Emukentha.work ads (spam) - Chrome, Firefox, IE, Edge

What is Emukentha.work ads?

Emukentha.work starts spamming users with annoying pop-up ads that can lead to shady sites

Emukentha.work sends annoying pop-up ads straight to users' screens

Emukentha.work is owned by fraudsters who want to generate revenue from pay-per-click advertising^[1] via push notifications. The website has a message which entices sports fans to subscribe to the services. It says that users will receive the latest sports updates from around the world.

Sadly, this is not true as users start getting spammed with annoying pop-up ads unrelated to sport. Because the developers of the site do not care about user privacy or security, they do not filter which ads can show up on their screens. Ads that you see may use sensational images and messages to get you to click on them.

As a result, links embedded in the pop-ups can lead to dangerous websites that try to trick users into providing their personal information or downloading PUPs (potentially unwanted programs)^[2] and malware. As you can see, even though push notifications are not malicious in themselves, they can create serious problems for everyday users.

Distribution methods

It is unusual for people to find these kinds of pages in search results. Most of the time, users get redirected to Emukentha.work, and other similar sites, like Otaherreau.xyz, Gcouncerne.xyz, and Ngmansucc.xyz from other shady websites they were browsing through previously.

Many people think that viruses and Internet fraud is a thing of the past. In reality, the number of pages that engage in such activities has only risen in recent years. People spend more and more time on their screens and this opportunity was not overlooked by crooks who want to take advantage of less IT-savvy individuals.

As a result, there are countless deceptive ads and sneaky redirects that redirect users to pages just like this one. This usually happens on sites that engage in illegal activities because they are unregulated. On illegal streaming platforms^[3] you might see many buttons saying “Download” or “Play.” Unfortunately, these are just ads that open new tabs and take users to untrusted pages.

Even though Google said it would get rid of them, they still exist, so people are still vulnerable to these social engineering techniques. That is why it is best to use only legitimate services, official web stores, etc. It is better to pay a small monthly subscription fee to Netflix and watch as many movies as you like than go lurking on one of these sites and risk infecting your device or becoming a victim of fraud.

Emukentha.work may use cookies to track users' browsing activities

Block push notifications from Emukentha.work

To block site permissions, you have to do it manually via browser settings:

Google Chrome (desktop):

1. Open Google Chrome browser and go to Menu > Settings.
2. Scroll down and click on Advanced.
3. Locate the Privacy and security section and pick Site Settings > Notifications.
4. Look at the Allow section and look for a suspicious URL.
5. Click the three vertical dots next to it and pick Block. This should remove unwanted notifications from Google Chrome.

Google Chrome (Android):

1. Open Google Chrome and tap on Settings (three vertical dots).
2. Select Notifications.
3. Scroll down to Sites section.
4. Locate the unwanted URL and toggle the button to the left (Off setting).

Mozilla Firefox:

1. Open Mozilla Firefox and go to Menu > Options.
2. Click on Privacy & Security section.
3. Under Permissions, you should be able to see Notifications. Click Settings button next to it.
4. In the Settings – Notification Permissions window, click on the drop-down menu by the URL in question.
5. Select Block and then click on Save Changes. This should remove unwanted notifications from Mozilla Firefox.

Safari:

1. Click on Safari > Preferences…
2. Go to Websites tab and, under General, select Notifications.
3. Select the web address in question, click the drop-down menu and select Deny.

MS Edge:

1. Open Microsoft Edge, and click the Settings and more button (three horizontal dots) at the top-right of the window.
2. Select Settings and then go to Advanced.
3. Under Website permissions, pick Manage permissions and select the URL in question.
4. Toggle the switch to the left to turn notifications off on Microsoft Edge.

MS Edge (Chromium):

1. Open Microsoft Edge, and go to Settings.
2. Select Site permissions.
3. Go to Notifications on the right.
4. Under Allow, you will find the unwanted entry.
5. Click on More actions and select Block.

Internet Explorer:

1. Open Internet Explorer, and click on the Gear icon at the top-right on the window.
2. Select Internet options and go to Privacy tab.
3. In the Pop-up Blocker section, click on Settings.
4. Locate web address in question under Allowed sites and pick Remove.

After removal is complete, we recommend using FortectIntego maintenance tool to clear your browsers. Almost every website you visit uses cookies^[4] to track your browsing activity, like the pages you visit, links you click on, and purchases you make. This data can later be sold to advertising networks that will use it to target you with more ads.

In worst cases, cookies can be hijacked and used for malicious purposes. The fact that you have pop-ups appearing from questionable sources means that you most likely were surfing through untrusted pages. Your browsing history may not be private and could end up in the wrong hands.

PUAs

One thing that we did not mention before is that the reason you ended up on Emukentha.work might be adware. It is a type of PUP that hides in your machine and performs tasks in the background like causing pop-ups, banners, redirects, and other commercial content to appear.

The most common way people get infected by adware is through freeware distribution sites. They include additional programs in the installers that monetize user activity. Many users do not really pay attention to the installation process and skip through the steps. If you want to avoid the installation of PUAs, follow these steps during the installation:

• Always choose the “Custom” or “Advanced” installation methods
• Read the Terms of Use and Privacy Policy to find to how your data will be used
• Inspect the file list and untick the boxes next to any bundled software

It is unknown which particular app could be causing unwanted symptoms, because they are often disguised as handy tools that you would not even suspect. We suggest using trusted professional security tools SpyHunter 5Combo Cleaner or Malwarebytes to scan your machine automatically. It should detect most suspicious apps and processes running in your system and remove them successfully. Otherwise, you can remove the program manually:

Windows 10/8:

1. Enter Control Panel into Windows search box and hit Enter or click on the search result.
2. Under Programs, select Uninstall a program.
3. From the list, find the entry of the suspicious program.
4. Right-click on the application and select Uninstall.
5. If User Account Control shows up, click Yes.
6. Wait till uninstallation process is complete and click OK.

Windows 7/XP:

1. Click on Windows Start > Control Panel located on the right pane (if you are Windows XP user, click on Add/Remove Programs).
2. In Control Panel, select Programs > Uninstall a program.
3. Pick the unwanted application by clicking on it once.
4. At the top, click Uninstall/Change.
5. In the confirmation prompt, pick Yes.
6. Click OK once the removal process is finished.

Mac:

1. From the menu bar, select Go > Applications.
2. In the Applications folder, look for all related entries.
3. Click on the app and drag it to Trash (or right-click and pick Move to Trash)

To fully remove an unwanted app, you need to access Application Support, LaunchAgents, and LaunchDaemons folders and delete relevant files:

1. Select Go > Go to Folder.
2. Enter /Library/Application Support and click Go or press Enter.
3. In the Application Support folder, look for any dubious entries and then delete them.
4. Now enter /Library/LaunchAgents and /Library/LaunchDaemons folders the same way and terminate all the related .plist files.