Virus and Spyware Removal Guides, uninstall instructions

What is OneSafe PC Cleaner?

OneSafe PC Cleaner is software classed as a Potentially Unwanted Application (PUA). It is endorsed as system cleaning tool capable of scanning and removing various threats and issues. One of this application's distribution methods is via deceptive/scam websites, hence why it is classified as a PUA.

Note that these unwanted apps are often inadvertently downloaded/installed together with other, regular programs (often when downloaded from untrustworthy sources).

What is SystemDistrict?

The SystemDistrict application should not be trusted, since it is categorized as adware and a potentially unwanted application (PUA).

Apps of this type feed users with unwanted ads and often gather private information. Typically, people do not download or install this software intentionally. In any case, we strongly recommend that you uninstall SystemDistrict and other PUAs immediately.

What is JavaRatty?

JavaRatty (also known as JavaCrypt) is malicious software classified as ransomware. Most ransomware-type programs encrypt data, however, JavaRatty damages files rather than encrypting them. When this malware damages files, they are appended with the ".encrypted" extension. Therefore, "1.jpg" might appear as "1.jpg.encrypted", and so on for all compromised files.

After this process is complete, a text file ("HOWTODECRYPT.txt") is stored in each affected folder. This file contains the ransom message.

What is securedconection[.]com?

securedconection[.]com is the address of a deceptive website that targets people who use iPhones. It display a fake virus notification and trick visitors into installing software that supposedly removes 'detected' viruses. At the time of research, securedconection[.]com urged users to download and install Antivirus VPN App.

Note that securedconection[.]com and other websites of this type should never be trusted - the same applies to software that is advertised on or through them.

What is safeiphoneconnection[.]com?

safeiphoneconnection[.]com is a deceptive/scam website. Visitors to this site are warned that their device has been infected, and if the threats are not removed, they risk permanent damage. Note that no web page can detect threats/issues present on any system - any that make such claims cannot be trusted.

Scams of this type are common and are typically designed to promote untrustworthy applications.

At the time of research, safeiphoneconnection[.]com promoted the Antivirus VPN App. Most visitors to deceptive/scam sites enter them unintentionally, since they are redirected by intrusive advertisements or Potentially Unwanted Applications (PUAs) already infiltrated into their browsers.

What is youhave-1-message[.]com?

youhave-1-message[.]com is a deceptive website that targets iPhone users. It promotes a dubious application that supposedly removes fake viruses detected by the site. At the time of research, youhave-1-message[.]com encouraged users to download and install an application called Antivirus SafeGuard VPN App.

Neither websites such as youhave-1-message[.]com nor software advertised on them should be trusted.

What kind of malware is ROGER?

Discovered by Jakub Kroustek, ROGER is a malicious program belonging to the Crysis/Dharma ransomware family. It operates by encrypting data and demanding ransom payments for decryption tools/software. During the encryption process all affected files are renamed with the victim's unique ID, developer's email address, and the ".ROGER" extension.

For example, "1.jpg" might appear as something similar to "1.jpg.id-1E857D00.[backdata.company@aol.com].ROGER". Once this process is complete, a text file ("FILES ENCRYPTED.txt") is created on the desktop and a pop-up window is displayed.

What is vpncheckyou[.]com?

vpncheckyou[.]com is one of many deceptive websites that use scare tactics to trick people into downloading dubious software. At the time of research, this web page was designed to trick visitors into believing that their devices (iPhones) were infected with viruses.

It then encourages them to download an app called Antivirus VPN App. This software might also be used to advertise other dubious apps. In any case, no software that is promoted through deceptive web pages such as vpncheckyou[.]com can be trusted.

What is "Mac OS X is infected (4) by viruses"?

"Mac OS X is infected (4) by viruses" is a typical virus alert. Pop-up windows of this type appear only on untrustworthy, deceptive websites. Typically, people visit these sites unintentionally - they are redirected by potentially unwanted applications (PUAs), which cause unwanted redirects, deliver advertisements, and collect browsing-related information.

What is "PRIZE EMAIL"?

"PRIZE EMAIL" is a scam run by deceptive websites. It claims that users' emails have been selected as participants in a prize promotion, and therefore they have won certain prizes. In fact, the scam operates by tricking users into making monetary transactions, which are supposedly necessary to receive these fake prizes.

Most visitors to deceptive/scam sites enter them inadvertently - they are redirected by intrusive advertisements or Potentially Unwanted Applications (PUAs) already infiltrated into the system. Note that PUAs do not need express permission to be installed onto devices.