Virus and Spyware Removal Guides, uninstall instructions

What is energysearch.co?

While examining energysearch.co, we found that it is a shady search engine that may provide misleading results. Typically, search engines of this kind are promoted through browser hijackers. Apps of this type modify the settings of web browsers to promote search engines.

What kind of page is mp3-convert[.]org?

While investigating suspicious websites, our research team found the mp3-convert[.]org page. It operates as a YouTube converter, i.e., the site allows users to convert said platform's video links to downloadable MP3 files. This service break copyright laws. What is more, mp3-convert[.]org is monetized via rogue advertising networks that are known to promote deceptive and malicious content.

What kind of scam is "Requested Information Or Content"?

We have examined this email and determined that it is a phishing email. Typically, scammers behind such emails try to trick individuals into providing sensitive information such as passwords or financial data. In this case, the phishing email is disguised as a letter from an email service provider.

What kind of page is fastcaptcha[.]top?

After investigating fastcaptcha[.]top, our team has determined that it is an untrustworthy website that shows a misleading message to deceive visitors into consenting to receive notifications. Websites like fastcaptcha[.]top are often accessed inadvertently by visitors. We discovered fastcaptcha[.]top while inspecting other shady pages.

What kind of email is "Your Domain And/Or Service Requires Upgrade"?

Our inspection of the "Your Domain And/Or Service Requires Upgrade" email revealed that it is spam. This fake letter informs the recipient that their email account has failed to upgrade and will be deleted. It urges updating the mail so as to avoid its deactivation. The aim of this spam letter is to promote a phishing website that records entered email passwords.

What kind of malware is Atharvan?

Atharvan is the name of a Remote Access Trojan (RAT). The purpose of malware of this type is to give an attacker unauthorized access to a computer or device from a remote location. The attacker can perform a variety of malicious activities, such as stealing passwords, deploying additional malware, deleting or modifying files, etc.

What is ChatGPT malware?

"ChatGPT malware" refers to malicious content distributed under the guise of ChatGPT (Chat Generative Pre-trained Transformer) – a chatbot developed by OpenAI. Since its inception in the autumn of 2022, ChatGPT has reached extreme popularity. At the time of writing, its user base has grown over 100 million. It is particularly prevalent that any enormously popular product/service is swiftly taken advantage of by cyber criminals and scammers alike.

Although ChatGPT is only available online (chat.openai.com), numerous fake desktop clients and mobile apps imitating this chatbot have been discovered. A variety of harmful and malicious software has been proliferated using "ChatGPT" as a disguise.

Additionally, OpenAI has released ChatGPT Plus – a paid premium service. This has opened the avenue for cyber criminals to offer "cracked" versions and create fake payment websites that target victims' financial information.

It must be emphasized that this fraudulent and dangerous content is in no way associated with either the actual ChatGPT or OpenAI.

What kind of scam is "World Lottery" email scam?

We have inspected this email and learned that it is a lottery scam email. It is a type of fraud where scammers send emails to unsuspecting individuals, claiming that they have won a large sum of money in a lottery or sweepstakes. These emails typically instruct recipients to respond with personal information.

What kind of malware is Snwkz?

Snwkz is ransomware that our team discovered while examining samples submitted to the VirusTotal website. The purpose of Snwkz is to encrypt files. Also, it creates a ransom note (a file named "[random_string]_HOW_TO_DECRYPT.txt") and renames files by appending a string of random characters and the ".snwkz" extension to filenames.

We found that Snwkz is part of the Hive ransomware family. An example of how it modifies filenames: it changes "1.jpg" to "1.jpg.5GidBrZG88lGZxe-YMbrNscpw4h9e6-NISHVchGL8Ov_qHLbTXn2TV00.snwkz" "2.png" to "2.png.5GidBrZG88lGZxe-YMbrNscpw4h9e6-NISHVchGL8Ov_qHLbTXn2TV00.snwkz", and so forth.

What is search.tablicious.com?

While investigating rogue software, we discovered the search.tablicious.com fake search engine. These illegitimate websites usually cannot generate search results and redirect to genuine search engines; this is true of search.tablicious.com as well.

Sites of this kind are typically promoted (via redirects) by browser hijackers. Furthermore, fake search engines and the software endorsing them – tend to spy on users' browsing activity.