Virus and Spyware Removal Guides, uninstall instructions

What kind of page is buzzworthyoffers[.]com?

Our researchers discovered buzzworthyoffers[.]com while browsing untrustworthy websites. This rogue page is designed to promote deceptive content and spam browser notifications. It can also redirect users to other (likely dubious/hazardous) sites.

Most visitors enter buzzworthyoffers[.]com and analogous webpages via redirects caused by websites utilizing rogue advertising networks. These pages can also be accessed through spam notifications, intrusive advertisements, mistyped URLs, or installed adware.

What kind of email is "Unclaimed Funds"?

Upon reading the "Unclaimed Funds" email, we determined that it is spam. This scam message is a supposed business proposal wherein the recipient will be presented as the relative of a deceased person in order to claim their significant bank holdings.

Typically, spam campaigns of this kind aim to trick users into disclosing private information or to scam them out of their money.

What kind of email is "Intuit QuickBooks - Negative Comments From A Consumer"?

After reviewing this "Intuit QuickBooks - Negative Comments From A Consumer" email, we determined that it is fake. This message states that a client has left a negative comment about the recipient's company. It must be stressed that these claims are false, and this mail is not associated with any legitimate entities.

It is a phishing email that aims to deceive recipients into visiting a fake QuickBooks sign-in page designed to steal their account log-in credentials.

What kind of email is "Capital One - Unrecognized Purchase"?

Our inspection of the "Capital One - Unrecognized Purchase" email revealed that it is fake. This spam letter queries the recipient on whether they recognize a nonexistent purchase, and when they attempt to investigate it – they are redirected to a phishing website that targets account log-in credentials.

It must be emphasized that the information in this email is false, and this mail is not associated with the real Capital One Financial Corporation.

What kind of page is bigsupersweepstakes[.]com?

Bigsupersweepstakes[.]com is a rogue webpage that promotes scams and browser notifications spam, and redirects users to other (likely dubious/dangerous) sites.

Most visitors to such pages access them via redirects caused by websites that employ rogue advertising networks. Our researchers discovered bigsupersweepstakes[.]com while inspecting sites that utilize said networks.

What kind of page is flightsettle[.]site?

We have examined flightsettle[.]site and found that it uses clickbait to get permission to show notifications. Once this permission is granted, flightsettle[.]site can display misleading notifications (e.g., fake warnings or offers) to trick users into opening deceptive sites. Thus, flightsettle[.]site should be avoided.

What kind of page is euopue[.]click?

In our analysis of euopue[.]click, we discovered that the site's purpose is to obtain permission to show notifications. Euopue[.]click uses a deceptive method to trick users into allowing it to send notifications. Therefore, it is advisable to avoid visiting euopue[.]click.

What kind of page is behque[.]click?

Our researchers discovered the behque[.]click rogue website during a routine inspection of suspicious sites. Upon examination, we determined that this page endorses browser notification spam and generates redirects to other (likely unreliable/dangerous) websites.

The majority of visitors to behque[.]click and analogous webpages access them via redirects produced by sites that utilize rogue advertising networks.

What is the fake "$OBT Airdrop"?

"$OBT Airdrop" is a scam that masquerades as the official website of Orbiter Finance (orbiter.finance). The fake site promotes an airdrop of the OBT token (Orbiter Finance's native token). Users who attempt to participate in this bogus event – inadvertently expose their digital wallets to a cryptocurrency drainer.

What kind of malware is EByte Locker?

We discovered EByte Locker while analyzing malware samples submitted to VirusTotal. During the inspection, we found that EByte Locker is ransomware based on Prince. Upon infiltration, EByte Locker encrypts files and appends ".EByteLocker" to them. It also changes the desktop wallpaper and provides a ransom note ("Decryption Instructions.txt").

Here is an example of how EByte Locker renames files: it changes "1.jpg" to "1.jpg.EByteLocker", "2.png" to "2.png.EByteLocker", etc.