Virus and Spyware Removal Guides, uninstall instructions

What kind of scam is "Transfer Profit Funds"?

After reviewing this letter, we found that it is a phishing email. Its purpose is to convince the recipients that they have earned money from crypto mining. This email contains a link to a phishing website where visitors are asked to provide login information. Recipients should ignore this phishing email.

What kind of application is czgovd[.]com?

During the examination of czgovd[.]com, we discovered that this page uses a clickbait technique to trick visitors into allowing it to display notifications. Also, czgovd[.]com redirects to potentially malicious websites. It is uncommon for such pages to be visited intentionally.

What kind of page is torggissoft[.]com?

While investigating untrustworthy websites, our researchers discovered the torggissoft[.]com rogue page. It promotes deceptive content and spam browser notifications. Additionally, this webpage can redirect visitors to different (likely unreliable/hazardous) sites.

Most users enter torggissoft[.]com and pages akin to it – via redirects caused by websites that use rogue advertising networks.

What kind of page is news-hexuma[.]com?

News-hexuma[.]com is a rogue webpage that we discovered while inspecting rogue sites. It is designed to endorse browser notification spam and redirect visitors to other (likely unreliable/harmful) websites. Users typically enter pages like news-hexuma[.]com through redirects caused by sites using rogue advertising networks.

What is Load All Links?

Our research team discovered the Load All Links browser extension while inspecting untrustworthy websites. This piece of software is presented as a tool capable of quickly selecting all links within a webpage, allowing users to open several simultaneously. However, our analysis of Load All Links revealed that it is adware. This extension runs intrusive ad campaigns and collects private information.

What kind of websiteis cleardating[.]top?

Cleardating[.]top is an untrustworthy page that displays deceptive content as a lure to trick visitors into agreeing to receive notifications from it. Also, cleardating[.]top redirects to similar websites. We discovered cleardating[.]top while examining sites that use shady advertising networks.

What kind of page is myadvastudio[.]com?

While investigating questionable websites, our research team found the myadvastudio[.]com rogue page. It operates by promoting browser notification spam. Additionally, this webpage can redirect visitors elsewhere (likely untrustworthy/harmful) sites.

Users typically enter pages like myadvastudio[.]com via redirects caused by websites that use rogue advertising networks.

What kind of malware is ZFX?

ZFX is ransomware - a type of malicious software that encrypts files. Our malware researchers discovered ZFX while checking the VirusTotal for recently submitted malware samples. In addition to encrypting data, ZFX modifies filenames, changes the desktop wallpaper, and drops the "+README-WARNING+.txt" file (a ransom note).

ZFX appends a string of random characters, cryptedData@tfwno.gf email address, and the ".ZFX" extension to filenames. For instance, it renames "1.jpg" to "1.jpg.[2AF20FA3].[CryptedData@tfwno.gf].ZFX", "2.png" to "2.png.[2AF20FA3].[CryptedData@tfwno.gf].ZFX", and so forth. ZFX is part of the Makop ransomware family.

What is SearchIT New Tab?

While researching dubious websites, our researchers found a page endorsing a browser extension called SearchIT New Tab. After inspecting this piece of software, we determined that it is a browser hijacker. SearchIT New Tab alters browser settings to promote the searchresults.store fake search engine.

What kind of website is advaguru[.]com?

We examined advaguru[.]com and learned that it displays a misleading message to lure visitors into agreeing to receive notifications. Additionally, advaguru[.]com redirects to one or more similar pages. This website was discovered by our team during an inspection of sites that use rogue ad networks.