Virus and Spyware Removal Guides, uninstall instructions

What kind of application is Quick pro?

We have discovered the Quick pro application while visiting deceptive websites. One of those pages claimed that it is required to add an extension to Chrome to proceed. Another one recommended adding an extension to the browser for an unspecified reason. We have examined Quick pro and found that it is a browser hijacker.

What is "CoinMarketCap Giveaway"?

"CoinMarketCap Giveaway" is a scam our researchers found while inspecting rogue websites. This fake giveaway promises to double users' contributions in either Bitcoin (BTC) or Ethereum (ETH) cryptocurrency. In other words, this scam is designed to trick users into transferring cryptocurrency to it with the false promise of returning double the amount.

What kind of page is bingocaptchapoint[.]top?

Bingocaptchapoint[.]top is a deceptive website designed to trick visitors into allowing it to display notifications. Also, it redirects visitors to other shady websites. We have discovered bingocaptchapoint[.]top while examining pages that use rogue advertising networks (various illegal movie streaming, torrent sites, etc.).

What kind of software is Buyers Assistant?

Buyers Assistant is presented as an app that lets users "buy with confidence and speed on eBay". We have discovered Buyers Assistant on a deceptive website that recommends installing an extension on a Chrome browser. After examining the app, we found that it displayed unwanted advertisements. Buyers Assistant is a typical advertising-supported application.

What is ANUBIZ LOCKER ransomware?

While inspecting new submissions to VirusTotal, our researchers found ANUBIZ LOCKER - a ransomware-type program that is part of the Babuk ransomware family.

Once executed on our test system, ANUBIZ LOCKER encrypted files and appended their filenames with a ".lomer" extension. For example, a file initially titled "1.jpg" appeared as "1.jpg.lomer", "2.jpg" as "2.jpg.lomer", and so on. ANUBIZ LOCKER also created a ransom note named "How To Restore Your Files.txt".

What kind of malware is Ooii?

Ooii is ransomware that has been discovered by our team while checking VirusTotal for recently submitted malware samples. We found that Ooii is part of the Djvu ransomware family. In addition to encrypting files, Ooii renames them by appending the ".ooii" extension and provides a ransom note (creates the "_readme.txt" file).

An example of how Ooii modifies filenames: it renames "1.jpg" to "1.jpg.ooii", "file.txt" to "file.txt.ooii", and so on.

What is ElementryCheck?

ElementryCheck is a rogue app that our researchers discovered during a routine inspection of new submissions to VirusTotal. After analyzing it, we determined that ElementryCheck operates as adware. Additionally, we learned that this piece of software belongs to the AdLoad malware family.

What kind of malware is Professor?

Our malware researchers have discovered the Professor ransomware while examining malware samples submitted to VirusTotal. They have learned that Professor is part of the VoidCrypt ransomware family. This variant encrypts files and appends the profes0r@tutanota.com email address, a string of random characters, and the ".professor" extension to filenames.

For example, it renames "1.jpg" to "1.jpg.[profes0r@tutanota.com][18MPG9VC42K6JTF].professor", "2.png" to "2.png.[profes0r@tutanota.com][18MPG9VC42K6JTF].professor". Also, Professor creates the "!INFO.HTA" file which displays a ransom note in a pop-up window.

What kind of application is External Links Tool?

We discovered the External Links Tool application after using an installer downloaded from a deceptive website, claiming that a browser extension may be outdated. After analyzing this app, we found that it generates ads (it functions as adware). Although, it is described as a tool that examines external links of domains.

What kind of page is check-the-trend[.]com?

Check-the-trend[.]com is a rogue webpage promoting browser notification spam. It is also capable of redirecting visitors to other unreliable and dangerous sites. Our research team discovered this page while inspecting sites that employ rogue advertising networks. Most users enter check-the-trend[.]com and similar websites via the aforementioned pages.