Virus and Spyware Removal Guides, uninstall instructions

What kind of page is flamehammer[.]top?

Our research team discovered the flamehammer[.]top rogue webpage while inspecting unreliable sites. This page is designed to promote browser notification spam; at the time of research, it did so by utilizing a fake CAPTCHA test. Additionally, it can redirect users to other (likely untrustworthy/harmful) websites.

Most visitors to flamehammer[.]top and pages akin to it access them via redirects generated by sites using rogue advertising networks.

What kind of software is Search-UIX?

Search-UIX is a rogue browser extension that operates as a browser hijacker. Software within this classification modifies browser settings to promote (via redirects) fake search engines.

While there is an illegitimate Internet search website that shares this extension's name – searchuix.com – this was not the engine endorsed by Search-UIX when we analyzed it. At the time of research, this browser hijacker generated redirects to thesearchfeeds.com site.

What kind of page is getfreevpn[.]click?

Getfreevpn[.]click is a rogue page that runs scams and pushes spam browser notifications. It can also redirect users to different (likely unreliable/dangerous) websites.

Visitors to this and similar webpages access them primarily through redirects generated by sites that utilize rogue advertising networks. We discovered getfreevpn[.]click during a routine investigation of websites that use said networks.

What kind of application is EssentialProcesser?

Our research team found the EssentialProcesser application while inspecting new file submissions to the VirusTotal platform. After investigating this app, we determined that it is advertising-supported software (adware). EssentialProcesser belongs to the AdLoad malware family. This app is designed to deliver intrusive advertisement campaigns.

What kind of malware is Nnll?

Our researchers discovered the Nnll ransomware-type program while reviewing new submissions to the VirusTotal website. Ransomware operates by encrypting data and demanding ransoms for its decryption.

After executing a sample of Nnll on our test machine, we found that it encrypts files and appends their filenames with a ".nnll" extension. For example, an original filename such as "1.jpg" appeared as "1.jpg.nnll", "2.png" as "2.png.nnll", etc. Once this process was completed, a ransom note titled "_Readme.txt" was created.

What kind of application is FontResultsMultitask?

While reviewing new file submissions to the VirusTotal platform, we found the FontResultsMultitask application. Our analysis revealed that FontResultsMultitask is adware belonging to the AdLoad malware family.

What kind of application is Cervidae?

In the course of examining a malicious installer, we encountered Cervidae and its troubling actions as a browser extension. These actions included enabling the "Managed by your organization" feature in the Chrome browser, gathering various types of data, and overseeing specific aspects of the browser.

What kind of application is ExplorerMainFrame?

ExplorerMainFrame is an adware-type application that our research team found while inspecting new submissions to the VirusTotal site. This piece of advertising-supported software is part of the AdLoad malware family. ExplorerMainFrame is designed to run intrusive ad campaigns.

What is RanunculusAcris?

During an investigation into a malicious installer, we came across RanunculusAcris and its concerning behavior as a browser extension. These activities encompassed the enabling of the "Managed by your organization" feature in the Chrome browser, the collection of diverse data, and the management of specific components of the browser.

What kind of email is "Password Marked For Deletion"?

Our examination of the "Password Marked For Deletion" email revealed that it is spam promoting a phishing scam. The letter targets recipients' email account log-in credentials by claiming that the password has expired.