Virus and Spyware Removal Guides, uninstall instructions

What is FeaturePremium?

FeaturePremium is a piece of rogue software that our researchers discovered while inspecting new submissions to VirusTotal. Our analysis uncovered that this app operates as adware and belongs to the AdLoad malware family.

What is p03try-c4t3g0ry[.]xyz?

Our team has discovered the p03try-c4t3g0ry[.]xyz website while examining illegal movie streaming, torrent, and similar sites (pages that use rogue advertising networks). P03try-c4t3g0ry[.]xyz is a page that runs the "You've Visited Illegal Infected Website" scam. Also, this untrustworthy site asks for permission to show notifications.

What kind of malware is CH Miner?

CH Miner is the name of a cryptocurrency miner with Remote Administration Trojan (RAT) and clipper functionality. It is created by the same cybercriminals who have developed the Echelon Stealer. Our team has discovered the CH Miner on a hacker forum.

It costs $20 for three days, $40 for a week, $80 for a month, $120 for six months, and $200 for a year. Its lifetime license is sold for $300. The source codes of the latest version of the CH Miner are sold for $1000.

What is AgentAdmin?

During a routine inspection of new submissions to VirusTotal, our research team found the AgentAdmin application. After analyzing this app, we learned that it operates as advertising-supported software (adware), and it also belongs to the AdLoad malware family.

What kind of malware is Kxde?

Our malware researchers have discovered a ransomware variant called Kxde while analyzing the samples submitted to VirusTotal. This variant is part of the Djvu ransomware family. It encrypts files and appends the ".kxde" extension to filenames. Kxde also provides a ransom note (creates a text file named "_readme.txt").

An example of how files encrypted by the Kxde ransomware are renamed: "1.jpg" is renamed to "1.jpg.kxde", "2.png" to "2.png.kxde", and so forth.

What is 1xExujJunyRVG8MWnEgxdHkVwW7xSzntZ?

1xExujJunyRVG8MWnEgxdHkVwW7xSzntZ is the name of a clipper-type malware. Malicious programs of this kind are also known as "clipboard hijackers"; they operate by changing clipboard data. Typically, clippers are used to redirect outgoing cryptocurrency transactions by replacing the intended wallet's address with one owned by the cyber criminals.

What kind of page is securesoftwarepc[.]com?

Securesoftwarepc[.]com is a shady website running the "McAfee - Your PC is infected with 5 viruses!" scam and asking for permission to show notifications. Our team has discovered this deceptive page while examining other pages of this kind that use rogue advertising networks.

What kind of application is MySpace Tab?

MySpace Tab is an application that we discovered on a shady website offering to "download and install recommended Chrome extension". After testing the app, we learned that it is a browser hijacker that promotes a fake search engine. It changes some of the browser's settings to search.spaceytab.com.

What kind of page is reistivelbife[.]com?

Reistivelbife[.]com is a rogue site our researchers found while inspecting untrustworthy webpages. This page promotes browser notification spam and redirects visitors to different (likely unreliable/malicious) websites. Pages of this kind are seldom accessed intentionally; most users enter them via redirects caused by webpages that use rogue advertising networks.

What is the "Ronin Wallet" scam?

During a routine inspection of sites that use rogue advertising networks, our research team discovered a webpage promoting a scam "Ronin Wallet". This phishing scam targets the log-in credentials of users' Ronin digital wallets. With this information in their possession, the cyber criminals may gain access/control over the exposed cryptowallets and the funds stored therein.