Virus and Spyware Removal Guides, uninstall instructions

What kind of application is UniversalSync?

Our researchers discovered the UniversalSync app while investigating new submissions to the VirusTotal site. After analyzing this application, we learned that it is advertising-supported software (adware) belonging to the AdLoad malware family. UniversalSync runs intrusive advertisement campaigns.

What kind of application is VirtualBalance?

Our research team discovered the VirtualBalance application while investigating new submissions to the VirusTotal website. After examining this piece of software, we determined that it is adware. VirtualBalance is part of the AdLoad malware family. This app generates revenue for its designers by feeding users with unwanted/deceptive ads.

What kind of malware is CiphBit?

CiphBit is a ransomware-type program. It is designed to encrypt data and demand ransoms for the decryption. On our test machine, CiphBit encrypted files and altered their filenames.

Original titles were appended with a unique ID assigned to the victim, the cyber criminals' email address, and an extension comprising four random characters. For example, a filename such as "1.jpg" appeared as "1.jpg[ID=13AADE]-[E-Mail=ciphbit@onionmail.org].aefA" following encryption.

Once this process was completed, a ransom-demanding message titled "____CiphBit____!.txt" was dropped. Based on the text therein, it is evident that CiphBit targets companies rather than home users. It is noteworthy that this ransomware uses double-extortion tactics.

What kind of application is UpperTheory?

While reviewing new file submissions to the VirusTotal platform, our research team discovered the UpperTheory application. We determined that it is advertising-supporting software (adware) belonging to the AdLoad malware family. This app is designed to run intrusive advert campaigns.

What kind of software is Galaxy Tab?

While checking out dubious websites, our research team discovered the Galaxy Tab browser extension. It promises to display galaxy-themed browser wallpapers. This extension modifies browser settings to generate redirects. Due to this behavior, it is classed as a browser hijacker.

What kind of application is LogFormula?

Following an assessment of LogFormula, it has been established that its primary purpose is to inundate users with intrusive advertisements, signifying that LogFormula operates as adware. It is crucial to emphasize that applications similar to LogFormula are often installed by users unintentionally due to the methods used to advertise and distribute them.

What kind of email is "Email Account Storage Limit Is Almost"?

"Email Account Storage Limit Is Almost Full" is spam mail targeting email account log-in credentials. The letter encourages to increase their inbox storage quota by signing in through a phishing website that mimics the recipient's email account sign-in page.

What kind of application is Traveling Tab?

Following an analysis of Traveling Tab, it has been determined that this browser extension's objective is to modify web browser settings to promote a specific search engine. Such browser extensions exhibiting these characteristics are referred to as browser hijackers. Users frequently install browser-hijacking applications without full awareness of their underlying functionality.

What kind of malware is Eldritch?

Eldritch is the name of a ransomware that our researchers found while investigating new malware submissions to the VirusTotal platform. This malicious program encrypts files and demands payment for their decryption.

On our test system, Eldritch encrypted files and added a ".eldritch" extension to their titles. For example, a filename such as "1.jpg" appeared as "1.jpg.eldritch", "2.png" as "2.png.eldritch", etc. Afterward, the ransomware changed the desktop wallpaper and created a text file titled "READ-THIS.txt" – both contained the ransom note.

What kind of malware is Aphrobyte Plus?

Aphrobyte Plus is a potent Remote Access Trojan (RAT) that utilizes Discord as a communication channel to connect with the victim's computer. This adaptable Trojan boasts an extensive repertoire of 41 commands, offering over 60 features. Cybercriminals can acquire Aphrobyte Plus on hacker forums for a price of 22 USD, payable in Bitcoin.