Virus and Spyware Removal Guides, uninstall instructions

What kind of website is protectorofpower[.]xyz?

Protectorofpower[.]xyz is a website that runs the "Your Windows 10 Is Infected With Viruses" scam and asks for permission to show notifications. Our team has discovered this deceptive site while inspecting various pages that use rogue advertising networks (e.g., torrent sites, illegal movie streaming pages)

What kind of page is ourhotfeed[.]com?

During a routine inspection of untrustworthy sites, we discovered the ourhotfeed[.]com rogue webpage. It is designed to push browser notification spam and redirect visitors to other (likely unreliable or malicious) websites. Pages like ourhotfeed[.]com are usually entered inadvertently. Most users access them via redirects caused by sites using rogue advertising networks.

What is LoginCheck?

LoginCheck is a piece of rogue software our research team discovered while inspecting new submissions to VirusTotal. After inspecting this app, we determined that LoginCheck works as advertising-supported software (adware) and belongs to the AdLoad malware family.

What is Msjd ransomware?

Msjd is a ransomware-type program belonging to the Djvu malware family. Our researchers found Msjd while inspecting new submissions to VirusTotal.

On our test machine, this ransomware encrypted files and added the ".msjd" extension to their filenames. To elaborate, a file initially titled "1.jpg" appeared as "1.jpg.msjd", "2.png" as "2.png.msjd", and so on for all of the affected files. Afterward, a ransom note named "_readme.txt" was created.

What kind of page is mediaforyour[.]com?

Mediaforyour[.]com is a rogue webpage that our researchers discovered while inspecting untrustworthy websites. It operates by using deception to lure visitors into allowing it to display spam browser notifications. Additionally, this page is capable of redirecting users to other (likely unreliable/malicious) sites. Most users encounter pages like mediaforyour[.]com via redirects caused by websites using rogue advertising networks.

What kind of software is GenerateExplorer?

GenerateExplorer is the name of an adware-type application designed to generate intrusive advertisements. Typically, apps of this type are promoted and distributed on shady websites, via deceptive ads, and in similar ways. Our team has discovered GenerateExplorer on a shady website offering to download software updates.

What is "ERGIFE" email virus?

Our team has examined this email and concluded that it is a fake letter from Ergife Palace Hotel (an existing hotel in Rome). All text in this letter is written in Italian. Cybercriminals behind it attempt to trick users into believing that they have received a quote request. Their goal is to lure recipients into executing Agent Tesla (executing a file in the attachment).

What is view dark?

View dark is a browser extension our researchers discovered while looking through deceptive download webpages. This piece of software promises to enable dark mode for websites that do not have it.

After inspecting view dark, we determined that it operates as adware. This extension runs intrusive advertisement campaigns (delivers ads) and spies on users' browsing activity.

What kidn of malware is Kratos Silent Miner?

Kratos Silent Miner is the name of ETC (Ethereum Classic) and ETH (Ethereum) cryptocurrency miner with various options and builds. We have discovered this miner on a hacker forum. Its developer offers to purchase a monthly subscription (with 24/7 support on Telegram) for $100.

What is SystemWalk?

While inspecting new submissions on VirusTotal, our research team discovered SystemWalk. We installed this application onto our test system and determined that it operates as advertising-supported software (adware). We also learned that SystemWalk is part of the AdLoad malware family.