Virus and Spyware Removal Guides, uninstall instructions

What kind of malware is Paradies?

Paradies clipper is the name of the malware that steals cryptocurrency from victims by replacing wallet addresses saved in the clipboard with addresses belonging to cybercriminals. It is sold on a hacker forum for 50 euros. The developer of the Paradies clipper describes it as a number one crypto clipper.

What kind of page is keepsafetycore[.]com?

Keepsafetycore[.]com is a rogue website that promotes scams and spam browser notifications. This page can also redirect users to other (likely untrustworthy/malicious) sites.

Our researchers discovered keepsafetycore[.]com while inspecting pages that employ rogue advertising networks. It is noteworthy that most users enter keepsafetycore[.]com and similar webpages through redirects generated by such sites.

What is LiftEffort?

Our research team found the LiftEffort application during a routine inspection of new submissions to VirusTotal. Our analysis of this app revealed that it operates as adware. Additionally, LiftEffort belongs to the AdLoad malware family.

What kind of application is PlusApparel?

After using a fake installer downloaded from a deceptive page, we discovered the PlusApparel application. We found that PlusApparel is a useless application that displays intrusive advertisements. Thus, we classified PlusApparel as adware.

What kind of application is TripleChop?

TripleChop is the name of an application that we discovered after downloading and using a fake installer for the Adobe Flash Player. While analyzing the app, we learned that it generates annoying advertisements. Thus, our team classified TripleChop as adware (advertising-supported software).

What is "You May Have Viruses On After Visiting An Adult Website"?

Our researchers discovered the "You May Have Viruses On After Visiting An Adult Website" scam while inspecting dubious websites. We found two variants of this scheme - one in English and the other in Portuguese.

Like most scams of this kind, "You May Have Viruses On After Visiting An Adult Website" is designed to promote fraudulent and malicious software by making false claims about victims' devices being infected. It is pertinent to mention that no website can detect threats on systems - therefore, any that proclaim such are scams.

What kind of page is ukindwouldm[.]xyz?

Ukindwouldm[.]xyz is one of the many deceptive websites that use clickbait techniques to trick visitors into allowing them to show notifications. Also, ukindwouldm[.]xyz redirects visitors to other pages. Our team discovered this page while inspecting illegal movie streaming, torrent, and similar sites.

What is Lizard Squad ransomware?

While inspecting new malware submissions on VirusTotal, our researchers discovered the Lizard Squad ransomware-type program.

After we executed a sample of this ransomware on our test system, it encrypted files and modified their titles. The filenames were appended with extensions consisting of four random characters, e.g., a file originally named "1.jpg" appeared as "1.jpg.kfk8", "2.png" as "2.png.v5nl", and so on.

Once the encryption process was finished, Lizard Squad created a ransom note titled "說明it.txt", which contained a message in Chinese and English. Furthermore, this ransomware changed the desktop wallpaper.

What is BytesShow?

BytesShow is a piece of rogue software that our researchers discovered while inspecting new submissions to VirusTotal. After running this app on our test system, we learned that BytesShow operates as advertising-supported software (adware) and belongs to the AdLoad malware family.

What kind of application is WiseInternational?

While analyzing websites encouraging to update "outdated" software (distributing fake installers), we discovered an application called WiseInternational. We found that this is an advertising-supported app. In other words, WiseInternational is designed to generate intrusive advertisements.