Virus and Spyware Removal Guides, uninstall instructions

What kind of malware is Noctua?

Noctua is a ransomware variant belonging to the Makop ransomware family. Our team has discovered this variant during the analysis of malware samples submitted to VirusTotal. It was found that Noctua encrypts files and appends a string of random characters, the noctua0302@goat.si email address, and the ".noctua" extension to filenames.

It also creates a ransom note (the "readme-warning.txt" file). An example of how Noctua ransomware modifies filenames: it renames "1.jpg" to "1.jpg.[87C29B86].[noctua0302@goat.si].noctua", "2.png" to "2.png.[87C29B86].[noctua0302@goat.si].noctua", and so on.

What is "Your phone is severly damaged by viruses"?

"Your phone is severly damaged by viruses" is a scam that our research team discovered while inspecting rogue websites. It claims that the visitor's mobile device has suffered damage from viruses and urges them to renew their McAfee anti-virus subscription.

It must be emphasized that all these claims are false, and the actual McAfee Corp. is in no way associated with this scam.

What is womenlifewellness[.]com?

We have discovered the womenlifewellness[.]com page during the analysis of various torrent pages, illegal movie steaming, and other sites that use shady advertising networks. It is an untrustworthy page that runs some health fraud scam and asks for permission to show notifications.

What kind of scam is "Someone matched with you on Tinder!"?

Our team has analyzed this email and found that it is a fake email notification from Tinder claiming that someone has matched with you. It is worth mentioning that Tinder actually sends such notifications to its users. However, this one is sent by scammers who attempt to trick users into opening a deceptive page.

What kind of malware is Tuid?

Our malware researchers have discovered a new Djvu ransomware variant called Tuid (it was found while checking malware samples submitted to the VirusTotal page). This variant encrypts files, appends the ".tuid" extension to filenames, and creates a ransom note (it generates a text file named "_readme.txt").

An example of how files encrypted by Tuid are modified: "1.jpg" is renamed to "1.jpg.tuid", "2.png" is renamed to "2.png.tuid", and so forth.

What kind of malware is Putin_Huilo_NoWar?

Putin_Huilo_NoWar is ransomware that our team has discovered while checking the VirusTotal page for submitted malware samples. While analyzing this ransomware, we noticed that it did not encrypt our files (but may encrypt files stored on other computers). Also, Putin_Huilo_NoWar displayed a pop-up window with a ransom note in it (written in the Russian language).

What kind of scam is "Binance email scam"?

After analyzing this email scam, we concluded that it is a phishing email used to steal sensitive information. Scammers behind it pretend to be the Binance team. Their goal is to trick users into believing that they can receive 0.10 BNB tokens for linking their wallet with a Binance account via the provided website.

What kind of scam is "Your card was added to Apple pay"?

It is a phishing scam used to trick unsuspecting users into providing credit card details. Scammers use a deceptive website disguised as the official Apple page to extract information. That site is promoted using other pages that use rogue advertising networks and mobile text messages (smishing messages).

What is the Raiffeisen Bank email scam?

Our team has analyzed this email and found that it is disguised as a letter from a bank called Raiffeisen (a legitimate banking company). It is written in the Czech language and contains a website link. Scammers behind it attempt to trick recipients into providing sensitive information on a deceptive page.

What kind of application is mini dark?

We have discovered the mini dark browser extension while examining deceptive websites. After downloading and installing this app, we learned that it operates as a browser hijacker. It changes the settings of a web browser to promote a fake search engine (getsins.com). Thus, the mini dark is not a trustworthy browser extension.