Virus and Spyware Removal Guides, uninstall instructions

What is Dkey ransomware?

While inspecting new malware submissions to VirusTotal, our researchers came upon the Dkey ransomware-type program. It belongs to the Dharma ransomware family, and it is designed to encrypt data and demand payment for decryption.

Once executed on our test system, Dkey began encrypting files and altering their filenames. Original titles were appended with a unique ID, the cyber criminals' email, and a ".dkey" extension. For example, a file named "1.jpg" appeared as "1.jpg.id-9ECFA84E.[Daniel22key@aol.com].dkey".

After this process was completed, the ransomware displayed a pop-up window and created a text file - "FILES ENCRYPTED.txt" - on the desktop.

What is NetSearchPanel?

While inspecting new submissions to VirusTotal, our research team found a rogue application named NetSearchPanel. Following our analysis of this application, we determined that it operates as adware. It is pertinent to mention that NetSearchPanel is part of the AdLoad malware family.

What kind of page is nidescar[.]com?

Nidescar[.]com is a rogue site designed to deceive visitors into enabling spam browser notification delivery. It is also capable of redirecting them to various (likely untrustworthy/malicious) websites.

Users typically access such webpages through redirects caused by sites that use rogue advertising networks. Our researchers discovered nidescar[.]com while inspecting websites of this kind.

What is Solo (VoidCrypt) ransomware?

Our research team discovered the Solo ransomware-type program during a routine investigation of new submissions to VirusTotal. This piece of malicious software is part of the VoidCrypt ransomware family.

After we executed a sample of Solo (VoidCrypt) on our testing system, it encrypted files and modified their titles. Original filenames were appended with a unique ID assigned to the victim, the cyber criminals' email address, and a ".solo" extension. For example, a file named "1.jpg" appeared as "1.jpg.(CW-DV6109742358)(decryptionfiles@gmail.com).solo" following encryption.

Once this process was completed, the ransomware dropped a ransom-demanding message titled "unlock-info.txt" onto the desktop.

What kind of page is newadsfit[.]com?

While inspecting dubious websites, our researchers found the newadsfit[.]com webpage. It operates by attempting to trick visitors into allowing spam browser notification delivery. Additionally, this site can redirect users to other (likely untrustworthy/dangerous) websites.

Most visitors to pages like newadsfit[.]com access them through redirects caused by sites using rogue advertising networks.

What kind of website is topmusicalcomedy[.]com?

After examining topmusicalcomedy[.]com, our team found that it is one of the deceptive pages designed to lure visitors into agreeing to receive notifications from it. We also found that topmusicalcomedy[.]com can redirect visitors to other untrustworthy websites. We discovered this site while inspecting pages that use rogue advertising networks.

What kind of page is essential-scan[.]com?

While inspecting essential-scan[.]com, we learned that it runs the "McAfee - Your PC is infected with 5 viruses!" scam and wants to show notifications. It displays deceptive content (uses deceptive marketing) to trick visitors into purchasing legitimate antivirus software. Typically, users open such pages unintentionally.

What kind of page is cartech[.]cfd?

Cartech[.]cfd is the address of a rogue webpage that our research team discovered while inspecting dubious sites. This page attempts to deceive visitors into allowing it to display browser notification spam. Furthermore, this website can redirect visitors to different (likely untrustworthy/malicious) pages.

Most users access cartech[.]cfd and similar webpages through redirects caused by sites that use rogue advertising networks.

What kind of page is fun4me[.]click?

Fun4me[.]click is a rogue webpage promoting browser notification spam. Our researchers discovered this site during a routine inspection of untrustworthy websites.

Visitors to fun4me[.]click and sites akin to it - typically access them via redirects caused by webpages that use rogue advertising networks, spam notifications, mistyped URLs, intrusive ads, or installed adware.

What kind of page is xxx-offers[.]com?

While investigating untrustworthy websites, our research team discovered the xxx-offers[.]com rogue page. It is designed to push spam browser notifications and redirect visitors to other (likely dubious or malicious) webpages.

Most commonly, sites like xxx-offers[.]com are accessed through redirects caused by pages that use rogue advertising networks.