12,248guides5,475members
14:45briannacorporation.com: a business website listed for GuLoader and Remcos RAT files, and what to do on Windows13:50How to check for malware on Android: signs, scan and removal12:20Venmo scam calls on iPhone and Android: is it real and what to do11:20Shipments free scam on iPhone and Android: fake delivery texts and free shipping offers07:00Walmart scam calls on iPhone and Android: what they are and what to do06:18FuelSync scam? What we found, and what to do on iPhone and Android if you paid11 Octniggersmp.net: a Minecraft cheat client site whose .jar downloads URLhaus tags SilentNet, and what to do if you ran one11 OctFTX scam: what it is, how the fake FTX claim e-mails work and what to do

12,243 guides

Viruses removal guides

What a threat is, how it got in and how to remove it, step by step.

Most searched viruses guides

  1. 1Remove Googleads.g.doubleclick.net
  2. 2Remove Tsyndicate.com
  3. 3Remove Xhamster.com virus
  4. 4Remove Csrss.exe trojan
  5. 5Remove Chaturbate.com
  6. 6Remove Googlesyndication
  7. 7Remove Nutaku malware
  8. 8Remove Goto-searchitnow.global.ssl.fastly.net
  9. 9Remove PDFSpark
  10. 10Remove Tongtonger.click ads

How viruses gets in

Fake and unwanted search engines2,586 guidesMalicious browser extensions2,516 guidesPush notification spam1,923 guidesSoftware bundling and freeware installers1,630 guidesCracks, keygens and torrents564 guidesWeather, maps, news and recipe apps430 guidesMalicious email attachments (malspam)396 guides"Click Allow if you are not a robot" pages348 guidesCoupon and shopping extensions348 guides

Newest viruses removal guides 1–27 of 12,243

Remove briannacorporation.com: a business website listed for GuLoader and Remcos RAT files, and what to do on Windows

briannacorporation.com is a web address that URLhaus lists four times, on 9 and 12 October 2026, for encrypted or encoded files tagged GuLoader and RemcosRAT, a loader and a remote access trojan for Windows. The...TRHigh riskUgnius Kiguolis ·

Remove How to check for malware on Android: signs, scan and removal

To check for malware on Android, look for the warning signs, run a Google Play Protect scan, go through your apps and special permissions, and test in safe mode. If anything harmful turns up, uninstall it, change...TRMedium riskUgnius Kiguolis ·

Remove Venmo scam calls on iPhone and Android: is it real and what to do

Venmo scam calls are phone calls or voicemails from people who pretend to be Venmo, its fraud team or someone who sent you money, to get a code, a password or a payment. Hang up, open the Venmo app yourself to check...TRHigh riskUgnius Kiguolis ·

Remove Shipments free scam on iPhone and Android: fake delivery texts and free shipping offers

"Shipments free scam" is what people type after a text says a shipment is held or free to claim, or after an ad offers a free item if you only pay shipping. The text is a known scam pattern, the ad often is one, and...TRHigh riskUgnius Kiguolis ·

Remove Walmart scam calls on iPhone and Android: what they are and what to do

Walmart scam calls are fake calls, usually robocalls, that use Walmart's name to claim a large order on your account and push you to press 1 or call back. Hang up without pressing anything, check your real Walmart...ADHigh riskUgnius Kiguolis ·

Remove FuelSync scam? What we found, and what to do on iPhone and Android if you paid

FuelSync is the name of a plug-in gadget sold online as a gas saver, and people search for it because the savings claims look too good and some reviews warn about billing. We found no regulator ruling and no...TRMedium riskUgnius Kiguolis ·

Remove niggersmp.net: a Minecraft cheat client site whose .jar downloads URLhaus tags SilentNet, and what to do if you ran one

niggersmp.net is a website that offers free Minecraft cheat clients, and URLhaus lists four of its .jar downloads (Radium_Client.jar, krypton.jar, 4E_Client.jar and Zyphers_Rig_Mod.jar) as malware tagged SilentNet. A...TRHigh riskUgnius Kiguolis ·

Remove H1B scam: how fake H-1B job offers and visa fee demands work, and what to do

An H1B scam is a fake job or visa offer that promises H-1B sponsorship and then asks the worker to pay a fee, send identity papers or both. A real employer pays the H-1B filing costs, so stop paying, check the...TRHigh riskUgnius Kiguolis ·

Remove Findwide search engine: is it safe, and how to remove it from your browser

Findwide is a search engine name that users report as a browser hijacker: it replaces the home page and default search. If it is your search engine and you did not choose it, remove the extension or program that set...BHMedium riskUgnius Kiguolis ·

Remove Is Honeytoon a scam? What we found for iPhone and Android users

Honeytoon is a webtoon app for iPhone and Android, and the people who search whether it is a scam mostly mean its charges. We found a working service with many billing complaints, not a proven scam and not malware....ADHigh riskUgnius Kiguolis ·

Remove armoniamiddleeast.ae: a site that served fake Chrome installers for Windows, and what to do

armoniamiddleeast.ae is a website that URLhaus lists for three Windows malware downloads named ChromeSetup.exe, Chrome.exe and google.exe, reported on 24 September 2026. They pretend to be Google Chrome installers....TRHigh riskUgnius Kiguolis ·

Remove royalcuts.co.uk: a barber shop site that served fake Chrome installers and CoinMiner files, and what to do

royalcuts.co.uk presents a UK barber shop, but URLhaus lists five Windows program downloads on it, named like Chrome installers, two tagged CoinMiner. All five were offline on 10 October 2026. If you opened one,...TRHigh riskUgnius Kiguolis ·

Remove 0807.st: archives tagged SmartLoader and Stealc, and what to do if you ran one on Windows

0807.st is a web address that URLhaus lists for three files reported on 10 October 2026: two RAR archives and one DAT file, all tagged SmartLoader and Stealc. SmartLoader is a Windows loader and Stealc is a stealer...TRHigh riskUgnius Kiguolis ·

Remove cablewireltd.site: a Windows VIP Keylogger host serving Crypted.ps1 PowerShell files, and what to do if one ran

cablewireltd.site is a web address that URLhaus lists nine times in September 2026 for malware files: seven PowerShell scripts named Crypted.ps1 and two JavaScript loaders, three of them tagged VIPKeylogger, a...TRHigh riskUgnius Kiguolis ·

Remove nordertextil.de: a ClickFix loader site for Windows, and what to do if you pasted its PowerShell command

nordertextil.de is a German web address that URLhaus lists for four malware downloads tagged ClickFix, Loader, exe and powershell, and our browser could not find the domain when we tested it. If you pasted a command...TRHigh riskUgnius Kiguolis ·

Remove tryclix.com: a Mac ClickFix site listed for the MacSync stealer, and what to do if you pasted its command

tryclix.com is a website that URLhaus lists for Mac malware downloads tagged ClickFix and MacSync, and our browser could not find the domain at all when we tested it. If you pasted a command from it into Terminal on...TRHigh riskUgnius Kiguolis ·

Remove maple30.com: a Mac malware host tagged Amos and ClickFix, and what to do if you ran a command from it

maple30.com is a website that URLhaus lists for Mac malware downloads tagged Amos and ClickFix, and it shares an identical file address with another listed host, quillchant14.com. If you pasted a command from it into...TRHigh riskUgnius Kiguolis ·

Remove quillchant14.com: a Mac ClickFix site that serves the Amos stealer, and what to do if you pasted its command

quillchant14.com is a website that URLhaus lists for Mac malware downloads tagged ClickFix and Amos, and it answered our test with a Cloudflare error instead of a page. If you pasted a command from it into Terminal...TRHigh riskUgnius Kiguolis ·

Remove power.belyxhost.in: a Mirai botnet download address for routers and cameras, and what to do if a device of yours may be infected

power.belyxhost.in is a web address that URLhaus lists for 15 malware downloads, 14 of them tagged mirai, a botnet that takes over routers, cameras and other small network devices. The name no longer resolves when we...TRHigh riskUgnius Kiguolis ·

Remove swatting.wiki: a Mirai botnet download address for routers and cameras, and what to do if a device of yours may be infected

swatting.wiki is a web address that URLhaus lists for 14 malware downloads, every one tagged mirai, a botnet that takes over routers, cameras and other small network devices. The name no longer resolves when we look...TRHigh riskUgnius Kiguolis ·

Remove tronzadorasnng.com: a Windows XWorm malware site that hides code in PNG pictures, and what to do if a script from it ran

tronzadorasnng.com is a website that URLhaus lists for malware downloads: The site no longer answers when we look it up. If you ran a script or a pasted command from it on Windows, treat the PC as compromised: change...TRHigh riskUgnius Kiguolis ·

Remove rabbids.cc: a Windows infostealer download site that uses DLL sideloading, and what to do if you ran a file from it

rabbids.cc is a web address that URLhaus lists for 5 malware downloads, tagged infostealer, stealer and dll-sideloading, among them a zip archive and a file named 7za.exe that were still online when we checked. If...TRHigh riskUgnius Kiguolis ·

Remove crystalbranchtw.blog: a .blog address that served Mirai files for routers and cameras, and what to do if a device of yours may be infected

crystalbranchtw.blog is a web address that URLhaus lists for 36 malware downloads, 34 of them tagged mirai, a botnet that takes over routers, cameras and recorders. All 36 were added within 23 seconds on 28 September...TRHigh riskUgnius Kiguolis ·

Remove dstats.qzz.io: a Mirai botnet download address for routers and cameras, and what to do if a device of yours may be infected

dstats.qzz.io is a web address that URLhaus lists for 36 malware downloads, 34 of them tagged mirai, a botnet that takes over routers, cameras and other small network devices. The site no longer answers when we look...TRHigh riskUgnius Kiguolis ·

Remove delphiaonline.top: a Windows malware download site with PowerShell and JavaScript stubs, and what to do if one ran

delphiaonline.top is a website that URLhaus lists for malware downloads: a JavaScript file and two PowerShell scripts both named secured_stub.ps1, all kept in open folders on the server. The site no longer answers...TRHigh riskUgnius Kiguolis ·

Remove uasputnik.com: a Windows ClickFix malware site serving .msi installers, and what to do if you ran one

uasputnik.com is a website that URLhaus lists for three Windows installer (.msi) malware downloads, two of them tagged ClickFix and one tagged Loader, and it refused our test connection. If you pasted a command from...TRHigh riskUgnius Kiguolis ·

Remove reinigung-kosanke.de: a hacked WordPress site that served Formbook PowerShell scripts, and what to do

reinigung-kosanke.de is a German cleaning business website that URLhaus lists for four PowerShell (.ps1) malware downloads tagged Formbook, and it answered our test with a 503 error. If you ran a script from it,...TRHigh riskUgnius Kiguolis ·
123…454
5,475 members already hereReading, writing, commenting and voting. 0 verified · 200 joined this year
All membersJoin