Virus and Spyware Removal Guides, uninstall instructions

What kind of page is click-and-continue[.]live?

While inspecting websites that use rogue advertising networks, we discovered the click-and-continue[.]live website. It is designed to push its spam browser notifications, load questionable content, and redirect visitors to other untrustworthy/hazardous webpages.

Most visitors to click-and-continue[.]live and sites akin to it - access them via the aforementioned advertising-network-using pages.

What is VSOP ransomware?

Our researchers detected VSOP ransomware during a routine inspection of new malware submission on VirusTotal. While analyzing a sample, we learned that this ransomware encrypts files and appends their names with a ".PPLIT" extension. To elaborate, a file initially titled "1.jpg" appeared as "1.jpg.PPLIT", "2.jpg" as "2.jpg.PPLIT", etc. An updated variant appends ".minex" extension. Afterwards, VSOP created a ransom note - "README.txt" - on the desktop.

What is YouTube Ad Remover?

YouTube Ad Remover is a rogue browser extension, which we have researched. On its "official" site, this extension is promoted as a tool capable of blocking advertisements on YouTube videos. However, we found that when installed on Google Chrome, YouTube Ad Remover promises only to auto-skip said ads.

Instead of operating as advertised, this browser extension displayed various adverts. Therefore, we classify YouTube Ad Remover as adware.

What kind of page is next-notification[.]com?

We have examined the next-notification[.]com page and concluded that the main purpose of this page is to trick visitors into allowing it to show notifications. Our team has discovered next-notification[.]com while browsing illegal streaming, torrent sites, and similar pages that use questionable advertising networks.

What is Newexploit ransomware?

Newexploit is the name of a ransomware-type program, which our researchers have sampled from VirusTotal. Once launched on our test machine, Newexploit encrypted files and appended their filenames with a ".exploit" extension. For example, a file initially named "1.jpg" afterwards looked like "1.jpg.exploit", "2.jpg.exploit" as "2.jpg.exploit", etc.

Following the completion of the encryption process, this ransomware created a ransom note - "RECOVERY INFORMATION.txt" - on the desktop.

What kind of application is Digital Info?

We have spotted the Digital Info extension on a shady website offering to update an installed extension. After adding this app to the Chrome browser and testing it, we have learned that it generates advertisements. Therefore, we have categorized this app as advertising-supported software.

What is "Update required to avoid login interruption" email scam?

After analyzing this email, we have discovered that it is a phishing email (it contains a link to a phishing website). Scammers behind it attempt to trick recipients into providing personal information such as email addresses and passwords required to access Microsoft and possibly other accounts.

What kind of page is theironnews[.]site?

While investigating rogue websites, our researchers discovered that theironnews[.]site is an untrustworthy page designed to promote spam browser notifications. It can also redirect visitors to other unreliable and dangerous sites. Most users access webpages like theironnews[.]site via others using rogue advertising networks.

What is "AIC Contracting" email virus?

Our team has inspected this email and concluded that it is part of a malicious spam campaign. Cybercriminals use it to distribute Agent Tesla - a Remote Administration Trojan. Their goal is to trick recipients into executing a file extracted from the malicious attachment (archive file).

What is CheckControl?

Our research team discovered CheckControl on new VirusTotal submissions. After launching this app on our test system, we found that CheckControl is an adware-type application belonging to the AdLoad malware family.