Virus and Spyware Removal Guides, uninstall instructions

What is the CryptoWallet Address Replacing Virus?

CryptoWallet Address Replacing Virus refers to a system infection with a malicious program, which has clipper functionalities.

Clippers (also known as clipboard hijackers) are designed to change the data copied into the clipboard. In this article we will analyze clippers designed to replace copied cryptocurrency wallet addresses before an outgoing transaction - thereby redirecting the funds to cryptowallets belonging to the cyber criminals.

What kind of page is freecaptcha[.]top?

Our researchers found the freecaptcha[.]top rogue webpage while checking out untrustworthy sites. This page is designed to push spam browser notifications and redirect visitors to different (likely unreliable/malicious) webpages. Most users enter them through redirects caused by websites using rogue advertising networks.

What is ExpressionCargo?

While inspecting new submissions to VirusTotal, we found the ExpressionCargo rogue application. Our analysis revealed that this app operates as advertising-supported software (adware) and belongs to the AdLoad malware family.

What kind of page is trusted-captcha[.]top?

Our research team discovered the trusted-captcha[.]top rogue page while inspecting dubious websites. It is designed to push browser notification spam and redirect visitors to other (likely untrustworthy/malicious) sites. Most users access such webpages through redirects caused by sites using rogue advertising networks.

What is "LUNA Giveaway"?

While inspecting deceptive websites, our research team found the "LUNA Giveaway" scam. It promises users twice-fold the return on the cryptocurrency that users transfer to it. However, this giveaway is a scam, and all the funds given to it will be lost.

To create the impression of legitimacy, the scam is presented as an event held by Do Kwon - the cryptocurrency developer and co-founder/CEO of Terraform Labs. It must be emphasized that neither Do Kwon nor any other individual/entity mentioned by this scam are associated with it.

What kind of page is captchatest[.]top?

Captchatest[.]top is a rogue webpage that we found while inspecting untrustworthy sites. This page is designed to push browser notification spam and redirect visitors to other (likely unreliable/malicious) websites. Users typically enter such webpages through redirects caused by sites using rogue advertising networks.

What is "Twitter Crypto Giveaway"?

After inspecting the "Twitter Crypto Giveaway" we determined that it is a scam. Similar to countless fake cryptocurrency giveaways, this scam promises to double the amount of Bitcoin (BTC) or Ethereum (ETH) that users transfer to it.

The scheme is presented as a giveaway created by Elon Musk - a business magnate and investor and the Twitter social networking platform. The scammers likely incorporated the two together due to the proposed acquisition of Twitter by Elon Musk in 2022. It must be emphasized that neither Elon Musk nor Twitter, Inc. are associated with this scam.

What is Eegf ransomware?

Our research team discovered the Eegf ransomware while inspecting new submissions to VirusTotal. We determined that this program belongs to the Djvu ransomware family.

After we launched this ransomware on our test machine, it encrypted files and appended their filename with the ".eegf" extension. For example, a file initially titled "1.jpg" appeared as "1.jpg.eegf", "2.png" as "2.png.eegf", and so on. Once this process was completed, a ransom-demanding message - "_readme.txt" - was created.

What is Bnrs ransomware?

Bnrs is a ransomware-type program that our researchers discovered while inspecting new submissions to VirusTotal. We determined that Bnrs is part of the Djvu ransomware family.

When we executed a sample of this ransomware on our test machine, it encrypted files and appended their filenames with a ".bnrs" extension. For example, a file initially titled "1.jpg.bnrs" appeared as "1.jpg.bnrs", "2.png" as "2.png.bnrs", etc. Afterwards, a ransom note - "_readme.txt" was created.

What is Fit Video Display?

Fit Video Display is a rogue browser extension that our researchers discovered while inspecting deceptive download webpages. This piece of software promises various video display related features. However, our analysis revealed that Fit Video Display operates as adware.