Virus and Spyware Removal Guides, uninstall instructions

What is GetAnAntivirus ransomware?

GetAnAntivirus is the name of a ransomware-type program that our researchers discovered while inspecting new malware submissions to VirusTotal. This malicious program is part of the Chaos ransomware family.

After we launched a sample of this ransomware on our test machine, it encrypted files and appended their filenames with a ".GetAnAntivirus" extension. For example, a file titled "1.jpg" appeared as "1.jpg.GetAnAntivirus", "2.png" as "2.png.GetAnAntivirus", and so forth.

Once this process was completed, a ransom-demanding message - "read_it.txt" was dropped onto the desktop. Additionally, GetAnAntivirus changed the desktop wallpaper.

What is CycleAfter?

CycleAfter is a piece of rogue software classified as adware. We discovered this app while inspecting new submissions to VirusTotal. Additionally, it has to be mentioned that CycleAfter is part of the AdLoad malware family.

What kind of page is news-jixuzi[.]cc?

While examining websites that use rogue advertising networks, we discovered news-jixuzi[.]cc - a shady page that uses a clickbait technique to trick visitors into allowing it to show notifications. It is uncommon for pages like news-jixuzi[.]cc to be visited intentionally. Also, they often redirect visitors to other sites of this kind.

What kind of malware is Paradies?

Paradies clipper is the name of the malware that steals cryptocurrency from victims by replacing wallet addresses saved in the clipboard with addresses belonging to cybercriminals. It is sold on a hacker forum for 50 euros. The developer of the Paradies clipper describes it as a number one crypto clipper.

What kind of page is keepsafetycore[.]com?

Keepsafetycore[.]com is a rogue website that promotes scams and spam browser notifications. This page can also redirect users to other (likely untrustworthy/malicious) sites.

Our researchers discovered keepsafetycore[.]com while inspecting pages that employ rogue advertising networks. It is noteworthy that most users enter keepsafetycore[.]com and similar webpages through redirects generated by such sites.

What is LiftEffort?

Our research team found the LiftEffort application during a routine inspection of new submissions to VirusTotal. Our analysis of this app revealed that it operates as adware. Additionally, LiftEffort belongs to the AdLoad malware family.

What kind of application is PlusApparel?

After using a fake installer downloaded from a deceptive page, we discovered the PlusApparel application. We found that PlusApparel is a useless application that displays intrusive advertisements. Thus, we classified PlusApparel as adware.

What kind of application is TripleChop?

TripleChop is the name of an application that we discovered after downloading and using a fake installer for the Adobe Flash Player. While analyzing the app, we learned that it generates annoying advertisements. Thus, our team classified TripleChop as adware (advertising-supported software).

What is "You May Have Viruses On After Visiting An Adult Website"?

Our researchers discovered the "You May Have Viruses On After Visiting An Adult Website" scam while inspecting dubious websites. We found two variants of this scheme - one in English and the other in Portuguese.

Like most scams of this kind, "You May Have Viruses On After Visiting An Adult Website" is designed to promote fraudulent and malicious software by making false claims about victims' devices being infected. It is pertinent to mention that no website can detect threats on systems - therefore, any that proclaim such are scams.

What kind of page is ukindwouldm[.]xyz?

Ukindwouldm[.]xyz is one of the many deceptive websites that use clickbait techniques to trick visitors into allowing them to show notifications. Also, ukindwouldm[.]xyz redirects visitors to other pages. Our team discovered this page while inspecting illegal movie streaming, torrent, and similar sites.