Virus and Spyware Removal Guides, uninstall instructions

What kind of page is service-2022[.]site?

While inspecting dubious webpages, our researchers discovered the service-2022[.]site rogue site. It operates by promoting scams, pushing browser notification spam, and redirecting visitors to other (likely untrustworthy/malicious) websites.

Most users access pages like service-2022[.]site via redirects caused by sites using rogue advertising networks, mistyped URLs, spam notifications, intrusive ads, or installed adware.

What kind of page is fonto[.]club?

Fonto[.]club is a rogue page that our researchers discovered while inspecting suspicious websites. It is designed to promote deceptive material, push browser notification spam, and redirect visitors to other (likely untrustworthy/harmful) webpages.

Most users enter fonto[.]club and similar websites through redirects caused by pages that use rogue advertising networks.

What kind of page is basis-antivirus[.]com?

After examining basis-antivirus[.]com, we found that this page is designed to trick visitors into paying for legitimate software by displaying deceptive content. Also, it asks visitors for permission to show notifications. Our team discovered basis-antivirus[.]com while inspecting websites that use rogue advertising networks.

What is exploretoday.co?

Exploretoday.co is the URL of a fake search engine. These websites are typically promoted by browser-hijacking software, which modifies browser settings in order to cause redirects to illegitimate search engines. Furthermore, both the promoted sites and browser hijackers usually collect private data.

What kind of page is wukbgater[.]buzz?

While examining wukbgater[.]buzz, we found that this page uses a clickbait technique to trick visitors into agreeing to receive notifications. Also, it redirects to other shady websites. Thus, wukbgater[.]buzz cannot be trusted/should not be visited. Our team discovered wukbgater[.]buzz while inspecting pages that use rogue advertising networks.

What is Ofoq ransomware?

Our research team found the Ofoq ransomware while inspecting new submissions to VirusTotal. This malicious program is part of the Djvu ransomware family.

After we executed a sample of this ransomware on our test machine, it began encrypting files and changed their titles. The original filenames were appended with a ".ofoq" extension, e.g., a file named "1.jpg" appeared as "1.jpg.ofoq", "2.png" as "2.png.ofoq", etc. Once this process was completed, a ransom note - "_readme.txt" - was created.

What kind of malware is Ofww?

Our malware researchers have discovered a new Djvu ransomware called Ofww. We found it while examining malware samples submitted to the VirusTotal site. Ofww is ransomware that encrypts files and appends the ".ofww" extension to filenames. It also provides a ransom note (creates the "_readme.txt" file).

An example of how Ofww renames files: it changes "1.jpg" to "1.jpg.ofww", "2.png" to "2.png.ofww", and so forth.

What kind of malware is Oflg?

While inspecting malware samples submitted to the VirusTotal page, our team discovered ransomware called Oflg. It is part of the Djvu ransomware family. Oflg encrypts the victim's files, appends its extension (".oflg") to the filenames of all encrypted files, and creates the "_readme.txt" file/a ransom note.

An example of how Oflg modifies filenames: it changes "1.jpg" to "1.jpg.oflg", "2.png" to "2.png.oflg", "3.exe" to "3.exe.oflg", and so forth.

What kind of page is cousonelly[.]com?

While inspecting cousonelly[.]com, we learned that the purpose of this page is to trick visitors into allowing it to show notifications. It displays deceptive content to get that permission.

Our team discovered cousonelly[.]com while examining websites that use rogue advertising networks (illegal movie streaming pages, torrent sites, and similar pages).

What kind of page is steady-protection[.]com?

Steady-protection[.]com is a rogue webpage that our researchers discovered while investigating untrustworthy websites. This page runs scams, promotes spam browser notifications, and redirects visitors to other (likely unreliable/harmful) sites.

Most users access steady-protection[.]com and webpages akin to it - through redirects caused by sites using rogue advertising networks.