Virus and Spyware Removal Guides, uninstall instructions

What is "Ads Blocker" malware?

"Ads Blocker" (appeared as "Ads Blocker V16.1" on our testing machine) is a piece of malicious software targeting Android Operating Systems (OSes). This malware is capable of hijacking the device's calendar and overlaying browsers. "Ads Blocker" aims to promote a wide variety of rogue, scam, and malicious websites in this manner (i.e., by creating deceptive calendar events, causing redirects, and displaying fake notifications).

What kind of malware is Summer Locker?

Summer Locker is ransomware that prevents victims from using their files by encrypting them. Also, it appends the ".summer" extension to filenames. Summer Locker provides two ransom notes: one of them is displayed in a pop-up window and the second one is in the "___RECOVER__FILES__.summer.txt" file that Summer Locker drops on the desktop.

An example of how Summer Locker modifies filenames: it renames "1.jpg" to "1.jpg.summer", "2.png" to "2.png.summer", "3.exe" to "3.exe.summer", and so forth.

What kind of page is week-tale[.]xyz?

Week-tale[.]xyz is a deceptive website designed to lure visitors into granting it permission to show notifications. Also, it can redirect to a scam website (and possibly other untrustworthy pages). Our team discovered week-tale[.]xyz while examining illegal movie streaming pages, torrent sites, and similar pages that use rogue advertising networks.

What is LinkRoot?

LinkRoot is the name of a rogue application that our researchers discovered while investigating new submissions to VirusTotal. After inspecting this piece of software, we learned that it operates as adware. Additionally, LinkRoot belongs to the AdLoad malware family.

What kind of application is UnitDisplay?

While testing UnitDisplay, we found that it is an advertising-supported application that shows annoying (intrusive) advertisements. In addition to displaying ads, UnitDisplay may be capable of gathering information. We discovered this app after downloading a fake installer from a deceptive website.

What is HORNET ransomware?

While inspecting new malware submissions to VirusTotal, our researchers discovered the HORNET ransomware. It is designed to encrypt data and make ransom demands for decryption.

After we executed a sample of HORNET on our test machine, it began encrypting files and displayed a fake Windows OS update screen during the process. The filenames of the encrypted files were changed into random character strings, e.g., a file originally titled "1.jpg"appeared as "Mi5wbmc=", "2.png" as "MS5qcGc=", etc.

Once the encryption was completed, the ransomware dropped a ransom note named "README_[random_number].txt" onto the desktop. This message lacked critical information, which leads us to believe that HORNET is still in development and may have been released for testing purposes.

What kind of page is advertizementtoyou[.]com?

While examining advertizementtoyou[.]com, our team learned that this page is designed to lure visitors into agreeing to receive notifications. Advertizementtoyou[.]com uses a clickbait technique to obtain permission to deliver notifications. It also redirects to other websites.

What kind of software is Secure Audio Relay?

After testing the Secure Audio Relay application, we learned that it bombards users with intrusive advertisements. Software of this type is called adware. Our team discovered Secure Audio Relay on a shady website. It is common for adware to be promoted and distributed using questionable (often deceptive) methods.

What kind of page is track-scanner[.]com?

Our research team found the track-scanner[.]com rogue page during a routine inspection of questionable websites. It is designed to host online scams, promote browser notification spam, and redirect visitors to other (likely untrustworthy/malicious) webpages.

Most users enter sites like track-scanner[.]com via redirects caused by pages that use rogue advertising networks.

What is ClutchTrend?

While inspecting new submissions to VirusTotal, our researchers found the ClutchTrend application. Our analysis revealed that this app operates as advertising-supported software (adware). Furthermore, it is pertinent to mention that ClutchTrend is part of the AdLoad malware family.