Virus and Spyware Removal Guides, uninstall instructions

What is CreedNetwork?

CreedNetwork is a rogue application discovered by our research team during a routine investigation of new submissions to VirusTotal. We inspected this piece of software and determined that it operates as adware. It is noteworthy that CreedNetwork is part of the AdLoad malware family.

What kind of malware is Triada?

Triada is the name of a Trojan targeting Android users. Cybercriminals distribute this Trojan via a modified version of WhatsApp called FMWhatsapp (and possibly other apps). Once the app with Triada hidden in it is launched, the Trojan gathers various device information to set up a communication channel and drops additional payloads via a remote server.

What is Wizard ransomware?

Our research team discovered the Wizard malicious program during a routine inspection of new submissions to VirusTotal. It is classified as ransomware - a type of malware that encrypts data and makes ransom demands for the decryption tools.

After we executed a sample of Wizard ransomware on our testing system, it encrypted files and altered their titles. The original filenames were appended with a ".wizard" extension, e.g., a file named "1.jpg" appeared as "1.jpg.wizard", "2.png" as "2.png.wizard", etc.

Once the encryption process was completed, a ransom-demanding message - "decrypt_instructions.txt" - was created on the desktop.

What kind of malware is TeamDarkAnon?

TeamDarkAnon is ransomware designed to encrypt files, change the desktop wallpaper, drop a ransom note (the "read_it.txt") file, and append the ".anon" extension to filenames. Files encrypted by ransomware cannot be opened until they are decrypted. We discovered TeamDarkAnon while examining malware samples submitted to VirusTotal.

An example of how TeamDarkAnon modifies filenames: it renames "1.jpg" to "1.jpg.anon", "2.png" to "2.png.anon", "3.exe" to "3.exe.anon", and so forth.

What kind of email is "Pending Messages On Our Remote Server"?

Our inspection of the "Pending Messages On Our Remote Server" email revealed that it operates as a phishing scam. This letter seeks to obtain the recipient's email account log-in credentials by making false claims about messages failing to reach their inbox.

What kind of application is ModemMaterial?

ModemMaterial is the name of an application our team discovered after downloading and using a fake installer for the Adobe Flash Player. While testing ModemMaterial, we learned that it generates intrusive advertisements. Software that shows unwanted advertisements is called adware.

What kind of malware is Unique?

Unique is ransomware that makes files inaccessible by encrypting them, modifies their filenames, and generates two ransom notes ("info.txt" and "info.hta" files). Unique is part of the Phobos ransomware family. We discovered it on VirusTotal (while checking this page for recently submitted malware samples).

Unique renames files by appending the victim's ID, uniqueproject@xsmail.com email address, and ".unique" extension. For example, it renames "1.jpg" to "1.jpg.id[9ECFA84E-3379].[uniqueproject@xsmail.com].unique", "2.png" to "2.png.id[9ECFA84E-3379].[uniqueproject@xsmail.com].unique", and so forth.

What kind of page is wnprt[.]club?

While inspecting wnprt[.]club, our team learned that it has two purposes: to trick visitors into believing that their computers are infected (and purchasing antivirus software) and allowing it to show notifications. It runs the "McAfee - Your PC is infected with 5 viruses!" scam.

We discovered wnprt[.]club while examining pages that use rogue advertising networks (open shady pages and display deceptive ads).

What kind of page is analysissoftwarecentr[.]com?

Our researchers discovered the analysissoftwarecentr[.]com rogue webpage during a routine inspection of questionable websites. This page is designed to promote scams, push spam browser notifications, and redirects visitors to other (likely untrustworthy/malicious) sites.

Users typically access analysissoftwarecentr[.]com and similar webpages through redirects caused by sites that employ rogue advertising networks.

What is RankBet?

Our research team discovered the RankBet rogue app while inspecting new submissions to VirusTotal. After installing this piece of software onto our test system, we learned that it operates as adware. It is noteworthy that RankBet belongs to the AdLoad malware family.