Virus and Spyware Removal Guides, uninstall instructions

What is Redox stealer?

Redox is the name of a stealer-type malware that our researchers found while inspecting hotspots for selling malicious software. Redox is designed to extract sensitive information from infected systems and various applications installed onto them.

What kind of page is windows-hold[.]com?

Windows-hold[.]com is a deceptive website that runs a scam similar to "McAfee - Your PC is infected with 5 viruses!". Also, it asks for permission to display notifications. We discovered windows-hold[.]com while inspecting other pages that use rogue advertising networks (illegal movie streaming, torrent sites, and similar pages).

What kind of application is Moviety?

Moviety is described as "a perfect browser extension for movie lovers of all stripes". We have discovered this app on a deceptive website. After downloading and adding Moviety to a browser, we noticed that it shows intrusive advertisements. It means that Moviety is an advertising-supported application (also known as adware).

What kind of page is online-guard[.]com?

Our researchers discovered the online-guard[.]com rogue page while inspecting dubious websites. This webpage is designed to promote scams, push spam browser notifications, and redirect visitors elsewhere (likely unreliable/malicious websites). Most users enter sites of this kind via redirects caused by webpages that use rogue advertising networks.

What kind of application is Ad Blocker App?

Ad Blocker App is promoted as a free browser extension that blocks advertisements. Ironically, after testing the app, we found that it generates advertisements (it is an advertising-supported application). It is worth mentioning that adware is often distributed using questionable methods - users tend to install adware unknowingly.

What kind of page is notificationnewsspace[.]com?

While inspecting questionable sites, we discovered the notificationnewsspace[.]com rogue webpage. It promotes browser notification spam (via fake CAPTCHA) and redirects visitors to other (likely untrustworthy/malicious) websites. Most users enter such webpages through redirects caused by sites using rogue advertising networks.

What kind of application is Tuning Videos?

Tuning Videos is described as an app that protects the eyes and improves sleeping cycles by adjusting video temperature and many other properties. After downloading and adding it to a browser, we found that it has an additional property - it shows advertisements. Thus, we categorized Tuning Videos as adware.

What kind of malware is Rrbb?

Rrbb is the name of ransomware that our team has discovered during the analysis of malware samples submitted to VirusTotal. We found that Rrbb belongs to a ransomware family called Djvu. It encrypts files, appends the ".rrbb" extension to filenames, and provides a ransom note (in the "_readme.txt" file).

An example of how Rrbb modifies filenames: it renames "1.jpg" to "1.jpg.rrbb", "2.png" to "2.png.rrbb", "3.exe" to "3.exe.rrbb".

What kind of malware is Rryy?

We have discovered new ransomware belonging to the Djvu family while analyzing the samples submitted to VirusTotal. It is called Rryy. This ransomware encrypts files, appends its extension (".rryy") to filenames, and generates a text file ("_readme.txt") containing a ransom note.

An example of how Rryy renames files: it changes "1.jpg" to "1.jpg.rryy", "2.png" to "2.png.rryy", and so forth.

What kind of page is advnottech[.]com?

Advnottech[.]com is a rogue webpage that operates by pushing browser notification spam and redirecting visitors to other (likely untrustworthy/malicious) sites.

Our researchers discovered this page while inspecting websites that use rogue advertising networks. Most users access advnottech[.]com (and similar pages) via the aforementioned sites; however, it could also be entered through redirects caused by mistyped URLs, spam browser notifications, intrusive ads, or installed adware.