Virus and Spyware Removal Guides, uninstall instructions

What is Domn?

Discovered by Michael Gillespie, Domn is a malicious program and part of the Djvu ransomware family. Like most programs of this type, Domn is designed to prevent victims from accessing their data by encrypting files with strong encryption algorithms. To regain access to their files, victims are encouraged to purchase a decryption tool and key.

Domn adds the ".domn" extension to the filenames of encrypted files. For example, "1.jpg" becomes "1.jpg.domn". It also creates a ransom message within the "_readme.txt" file.

What is IOByte System Care?

IOByte System Care is advertised as system optimizer software, which supposedly cleans systems, fixes errors, uninstalls unwanted programs, and removes threats (malicious software).

In fact, the developers distribute it using dubious methods. They include it within the set-ups of other software, and thus most people download and install programs of this type unintentionally. For this reason, IOByte System Care is categorized as a potentially unwanted application (PUA).

What is "Transcoal Pacific Email Virus"?

"Transcoal Pacific Email Virus" is a spam campaign, used to proliferate the LokiBot malware. One of spreading methods for such malicious software are large scale email spam campaigns. These emails contain executable files (or similar attachments), which download and install specific malware.

It should be known, that email letters of this kind are often marked as important, urgent, starred or otherwise highlighted as top priority mail. It is not recommended to open suspicious emails and it is expressly advised against opening any attachments and/or web links found therein. The "Transcoal Pacific Email Virus" spam campaign was discovered by My Online Security.

What is RSA?

RSA malware was discovered by Jakub Kroustek and is part of the Dharma ransomware family. This type of software is usually designed to encrypt files so that victims cannot use them unless they pay a ransom (purchase a decryption tool from cyber criminals).

This particular ransomware renames encrypted files by adding a personal ID, email address, and the ".RSA" extension to filenames.

For example, "1.jpg" might become "1.jpg.id-1E857D00.[rsa1024@tutanota.com].RSA". Other variants of this ransomware use ".[rsacrypt@aol.com].rsa" extension for encrypted files. It also creates/displays ransom messages within the "FILES ENCRYPTED.txt" text file and a pop-up window.

What is SourceAdd?

SourceAdd is the name of an app that supposedly makes internet browsing easier. In fact, it is classified as adware. Adware-type apps display intrusive, unwanted ads.

In some cases, they gather various details relating to users. In any case, many people download and install apps of this type inadvertently and, therefore, SourceAdd is known as potentially unwanted application (PUA).

What is Earth & Satellite View?

Earth & Satellite View is a browser hijacker, endorsed as a tool pack, containing quick access to maps and a web searcher (search.earthandsatelliteviewtab.com).

It is supposedly designed to provide easy access to various maps, driving directions and local traffic data. In all actuality, it changes browser settings to promote the aforementioned fake search engine - search.earthandsatelliteviewtab.com. Earth & Satellite View also spies on users' browsing activities, thereby gathering their personal information.

Since most users install this rogue app onto their systems inadvertently, it is classified as a PUA (potentially unwanted application).

What is safari-protection[.]com?

safari-protection[.]com is the address of a deceptive website that should not be trusted. It encourages visitors to download the Net Shield application, which is designed to protect users from having personal data stolen through malicious ads. Do not download applications that are advertised through (or on) deceptive websites.

Furthermore, people do not generally visit websites such as safari-protection[.]com intentionally - they are redirected to them by potentially unwanted apps (PUAs) installed on their browsers or operating systems.

What is solo85[.]biz?

Like vnuser.biz, nerinlelighda.pro, mediasource.online and thousands of others, solo85[.]biz is a rogue site. It is designed to feed visitors unreliable content and to generate redirects to likewise untrustworthy websites.

In most cases, visitors to solo85[.]biz do not access it willingly; they either get redirected by intrusive ads (typically hosted by compromised sites) or by having it force-opened by PUAs (potentially unwanted applications).

It should be noted, that these undesirable apps are not bound by explicit user permission, therefore they can infiltrate devices without user consent and/or knowledge. Aside from causing redirects, PUAs are also capable of running invasive advertisement campaigns and some can gather data.

What is Kvag?

Kvag is ransomware-type software that belongs to the Djvu family. Like most programs of this type, Kvag is designed to prevent access to files by encoding them with a strong encryption algorithm. To decrypt files, victims are encouraged to use a decryption tool and key by paying a ransom to cyber criminals (Kvag developers).

This ransomware creates a ransom message within the "_readme.txt" text file and renames victims' files by adding the ".kvag" extension to filenames. For example, "1.jpg" becomes "1.jpg.kvag".

What is CompuClever PC TuneUp?

CompuClever PC TuneUp is a piece of software, supposedly capable of optimizing computer system performance and cleaning unnecessary files, as well as making various other enhancements. Most users install this application onto their devices inadvertently, therefore it is categorized as a PUA (potentially unwanted application).

CompuClever PC TuneUp is often distributed together with other software, i.e. it is "bundled". This false marketing tactic, by which ordinary programs are pre-packed with unwanted content, is called "bundling".