"UNILEVER Email Virus" removal guide
What is "UNILEVER Email Virus"?
"UNILEVER Email Virus" is categorized as a spam campaign. Scammers send email messages to hundreds (or even thousands) of people hoping that some will open the delivered attachment. There are many similar scams available, but this one is used to spread the LokiBot virus via the attachment. We strongly recommend that you ignore the message and do not open the attached file.
Cyber criminals behind the "UNILEVER Email Virus" email claim to be representatives of Unilever, a well-known consumer goods company. According to the email, it was sent by Jon Strachan, Vice President - Supply chain. This person does work for this company, however, neither he nor Unilever has anything to do with this scam. The email details an invoice and contains an attached order. As mentioned above, this email scam is used to proliferate the LokiBot virus, a computer infection (trojan-type malware) designed to gather information such as passwords, logins, etc. and also to track data such as keystrokes. Having a computer infected with a virus of this type might lead to serious privacy issues, financial loss, and other problems. Opening the attachment presented in the "UNILEVER Email Virus" email leads to download/installation of the trojan-type infection. If installed, it can be detected as the "Senhaja" process (32-bit or 64-bit) in Windows Task Manager. If you receive this email, ignore it, and certainly do not open the associated attachment.
There are many such campaigns used to scam users. Some examples include American Express Email Virus, Apple Email Virus, and IRS Email Virus. Different scams are used to proliferate different computer infections (such as Adwind, FormBook, TrickBot, Emotet, etc.) - they are usually distributed through attachments or web links. These viruses steal personal data, and thus we strongly recommended that you remove them immediately.
How did "UNILEVER Email Virus" infect my computer?
Like most spam campaigns of this type, the virus only infects computers when the presented attachment is opened and permission to install the rogue software is given. Malicious attachments are often Microsoft Office documents, PDF, archive, and executable files. For example, if the file is an MS Office document, once opened, it requests permission to enable macros commands. Enabling them allows a computer infection to be installed. Note that these infected attachments cannot do any harm if they are not opened.
How to avoid installation of malware?
Never open email attachments that are delivered in emails received from suspicious or unknown addresses, or if the email is not specifically relevant to you. Scammers often hide behind well-known company names, however, these are just attempts to make the emails and presented attachments seem legitimate. The most efficient way to avoid infections proliferated through these attachments is to simply ignore the email not open the file. Also have reputable anti-virus or anti-spyware software installed to keep computers safe. If you have already opened a "UNILEVER Email Virus" attachment, we recommend running a scan with Spyhunter for Windows to automatically eliminate infiltrated malware.
Text presented in the "UNILEVER Email Virus" email message:
Subject: UNILEVER PURCHASE ORDER #091223 for acknowledgement
I hope this email finds you well.
Please find attached order for your acknowledgement and kindly send the proforma invoice in order to proceed with the request foradvance payment.
Awaiting your reply.
Vice President ñ Supply chain
Unilever UK Limited
Consumer Careline: +44(0)800 01 01 07
The information contained in this electronic transmission message and any of its attachments is intended for addressee(s) only and may contain confidential information. If you are not the addressee(s), please notify the sender and delete this message completely. Any views expressed herein are those of the individual sender except where the sender specifically states it to be the views of Unilever.
Unileveris neither liable for incomplete transmission of this electronic message nor for any delay in its receipt. If you are not the intended recipient you are hereby notified that any disclosure, reproduction, distribution or taking any action in reliance on the contents of this electronic message is strictly prohibited.
Screenshot of a LokiBot malicious process in Task Manager (Senhaja (32-bit)):
Instant automatic removal of UNILEVER purchase order virus:
Manual threat removal might be a lengthy and complicated process that requires advanced computer skills. Spyhunter is a professional automatic malware removal tool that is recommended to get rid of UNILEVER purchase order virus. Download it by clicking the button below:
- What is "UNILEVER Email Virus"?
- STEP 1. Manual removal of UNILEVER Email Virus2 malware.
- STEP 2. Check if your computer is clean.
How to remove malware manually?
Manual malware removal is a complicated task - usually it is best to allow antivirus or anti-malware programs to do this automatically. To remove this malware we recommend using Spyhunter for Windows. If you wish to remove malware manually, the first step is to identify the name of the malware that you are trying to remove. Here is an example of a suspicious program running on a user's computer:
If you checked the list of programs running on your computer, for example, using task manager, and identified a program that looks suspicious, you should continue with these steps:
Download a program called Autoruns. This program shows auto-start applications, Registry, and file system locations:
Restart your computer into Safe Mode:
Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer start process, press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, and then select Safe Mode with Networking from the list.
Video showing how to start Windows 7 in "Safe Mode with Networking":
Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click Advanced startup options, in the opened "General PC Settings" window, select Advanced startup. Click the "Restart now" button. Your computer will now restart into the "Advanced Startup options menu". Click the "Troubleshoot" button, and then click the "Advanced options" button. In the advanced option screen, click "Startup settings". Click the "Restart" button. Your PC will restart into the Startup Settings screen. Press F5 to boot in Safe Mode with Networking.
Video showing how to start Windows 8 in "Safe Mode with Networking":
Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options". In the advanced options menu select "Startup Settings" and click on the "Restart" button. In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.
Video showing how to start Windows 10 in "Safe Mode with Networking":
Extract the downloaded archive and run the Autoruns.exe file.
In the Autoruns application, click "Options" at the top and uncheck the "Hide Empty Locations" and "Hide Windows Entries" options. After this procedure, click the "Refresh" icon.
Check the list provided by the Autoruns application and locate the malware file that you want to eliminate.
You should write down its full path and name. Note that some malware hides process names under legitimate Windows process names. At this stage, it is very important to avoid removing system files. After you locate the suspicious program you wish to remove, right click your mouse over its name and choose "Delete".
After removing the malware through the Autoruns application (this ensures that the malware will not run automatically on the next system startup), you should search for the malware name on your computer. Be sure to enable hidden files and folders before proceeding. If you find the filename of the malware, be sure to remove it.
Reboot your computer in normal mode. Following these steps should remove any malware from your computer. Note that manual threat removal requires advanced computer skills. If you do not have these skills, leave malware removal to antivirus and anti-malware programs. These steps might not work with advanced malware infections. As always it is best to prevent infection than try to remove malware later. To keep your computer safe, install the latest operating system updates and use antivirus software.
To be sure your computer is free of malware infections, we recommend scanning it with Spyhunter for Windows.