Virus and Spyware Removal Guides, uninstall instructions

What kind of email is "Mail Delivery Failed"?

Our inspection of the "Mail Delivery Failed" email revealed that it is spam operating as a phishing scam. This letter aims to extract recipients' email account log-in credentials through false claims regarding messages that have failed to reach the inbox.

What kind of scam is "Validate Your Wallet"?

We have inspected this email and found that it is a phishing email sent by scammers who attempt to trick recipients into providing sensitive information. It urges recipients to validate their cryptocurrency wallets via the provided website - a fake page requesting to enter login information.

What kind of malware is Bozewerkers?

While examining malware samples submitted to VirusTotal, we discovered a new Nitro ransomware variant dubbed Bozewerkers. This variant encrypts data and appends the ".givemenitro" extension to filenames. Also, Bozewerkers changes the desktop wallpaper and displays a ransom note.

An example of how Bozewerkers modifies filenames: it renames "1.jpg" to "1.jpg.givemenitro", "2.png" to "2.png.givemenitro", and so forth.

What kind of page is trackedpcscanner[.]com?

Trackedpcscanner[.]com is the URL of a rogue page discovered by our researchers during a routine inspection of dubious websites. It operates by running scams and promoting spam browser notifications. Additionally, this webpage can redirect visitors elsewhere (likely unreliable/dangerous sites).

Most users access pages like trackedpcscanner[.]com via redirects caused by websites using rogue advertising networks.

What kind of page is guardpcsyst[.]online?

While checking out dubious webpages, our researchers discovered the guardpcsyst[.]online rogue page. It is designed to promote scams and browser notification spam. Furthermore, guardpcsyst[.]online can redirect visitors to different (likely untrustworthy/malicious) websites.

Users typically access such pages through redirects caused by sites that use rogue advertising networks.

What kind of email is "Dormant Account"?

The "Dormant Account" email is spam. It is presented as a letter from a bank auditing director regarding a dormant account of a late customer. The email suggests splitting the millions within it between the sender and recipient.

It must be emphasized that all the claims made by the "Dormant Account" letter are false. Typically, this scam model is used to trick recipients into disclosing private data and/or transferring their own money to the scammers.

What is Daily Inspiration?

Daily Inspiration is the name of a browser extension promising various widgets and features, such as displaying inspirational/motivational quotes, a clock, the weather forecast, sticky notes, and a to-do list on the browser's homepage. Our researchers discovered this piece of software while investigating suspicious websites.

After inspecting Daily Inspiration, we learned that it operates as a browser hijacker. In other words, this extension modifies browser settings and promotes the find.dsrcnav.com fake search engine.

What is Rdapdylvb ransomware?

Rdapdylvb is a malicious program belonging to the Snatch ransomware family. Our researchers discovered this ransomware-type program while inspecting new submissions to VirusTotal.

After we executed a sample of Rdapdylvb on our test machine, it encrypted files and altered their filenames. Original titles were appended with a ".rdapdylvb" extension, e.g., a file like "1.jpg" appeared as "1.jpg.rdapdylvb", "2.png" as "2.png.rdapdylvb", etc.

Once this process was completed, a ransom note – "HOW TO RESTORE YOUR FILES.TXT" – was created. Based on the information therein, it is evident that this ransomware targets companies rather than home users.

What kind of page is validitysaver[.]com?

We have inspected validitysaver[.]com and found that it is a deceptive website that uses a scare tactic to promote antivirus software. Validitysaver[.]com runs the "McAfee - Your PC is infected with 5 viruses!" scam. Also, this website asks for permission to show notifications.

What kind of malware is Mzop?

While analyzing Mzop, we found that it is ransomware that encrypts files. Also, it appends the ".mzop" extension to filenames and creates a ransom note (the "_readme.txt" file). Our team discovered Mzop while inspecting malware samples submitted to the VirusTotal website.

An example of how Mzop renames files: it changes "1.jpg" to "1.jpg.mzop", "2.png" to "2.png.mzop", and so forth. It is important to mention that Mzop is part of the Djvu ransomware family. Threat actors have been observed distributing ransomware belonging to this family alongside RedLine, Vidar, and other information stealers.