Virus and Spyware Removal Guides, uninstall instructions

What is "Cornèrcard email scam"?

After receiving this email, our researchers determined that it is a phishing email. The "Cornèrcard" letter in question is fake and in no way associated with Cornèr Bank - a Swiss private bank and credit card business. These emails target French-speaking users and attempt to trick them into disclosing their Cornèrcard account log-in credentials.

What is Arizona ransomware?

Our researchers discovered the Arizona ransomware during an investigation into new malware samples uploaded to VirusTotal.

After running this malicious program on our test system, we noticed it encrypting files and appending their filenames with the ".AZ" extension. For example, a file initially titled "1.jpg" appeared as "1.jpg.AZ","2.jpg" as "2.jpg.AZ", "3.jpg" as "3.jpg.AZ", etc.

Once the encryption process was completed, this ransomware created a message named "README.txt" on the desktop. It also changed the desktop wallpaper.

What is "Wallet Access Connect"?

"Wallet Access Connect" is a phishing scam targeting cryptocurrency wallet log-in credentials. We found it when analyzing sites that use rogue advertising networks. This scheme is presented as a tool to ease access between dApps (decentralized applications) and mobile wallets.

What kind of malware is Factfull?

While testing the sample, we identified that Factfull is ransomware - malware that encrypts files. We learned that this ransomware appends a string of random characters, factfull0103@airmail.cc email address, and the ".factfull" extension to filenames.

For example, it renames "1.jpg" to "1.jpg.[87C29B86].[factfull0103@airmail.cc].factfull", "document.txt" to "document.txt.[87C29B86].[factfull0103@airmail.cc].factfull". Factfull also creates the "readme-warning.txt" file/a ransom note. We also found that Factfull is part of the Makop ransomware family. It was discovered by GrujaRS.

What kind of application is need dark?

While examining the need dark application, we have learned that it hijacks a web browser by changing its settings. The purpose of this app is to promote iwsooos.com - a fake search engine. Our team has discovered the need dark browser hijacker while visiting a deceptive website.

What kind of page is 3v4lu4t3-4pp0intm3nt[.]xyz?

While researching rogue sites, our researchers stumbled upon the 3v4lu4t3-4pp0intm3nt[.]xyz webpage. We've discovered that this website promotes deceptive content and browser notification spam. Additionally, it can redirect visitors to other unreliable/malicious sites. We have observed this website running the "You've visited illegal infected website" scam.

Most users access pages like 3v4lu4t3-4pp0intm3nt[.]xyz unintentionally via others that use rogue advertising networks. However, these webpages can also be entered via redirects caused by deceptive notifications/ intrusive advertisements or installed harmful software.

What kind of page is foodme[.]info?

Our team has discovered foodme[.]info while browsing illegal movie streaming, torrent, adult dating, and similar sites that use questionable advertising networks. At the time of the research, foodme[.]info displayed a fake CAPTCHA to trick visitors into allowing it to deliver notifications.

What kind of website is adroadlinks[.]com?

We have discovered adroadlinks[.]com while visiting websites that use rogue advertising networks (such as illegal movie streaming, torrent sites). After examining adroadlinks[.]com, we learned that this page displays deceptive content and asks for permission to show untrustworthy notifications.

What is Blocker ransomware?

Our researchers discovered Blocker ransomware on VirusTotal. While analyzing the ransomware sample we found that it encrypts files and appends them with the ".blocker" extension. For example, a filename like "1.jpg" appeared as "1.jpg.blocker", "2.jpg" as "2.jpg.blocker", and so on. Once the encryption was finished, Blocker created a ransom note named "#Decrypt#.txt".

What is LinkGraph Analysis?

LinkGraph Analysis is the name of a browser extension endorsed as a tool that allows users to check their websites' SEO (Search Engine Optimization) and provides a comprehensive support link analysis. After installing this piece of software onto our test system, we determined that LinkGraph Analysis is an adware-type browser extension.