Virus and Spyware Removal Guides, uninstall instructions

What is FLYU ransomware?

Discovered by Jakub Kroustek, FLYU is a malicious program, which is part of the Dharma ransomware family. This malware is designed to encrypt data and demand payment for decryption.

During the encryption process, all affected files are renamed following this pattern: original filename, unique ID assigned to the victims, cyber criminals' email address, and the ".FLYU" extension. For example, a file originally named "1.jpg" would appear as something similar to "1.jpg.id-C279F237.[yourfiles1@tutanota.com].FLYU" after encryption.

Once this process is complete, ransom messages are created in a pop-up window and "FILES ENCRYPTED.txt" text file.

What is search.productivebrowser.com?

search.productivebrowser.com is the address of a fake search engine. Generally, these sites are promoted through potentially unwanted applications (PUAs) classified as browser hijackers, adware-type apps. Apps of this type promote fake search engines by changing browser settings and hijacking browsers.

They are classified as PUAs because, in most cases, users download and install them inadvertently.

What is mommaskids[.]com?

mommaskids[.]com is a rogue website designed to present visitors with dubious material and/or redirect them to other bogus or possibly malicious web pages. There are thousands of sites similar to mommaskids[.]com on the web including, for example, thedailynews.report, directbase.ru, yourtopnews.com, and news-back.net.

Users rarely access these web pages intentionally - most are redirected to them by intrusive advertisements or Potentially Unwanted Applications (PUAs) already infiltrated into their devices. This software does not need explicit user consent to be installed onto systems.

PUAs operate by causing redirects, running intrusive ad campaigns, and collecting browsing-related information.

What is Moss?

Moss belongs to a ransomware family called Djvu. It encrypts files, modifies their filenames by appending its extension, and creates the "_readme.txt" file (the ransom message with instructions about how to contact the developers and other details) in all folders that contain encrypted files.

Moss appends the ".moss" extension to the filenames of encrypted files. For example, "1.jpg" is renamed to "1.jpg.moss", "2.jpg" to "2.jpg.moss", and so on.

What is searchgoose.com?

Searchgoose.com is the address of a fake search engine. Most fake search engines are promoted by unwanted applications that are classified as browser hijackers. Therefore, if a browser opens searchgoose.com, this indicates that a browser hijacker is installed on it. Most users download and install them inadvertently.

What is the Covid stealer?

Covid is malicious software classified as a 'stealer'. As the classification implies, this malware steals information. Stealers can employ various functionality to stealthily obtain data from infected systems. This Covid malware is highly dangerous, and thus infections must be eliminated immediately upon detection.

What is thedailynews[.]report?

thedailynews[.]report is a rogue website sharing many similarities with yourtopnews.com, news-back.net, locompany.club, and countless others. Visitors to this site are presented with dubious content and/or are redirected to other untrusted or possibly malicious web pages.

Typically, these sites are accessed via redirects caused by intrusive advertisements or by Potentially Unwanted Applications (PUAs) already infiltrated into the system. This software does not need explicit user consent to be installed on the device. PUAs cause redirects, deliver intrusive ad campaigns and collect browsing-related information.

What is directbase[.]ru?

directbase[.]ru functions in a similar manner to justmedia24[.]biz, watch-video[.]net, news06[.]biz, and many other rogue websites. It can open untrusted, potentially malicious pages or display dubious content.

Commonly, browsers open sites such as directbase[.]ru due to potentially unwanted applications (PUAs) installed on them. I.e., users to not often visit these web pages intentionally.

What is DLM virus?

DLM (Download Manager) is a legitimate Mac application, which can be used to manage/organize downloads. I.e., to control download bandwidth, improve speed, and prioritize and schedule downloads. In fact, cyber criminals distribute this app with browser hijackers, adware-type apps and other potentially unwanted applications (PUAs) through malicious installers.

If you do not remember downloading or installing DLM, you might have unwanted software installed on your computer and/or browser.

What is yourtopnews[.]com?

Sharing many similarities with mp3bars.com, face-push.com, watch-video.net and thousands of others, yourtopnews[.]com is a rogue site. Once accessed, yourtopnews[.]com presents visitors with dubious content and/or redirects them to other untrusted or possibly malicious web pages.

Few users access yourtopnews[.]com or similar pages intentionally - most are redirected to them by intrusive advertisements or Potentially Unwanted Applications (PUAs) already infiltrated into their devices. These apps do not need express user permission to be installed onto systems.

PUAs operate by causing redirects, running intrusive ad campaigns and collecting browsing-related information.