Virus and Spyware Removal Guides, uninstall instructions

What is Evil?

Evil is malware belonging to the Jigsaw ransomware family. It is designed to encrypt victims' files, modify their filenames and display a pop-up window (containing a ransom message). Evil renames files by appending the ".evil" extension. For example, "1.jpg" is renamed to "1.jpg.evil", "2.jpg" to "2.jpg.evil", etc.

What is Cyber Search?

Cyber Search is a browser hijacker which changes certain browser settings to cybersearch.xyz, adds the "Managed by your organization" feature to Google Chrome browsers, and collects private, sensitive information. Generally, users download and install apps such as Cyber Search (browser hijackers) inadvertently.

This particular app is distributed via a fake installer for Adobe Flash Player and, therefore, is categorized as a potentially unwanted application (PUA).

What is PDFConverterSearch4Free?

PDFConverterSearch4Free is rogue software categorized as a browser hijacker. It operates by making changes to browser settings to promote pdfconvertersearch4free.com (a fake search engine). Additionally, most browser hijackers have data tracking capabilities, which are employed to monitor users' browsing activity - PDFConverterSearch4Free is no exception to this.

Due to the dubious techniques used to proliferate browser hijackers, they are also classified as Potentially Unwanted Applications (PUAs).

What is Szymekk ransomware?

Discovered by GrujaRS, Szymekk is a malicious program and a new variant of Cobra Locker ransomware. Following successful infiltration, this malware encrypts data and locks the device's screen in order to demand ransoms for decryption and restoration of access.

During the encryption process, all affected files are appended with the ".Szymekk" extension. For example, a file originally named something like "1.jpg" would appear as "1.jpg.Szymekk" following encryption. After this process is complete, the screen is locked and a message is displayed on it.

What is DreamTrip?

DreamTrip software is classified as adware because it serves various advertisements. Note that there are many apps of type that are designed to serve ads and gather information. Typically, users download and install adware-type apps inadvertently and, for this reason, they are classified as potentially unwanted applications (PUAs).

Research shows that this particular app is distributed via a malicious installer.

What is AnoymouS ransomware?

Discovered by malware researcher S!Ri, AnoymouS is a malicious program classified as ransomware. Systems infected with this ransomware have their data encrypted and users receive ransom demands for decryption tools. During the encryption process, all affected files are appended with the ".AnoymouS" extension.

For example, a file originally named something like "1.jpg" would appear as "1.jpg.AnoymouS", "2.jpg" as "2.jpg.AnoymouS", and so on. After this process is complete, ransom messages within "Message_Important.txt" files are dropped into compromised folders.

What is ZaLtOn?

ZaLtOn belongs to the Xorist ransomware family. It encrypts victims' files, renames them, changes the desktop wallpaper, displays a pop-up window and creates the "HOW TO DECRYPT FILES.txt" text file. ZaLtOn renames files by appending the ".ZaLtOn" extension to filenames.

For example, "1.jpg" is renamed to "1.jpg.ZaLtOn", "2.jpg" to "2.jpg.ZaLtOn", and so on. It also creates the "HOW TO DECRYPT FILES.txt" text file in all folders that contain encrypted files - this is a ransom message (also displayed by the desktop wallpaper and pop-up window) with instructions about how to pay the ransom, contact cyber criminals, etc.

What is ZipConvertAce?

ZipConvertAce is advertised as an archive manager, a program that compresses and extracts/zips and unzips files. In fact, its developers distribute it using dubious methods. Therefore, ZipConvertAce is categorized as a potentially unwanted application (PUA). Note also that the installer for ZipConvertAce is used to promote a browser hijacker (also a PUA).

What is msascuil.exe?

msascuil.exe (or MSASCuiL.exe) is a legitimate file/process, which is a part of Microsoft Windows 10. This file can be found in the "C:\Program Files\Windows Defender" folder and is part of the Windows Defender user interface. The purpose of msascuil.exe is (or was) to display the Windows Defender icon in the taskbar.

In fact, this is a legitimate file/process. Unfortunately, like most of these processes and files, the names can be used by cyber criminals to disguise malicious processes and programs.

What is "Amazon loyalty program" scam?

This deceptive website may appear similar to a legitimate survey from Amazon, however, the official Amazon company has nothing to do with this scam. Generally, scammers behind such web pages attempt to trick visitors into believing that, in return for participation in a survey, they can receive a prize.

Commonly, these survey scams are used to extract personal, sensitive information. Do not to trust this or other deceptive, unofficial websites. Note that these bogus web pages are often opened through other untrusted sites, deceptive ads, or by installed potentially unwanted applications (PUAs).