of software is presented as a tool capable of providing easy access to updates, results, and the latest news relating to motorsports.

However, when we installed Motorsports Start onto our test machine, it modified browser settings to cause redirects to the search.nstart.online fake search engine. Due to this behavior, Motorsports Start is classified as a browser hijacker.