Virus and Spyware Removal Guides, uninstall instructions

What kind of page is henidspost[.]com?

While browsing suspicious websites, our researchers discovered the henidspost[.]com rogue page. After investigating it, we determined that this webpage endorses browser notification spam and redirects users to other (likely untrustworthy/malicious) sites. Most users enter pages like henidspost[.]com via redirects caused by websites utilizing rogue advertising networks.

What kind of application is DefaultService?

Our researchers found the DefaultService application while inspecting new submissions to the VirusTotal website. Upon examination, we determined that this app is adware from the AdLoad malware family. It operates by delivering intrusive ad campaigns and may possess other harmful abilities.

What kind of page is newsparty[.]top?

We have inspected newsparty[.]top and discovered that it is an unreliable web page designed to deceive visitors into granting it permission to show notifications. Newsparty[.]top uses a technique known as clickbait to receive this permission. Also, newsparty[.]top may cause redirects to similar websites.

What kind of page is ruopors.co[.]in?

We have analyzed the website and found that it runs the "You've Visited Illegal Infected Website" scam. It uses scare tactics to trick visitors into agreeing to receive notifications and paying for a security tool. Typically, when users agree to receive notifications from sites like ruopors.co[.]in, they receive misleading notifications. Thus, ruopors.co[.]in should not be trusted.

What is the fake "$SWOT Token Airdrop"?

After inspecting this "$SWOT Token Airdrop", as promoted on the swotai[.]xyz webpage, we determined that it is fake. This scam imitates the Swot AI platform (swotai.org).

When a user attempts to take part in the bogus giveaway, they expose their digital wallets to a cryptocurrency drainer. Hence, victims of schemes like this "$SWOT Token Airdrop" can lose all the funds stored in compromised cryptowallets.

What kind of scam is "Foreign Compensation Commission"?

We have examined this email and determined that this a fraudulent letter crafted by scammers. The email is disguised as a notification regarding a payment. It claims that recipients are entitled to a large sum of money. The purpose of this scam is to extract money and (or) information from unsuspecting recipients.

What is the fake "SatoshiVM Airdrop"?

We have inspected the Satoshi VM Airdrop site (drop-satoshivm[.]app) and found it to be a scam website mimicking the real SatoshiVM web page (satoshivm[.]io). The fake site is designed to trick visitors into believing they can obtain free cryptocurrency. Scammers use this site to drain crypto wallets.

What kind of application is TaskIndexer?

Upon analyzing the TaskIndexer app, we observed that it inundates users with intrusive advertisements. These ads can promote dubious and potentially harmful websites. Consequently, we categorized TaskIndexer as adware. It is typical for software of this nature to be disseminated through deceptive tactics and unintentionally installed by users.

What kind of application is WebIndex?

WebIndex is a rogue application discovered by our researchers during a routine inspection of new file submissions to the VirusTotal website. After examining this app, we determined that it is advertising-supported software (adware). WebIndex is part of the AdLoad malware family.

What kind of malware is Rincrypt 3.0?

While reviewing new file submissions to the VirusTotal platform, our research team discovered the Rincrypt 3.0 ransomware. This malware is designed to encrypt data and demand payment for its decryption.

On our testing system, Rincrypt 3.0 encrypted files and appended their filenames with a ".rincrypt3" extension. To elaborate, a file initially named "1.jpg" appeared as "1.jpg.rincrypt3", "2.png" as "2.png.rincrypt3", etc. Afterward, a ransom note titled "READ_THIS.txt" was created.