Virus and Spyware Removal Guides, uninstall instructions

What kind of malware is Money?

Money ransomware is a part of the Dharma family and was discovered by Jakub Kroustek. Malware of this type is usually designed to block access to data by encryption. To regain access to their files, victims must use decryption tools and/or keys that can be purchased from the cyber criminals who designed the ransomware-type program.

Money changes filenames of encrypted files by adding an ID number, email address, and the ".money" extension. For example, "1.jpg" might be renamed to "1.jpg.id-1E857D00.[cmdroot@airmail.cc].money". Instructions about how to pay the ransom and contact cyber criminals are presented in a pop-up window and text file called "FILES ENCRYPTED.txt".

Updated variants of this ransomware use ".[admin@fentex.net].money", ".[admincrypt@protonmail.com].money", ".[todesh@gmx.de].MONEY" and ".[admin@stex777.com].money" extensions for encrypted files.

What is "Your device was infected with my private malware"?

"Your device was infected with my private malware" is the name of a spam campaign, a scam that criminals use to trick people into paying a ransom. They threaten to share a non-existent video with other parties unless they receive a specific sum within 72 hours.

Never trust these emails. If you receive "Your device was infected with my private malware" or other similar emails, you should ignore them.

What is "This Update requires an action"?

"This Update requires an action" is the headline of a deceptive pop-up window that encourages users to update outdated software. Do not trust this pop-up or obey the instructions. Research shows that the pop-up appears due to adware that is already installed on the computer and/or browser.

Typically, people do not install adware intentionally. Therefore, apps of this type are classed as potentially unwanted applications (PUAs). This particular pop-up is used to promote PUAs such as Tapufind and ChillTab - we strongly recommend that you do NOT download or install them.

What is Power App?

Power App is a browser hijacker, identical to Genius App. This rogue application is advertised as enhancing web searches. It is supposedly capable of fast searches, providing accurate search results, etc., however, it operates by changing browser settings to promote a fake search engine (searchpowerapp.com). 

Power App also monitors users' browsing habits and is categorized as a PUA (Potentially Unwanted Application), since users tend to install it onto devices inadvertently.

What is Obituary Search?

Obituary Search is a browser hijacker advertised for allowing access to various ancestry-related content. It is supposedly capable of providing access to ancestry sites and obituary databases. Obituary Search is classed as a Potentially Unwanted Application (PUA), as most users install it inadvertently.

This rogue application operates by modifying browser settings to promote its fake search engine (search.obituarysearchtab.com). It also tracks user data, recording browsing activity and personal information. Updated variant of Obituary Search browser hijacker promotes search.newobituarysearchtab.com.

What is Instant Translation?

Instant Translation is a browser hijacker, endorsed as an application for quick access to various free translation tools. It is supposedly capable of immediately providing dictionaries and translating any web page, however, it operates by changing browser settings to promote its fake search engine (search.getfreetranslationstab.com).

Instant Translation also has data tracking abilities. Many users install this application inadvertently and it is therefore classified as a Potentially Unwanted Application (PUA).

What is CoverOpen?

CoverOpen is a program that supposedly helps people to browse the internet efficiently (providing fast searches, accurate results, and enhancing the browsing experience in other ways). In fact, this app is categorized as adware, software that displays unwanted, often deceptive ads.

People usually download and install apps of this type inadvertently, and thus they are categorized as potentially unwanted applications (PUAs). Additionally, these apps can operate as information tracking tools, collecting various user details.

What is Mike?

Discovered by GrujaRS, Mike is malicious software belonging to the HildaCrypt ransomware family. This malicious program is designed to encrypt data and keep it locked until a ransom is paid. During the encryption process, all files are renamed with the ".mike" extension.

For example, "1.jpg" becomes "1.jpg.mike". After encryption, Mike creates the "_readme.txt" text file and stores it on the victim's desktop.

What is leadnote[.]me?

Similar to muchinspardorop.info, noorotin.biz, meknews.biz, and many others, leadnote[.]me is a rogue website that generates redirects to other compromised and dangerous sites. This website can also present visitors with dubious and even malicious content.

Few users access this site intentionally - most are redirected by intrusive advertisements or Potentially Unwanted Applications (PUAs). These apps do no require explicit user permission to infiltrate devices. PUAs cause redirects, deliver advertisement campaigns, and track data.

What is WindowGroup?

WindowGroup is advertised as a tool that provides accurate search results, fast searches, and other features that supposedly enhance the browsing experience.

In fact, it also serves unwanted, intrusive advertisements. Therefore, WindowGroup is classified as adware and a potentially unwanted application (PUA). Note that these apps record details relating to browsing activities. Most people download and install adware (and other PUAs) unintentionally/inadvertently.