Kfx7-67 – a pop-up virus that's targetting Android users

Kfx7-67 virus is a fake alert that people may encounter when browsing the internet on their Android smartphones. The notification usually appears after clicking on deceptive ads or can be caused by a sudden redirect. The latter is typically the result of adware[1] installed on users' devices.
Upon accessing a malicious site, the pop-up shows up immediately, claiming that the phone was infected with malware. After clicking “Ok,” users are redirected to a website that is designed to look threatening – a huge “VIRUS” warning and red color are used to intimidate the visitor.
Since many users are unaware that this type of notification is a scam, they believe that they have been actually infected with malware and that they need to eliminate it with the provided “Security App.” However, the Kfx7-67 virus is a hoax, and users should not install anything offered by this rogue notification.
| Name | Kfx7-67 virus |
| Type | Malicious advertisement, browser redirect, Android virus |
| Targets | The fake alert mostly targets Android device users (Samsung, LG Moto, Google Pixel, OnePlus, Xiaomi, and others) |
| Distribution | The pop-up can be encountered on a random website by chance, although frequent redirects to suspicious and malicious websites can be caused by adware, which is typically distributed via software bundles, fake updates, or bogus virus infection notifications |
| Symptoms | A pop-up shows up within the browser after clicking on an advertisement or being redirected from another website. Once “Ok” is clicked, users are led to another warning in a red background, which claims that the virus was detected on the device and that the “Security App” should be installed to remove it. Otherwise, personal information will be supposedly leaked to hackers |
| Risks | Since the pop-up uses social engineering to frighten users about their devices' security, they might install a malicious app after encountering a prompt. As a result, personal information can be stolen (passwords, logins, bank account details, etc.), other malware installed, and financial losses suffered |
| Elimination | To delete adware from Android device, you should perform a full system scan with anti-malware software or look for the suspicious apps manually as explained below |
| System fix | In case your computer was affected by malicious software, you can fix damage done to system files with the help of FortectIntego or a similar repair tool |
While Kfx7-67 virus alert usually shows up on Android phones or tablets, it does not mean that the pop-up cannot be seen on Windows or Mac machines. Therefore, if you saw the notification on another operating system, you should follow the guide below that would explain how to reset the installed web browsers and remove virus-related entries once and for all. Additionally, for computer users, we recommend using FortectIntego in case the infection was found.
There are two scenarios of how you can encounter deceptive alert:
- You click on an advertisement within the application or on a random website;
- You are redirected via the browser automatically.
Upon entry, you are shown a pop-up window, which is usually accompanied by a “www.website.com says:” phrase (note that URL differs greatly) and the message is as follows:
ATTENTION
KFX7-67 VIRUS FOUND!You personal data are compromised. Your private messages and all phone files can be violated. It is advisable to immediately eliminate the virus.
How to start the cleaning process:
Step 1: Click on the button “eliminate the virus” and install the antivirus Security Antivirus 2017.
Step 2: Scan and remove all viruses foundTIME REMAINING
00:50:14
This message is a classic when it comes to online scams – it uses human psychology in order to make users believe that their device is infected with viruses (the technique is called social engineering). For example, the color red is often associated with danger, and the provided timer creates a false sense of urgency. This way, Kfx7-67 virus scam authors manipulate visitors' emotions to make them download (possibly) malicious applications.
However, deception is really easy to stop, especially for those who already encountered such fake alerts before. There are hundreds of thousands of fake websites that specialize in such notifications, namely, “Your system is infected with 3 viruses,” “5 Billionth Search,” “Pornographic virus alert from Microsoft,” etc.
The pop-up virus works by the same principle as the mentioned scams: it imitates a legitimate warning about malware infections and threatens with a password and other data loss. These messages are usually littered with grammar/spelling mistakes, and also include a timer – a classic for a scam of such type.

Another sign that the Kfx7-67 virus is fake is that the notification about the alleged malware infection comes from within the web browser. The truth is that only a reputable security application installed on the device can detect viruses on the system, so you should not believe fake alerts coming from random websites. Therefore, do not install anything the scam is offering, as you could actually infect your phone with malware. Simply close down the webpage immediately.
The fake notification changes its language depending on location, so users can encounter it in many different languages to make it more accessible and ensuring that everybody would understand it. So far, the malicious pop-up was spotted in the U.S., Germany, Russia, China, Italy, South Korea, and other countries.
Since the alert comes from within the browser, and the malware name is fictional, there is no need for Kfx7-67 virus removal. However, we would still recommend checking the device with reputable anti-malware software to ensure that it is secure. Also, you should clear cache and data from Chrome or another web browser that you use.
How to identify a deception when browsing or installing new software
The Internet has become a much safe place than it used to be, as many security measures and content filters were applied to the search engines. Despite these efforts, there are millions of malicious websites out there that seek to trick users into providing their sensitive information, downloading malicious apps, or calling fake tech support in order to extort money. Therefore, it is important to be vigilant while browsing the web, since encountering scams is not that rare of an occurrence, especially if the machine is infected with adware.
Therefore, never trust pop-ups or notifications about virus infections, missing Flash plugin,[2] free expensive gifts, and similar unrealistic scenarios. These messages come from within the browser, and there is nothing real about them – they were compiled to scam people.
It is also important to note that adware can also be a major cause for intrusive pop-ups, banners, deals, offers, interstitials, and other ads. Potentially unwanted programs are often installed with elevated permissions, which allow them to display content over other apps. To avoid PUPs, you should never download apps on mobile from third parties and only trust sources like Google Play. As recommended by experts,[3] on a PC, always opt for the advanced/custom installation method instead of recommended/quick one to avoid optional apps being installed in the background.
Simple steps to remove Kfx7-67 virus from your device
Many users who encountered the malicious pop-up claimed that the issue is recurring, which means that they are constantly encountering fake alerts. While there is no need to remove Kfx7-67 virus since it is fake, it is necessary to check your device for adware or other malicious software.
Since these apps are downloaded from third-party sources, they are installed with elevated permissions during careless installation. Thus, always check which permissions are asked prior to the installation.
Finding adware might not always be easy, however, as these apps might hide under legitimate names. You should go to the app list on your Samsung or another Android phone, and eliminate everything suspicious at once. Once done, you should remove cache and data from Google Chrome:
- Go to Settings > Apps/Applications.
- Expand the full list of the installed apps.
- Tap on Google Chrome and select Storage & cache.
- Clear storage and clear cache of the app.
You can also check the Special app access > Display over other apps section to see which apps are allowed the function. This way, you can prevent apps from showing ads for you.

For those who only encountered the alert by accident, nothing needs to be done in terms of Kfx7-67 virus removal, as long as the webpage is closed down immediately upon entry. If you installed some unknown application from a scam site, you should immediately perform a full system scan with anti-malware.
Uninstall from Windows
Uninstall from Windows 10/8:
- Type Control Panel into the Windows search box and open the result.
- Under Programs, select Uninstall a program.

Uninstall from Windows 7/XP:
- Click on Windows Start > Control Panel (Windows XP users should click on Add/Remove Programs).
- In Control Panel, select Programs > Uninstall a program.

Remove the unwanted program:
- In the Programs and Features window, look for any recently installed suspicious entries, select them, and click Uninstall.
- If User Account Control appears, click Yes to confirm, then complete the removal.

Delete from macOS
Remove the unwanted application:
- From the menu bar, select Go > Applications.
- In the Applications folder, look for any suspicious entries, then drag them to Trash (or right-click and pick Move to Trash).

Delete leftover files and folders:
- Select Go > Go to Folder.
- Enter /Library/Application Support and remove any suspicious folders related to the unwanted program.
- Repeat the same check in the /Library/LaunchAgents and /Library/LaunchDaemons folders, deleting any suspicious entries.

- Finally, empty the Trash to permanently remove the leftovers.
Remove from Microsoft Edge
Delete unwanted extensions from MS Edge:
- Select Menu (three horizontal dots at the top-right of the browser window) and pick Extensions.
- From the list, pick the extension and click on the Gear icon.
- Click Remove.

Clear cookies and other browser data:
- Click on the Menu (three horizontal dots at the top-right of the browser window) and select Settings > Privacy, search, and services..
- Under Clear browsing data, pick Choose what to clear.
- Select Cookies and other site data and Cached images and files. (apart from passwords, although you might want to include Media licenses as well, if applicable) and click on Clear.

Restore new tab and homepage settings:
- Click the menu icon and choose Settings.
- Then find On startup section.
- Click Remove next to any suspicious startup page.
Reset MS Edge if the above steps did not work:
- Press on Ctrl + Shift + Esc to open Task Manager.
- Click on More details arrow at the bottom of the window.
- Select Details tab.
- Now scroll down and locate every entry with Microsoft Edge name in it. Right-click on each of them and select End Task to stop MS Edge from running.

Instructions for Chromium-based Edge
Delete extensions from MS Edge (Chromium):
- Open Edge and click select Settings > Extensions.
- Delete unwanted extensions by clicking Remove.

Clear cache and site data:
- Click on Menu and go to Settings.
- Select Privacy, search and services.
- Under Clear browsing data, pick Choose what to clear.
- Under Time range, pick All time.
- Select Clear now.

Reset Chromium-based MS Edge:
- Click on Menu and select Settings.
- On the left side, pick Reset settings.
- Select Restore settings to their default values.
- Confirm with Reset.
- This will disable extensions and reset startup pages but will not delete bookmarks, saved passwords, or browsing history.

Remove from Mozilla Firefox (FF)
Remove dangerous extensions:
- Open Mozilla Firefox browser and click on the Menu (three horizontal lines at the top-right of the window).
- Select Add-ons.
- In here, select the unwanted extension and click Remove.

Reset the homepage:
- Click three horizontal lines at the top right corner to open the menu.
- Choose Settings.
- Under Home, set your preferred homepage and new tab settings.
Clear cookies and site data:
- Click Menu and pick Settings.
- Go to Privacy & Security section.
- Scroll down to locate Cookies and Site Data.
- Click on Clear Data...
- Select Cookies and Site Data and Temporary cached files and pages, then click Clear.

Reset Mozilla Firefox
If clearing the browser as explained above did not help, reset Mozilla Firefox:
- Open Mozilla Firefox browser and click the Menu.
- Go to Help and then choose Troubleshooting Information.

- Under Give Firefox a tune up section, click on Refresh Firefox...
- Once the pop-up shows up, confirm the action by pressing on Refresh Firefox.

Remove from Google Chrome
Delete malicious extensions from Google Chrome:
- Open Google Chrome, click on the Menu (three vertical dots at the top-right corner) and select More tools > Extensions.
- In the newly opened window, you will see all the installed extensions. Uninstall all suspicious extensions related to the unwanted program by clicking Remove.

Clear cache and web data from Chrome:
- Click on Menu and pick Settings.
- Under Privacy and security, select Clear browsing data.
- Select Browsing history, Cookies and other site data, as well as Cached images and files.
- Click Clear data.

Change your homepage:
- Click menu and choose Settings.
- Look for a suspicious site in the On startup section.
- Click on Open a specific or set of pages and click on three dots to find the Remove option.
Reset Google Chrome:
If the previous methods did not help you, reset Google Chrome to eliminate all the unwanted components:
- Click on Menu and select Settings.
- In the Settings, scroll down and click Advanced.
- Scroll down and locate Reset and clean up section.
- Now click Restore settings to their original defaults.
- Confirm with Reset settings.

Delete from Safari
Remove dangerous extensions:
- Open Safari, click Safari in the menu at the top-left of the screen, and select Preferences.
- Go to the Extensions tab, look for any suspicious entries, and click Uninstall to remove them.

Clear history and website data:
- Click Safari in the menu and pick Clear History.
- Set Clear to all history and confirm with Clear History.

Reset Safari:
- Click Safari in the menu and select Preferences > Advanced.
- Enable Show Develop menu in menu bar.
- From the menu bar, click Develop and select Empty Caches.

Was this guide helpful?
Be the first to comment