Virus and Spyware Removal Guides, uninstall instructions

What kind of page is antivirus-click[.]com?

Antivirus-click[.]com is a rogue page that we discovered while inspecting untrustworthy websites. It is designed to host scams, promote browser notification spam, and redirect visitors to other (likely dubious/malicious) webpages. Users typically enter these sites through redirects caused by pages using rogue advertising networks.

What is SampleFormat?

SampleFormat is a piece of rogue software that our researchers discovered while inspecting new submissions to VirusTotal. After analyzing this app, we determined that it operates as adware and belongs to the AdLoad malware family.

What kind of email is "FedEx Corporation"?

After analyzing this "FedEx Corporation" email, we determined that it is malspam. These letters are presented as reports from the FedEx Corporation regarding a shipment. However, their attachments are infectious and will begin downloading/installing malware upon being opened.

It must be emphasized that this spam is in no way associated with the actual FedEx Corporation.

What kind of software is PickGrid?

PickGrid is an advertising-supported application that generates annoying/intrusive advertisements. Our team discovered this app after executing a fake installer downloaded from a shady website claiming that the installed version of Adobe Flash Player is out of date. PickGrid is not a trustworthy application - it should never be installed.

What kind of page is yoursafeguardshield[.]com?

Yoursafeguardshield[.]com is a rogue page that runs scams, promotes spam browser notifications, and causes redirects (most likely to untrustworthy/malicious websites).

Our researchers discovered this webpage while inspecting sites that use rogue advertising networks. It is noteworthy that the redirects caused by such websites are how users typically enter yoursafeguardshield[.]com and similar pages.

What is Windows Calculator malware?

While analyzing an email containing a malicious attachment, we discovered that the threat actors behind Qakbot (also known as QBot) use a DLL hijacking method to distribute malware. They are abusing the Windows 7 Calculator application in their attacks. Currently, Qakbot is known to be used as a dropper for ransomware.

What is kind of email is "Meeting Reminder"?

Our inspection of the "Meeting Reminder" email revealed that it is spam. This letter operates as a phishing scam targeting email account log-in credentials. By making fake claims about an important document having been shared with the recipients - this scam attempts to trick them into disclosing their email passwords to view the nonexistent file.

What is DUCKTAIL?

DUCKTAIL is the name of a malicious program designed to steal Facebook Business accounts. The observed attacks have been highly targeted.

Research by WithSecure Intelligence suggests that this malware has been around since 2021 and is associated with Vietnamese cyber criminals. At the time of writing, DUCKTAIL continues to receive updates, including new abilities to evade Facebook's security measures.

What kind of page is saarmlife[.]ru?

Saarmlife[.]ru is an untrustworthy website designed to trick visitors into clicking the "Allow" button. The purpose of this site is to obtain permission to show notifications and redirect visitors to other shady pages. We discovered saarmlife[.]ru while inspecting pages that use rogue advertising networks.

What is ModuleView?

Our research team discovered the ModuleView rogue app while inspecting new submissions to VirusTotal. Our analysis of this piece of software revealed that it is adware. Additionally, ModuleView belongs to the AdLoad malware family.