Virus and Spyware Removal Guides, uninstall instructions

What is securedconection[.]com?

securedconection[.]com is the address of a deceptive website that targets people who use iPhones. It display a fake virus notification and trick visitors into installing software that supposedly removes 'detected' viruses. At the time of research, securedconection[.]com urged users to download and install Antivirus VPN App.

Note that securedconection[.]com and other websites of this type should never be trusted - the same applies to software that is advertised on or through them.

What is safeiphoneconnection[.]com?

safeiphoneconnection[.]com is a deceptive/scam website. Visitors to this site are warned that their device has been infected, and if the threats are not removed, they risk permanent damage. Note that no web page can detect threats/issues present on any system - any that make such claims cannot be trusted.

Scams of this type are common and are typically designed to promote untrustworthy applications.

At the time of research, safeiphoneconnection[.]com promoted the Antivirus VPN App. Most visitors to deceptive/scam sites enter them unintentionally, since they are redirected by intrusive advertisements or Potentially Unwanted Applications (PUAs) already infiltrated into their browsers.

What is youhave-1-message[.]com?

youhave-1-message[.]com is a deceptive website that targets iPhone users. It promotes a dubious application that supposedly removes fake viruses detected by the site. At the time of research, youhave-1-message[.]com encouraged users to download and install an application called Antivirus SafeGuard VPN App.

Neither websites such as youhave-1-message[.]com nor software advertised on them should be trusted.

What kind of malware is ROGER?

Discovered by Jakub Kroustek, ROGER is a malicious program belonging to the Crysis/Dharma ransomware family. It operates by encrypting data and demanding ransom payments for decryption tools/software. During the encryption process all affected files are renamed with the victim's unique ID, developer's email address, and the ".ROGER" extension.

For example, "1.jpg" might appear as something similar to "1.jpg.id-1E857D00.[backdata.company@aol.com].ROGER". Once this process is complete, a text file ("FILES ENCRYPTED.txt") is created on the desktop and a pop-up window is displayed.

What is vpncheckyou[.]com?

vpncheckyou[.]com is one of many deceptive websites that use scare tactics to trick people into downloading dubious software. At the time of research, this web page was designed to trick visitors into believing that their devices (iPhones) were infected with viruses.

It then encourages them to download an app called Antivirus VPN App. This software might also be used to advertise other dubious apps. In any case, no software that is promoted through deceptive web pages such as vpncheckyou[.]com can be trusted.

What is "Mac OS X is infected (4) by viruses"?

"Mac OS X is infected (4) by viruses" is a typical virus alert. Pop-up windows of this type appear only on untrustworthy, deceptive websites. Typically, people visit these sites unintentionally - they are redirected by potentially unwanted applications (PUAs), which cause unwanted redirects, deliver advertisements, and collect browsing-related information.

What is "PRIZE EMAIL"?

"PRIZE EMAIL" is a scam run by deceptive websites. It claims that users' emails have been selected as participants in a prize promotion, and therefore they have won certain prizes. In fact, the scam operates by tricking users into making monetary transactions, which are supposedly necessary to receive these fake prizes.

Most visitors to deceptive/scam sites enter them inadvertently - they are redirected by intrusive advertisements or Potentially Unwanted Applications (PUAs) already infiltrated into the system. Note that PUAs do not need express permission to be installed onto devices.

What is Hets?

Hets is malicious software belonging to the Stop/Djvu ransomware family. Devices infected with this malware have their data encrypted and the cyber criminals behind this infection demand ransom payments for decryption. When it encrypts files, the program renames them with the ".hets" extension.

For example, "1.jpg" appears as "1.jpg.hets", and so on for all compromised files. Once this process is complete, a text file named "_readme.txt" is created on the desktop.

What is "Microsoft Protected Your Computer"?

"Microsoft Protected Your Computer" is a notification that is displayed on the website of a technical support scam. This web page is disguised as an official Windows Support website, however, Microsoft has nothing do to with it.

The main purpose of this scam is to trick people into calling scammers who seek to extort money from unsuspecting people. We strongly recommend that you ignore this scam and do not call the number provided.

What is essaemiaaut[.]com?

Similar to newsredirect.net, giantttraffic.com, ewaglongoo.com, and thousands of others, essaemiaaut[.]com is a rogue website. It operates by presenting dubious content and/or redirects visitors to other untrustworthy web pages.

Most users enter these sites unintentionally when they are redirected by intrusive ads or Potentially Unwanted Applications (PUAs) already infiltrated into the system. These apps do not need explicit user permission to be installed onto devices. PUAs generate redirects, run intrusive ad campaigns, and record browsing-related information.