Step-by-Step Malware Removal Instructions

MrWhite Ransomware
Ransomware

MrWhite Ransomware

While inspecting new submissions to VirusTotal, our researchers discovered the MrWhite malicious program. It belongs to a ransomware family called VoidCrypt. After we launched a sample of MrWhite ransomware on our test system, it encrypted files and altered their names. Original filenames were ap

Breaking News Adware
Adware

Breaking News Adware

While examining the Breaking News browser extension, we found that it displays intrusive advertisements and can read and change certain data. Apps that show ads are known as advertising-supported applications. It is common for apps of this type to be promoted and distributed using deceptive method

Fixgroupfactor.com Ads
Notification Spam

Fixgroupfactor.com Ads

Our researchers discovered the fixgroupfactor[.]com rogue page while investigating suspicious websites. This site is considered to be a device/user threat since it is designed to promote deceptive and malicious content, push spam browser notifications, and redirect visitors to other (likely unreli

Files Downloader Assist Adware
Adware

Files Downloader Assist Adware

Our researchers discovered the Files Downloader Assist browser extension while checking out suspicious websites. According to the extension's "official" promotional webpage, this piece of software is a download management tool. However, our inspection of Files Downloader Assist revealed that is ad

Advfandom.com Ads
Notification Spam

Advfandom.com Ads

Our researchers discovered the advfandom[.]com rogue page during a routine inspection of untrustworthy websites. This webpage is designed to push browser notification spam; at the time of research, it did so by using fake CAPTCHA verification. Additionally, this site can redirect visitors to other

Advatravel.com Ads
Notification Spam

Advatravel.com Ads

While investigating suspicious websites, our research team discovered the advatravel[.]com rogue page. It operates by pushing browser notification spam and redirecting users to other (likely unreliable/dangerous) sites. Most visitors to advatravel[.]com and similar webpages enter them through red

ArchiveOperation Adware (Mac)
Mac Virus

ArchiveOperation Adware (Mac)

ArchiveOperation is an application that we discovered while reviewing new submissions to VirusTotal. After analyzing this app, we learned that it is adware belonging to the AdLoad malware family. Adware stands for advertising-supported software. It displays ads (e.g., pop-ups, banners, c

Advdomlab.com Ads
Notification Spam

Advdomlab.com Ads

We have examined advdomlab[.]com and learned that the purpose of this page is to trick visitors into allowing it to show notifications. Also, advdomlab[.]com redirects visitors to other untrustworthy websites. Our team discovered advdomlab[.]com while inspecting pages that use shady advertising ne

Mediumhiquality.com Ads
Notification Spam

Mediumhiquality.com Ads

Wave analyzed mediumhiquality[.]com and found that this page displays a deceptive message to trick visitors into allowing it to show notifications. Also, mediumhiquality[.]com redirects to other websites that use clickbait techniques to receive permission to display notifications. Mediumhi

Search-News Default Search Browser Hijacker
Browser Hijacker

Search-News Default Search Browser Hijacker

While testing the Search-News Default Search application, we found that it functions as a browser hijacker. It promotes a fake search engine (search-news.xyz) by changing some of the settings of a web browser. We discovered Search-News Default Search on a shady web page. Search-News Defaul