Virus and Spyware Removal Guides, uninstall instructions

What kind of email is "Password Expiry Notification"?

Our inspection of the "Password Expiry Notification" email revealed that it is spam. It falsely claims that the recipient's email account password will expire soon. The goal of this phishing mail is to obtain victims' log-in credentials and steal their email accounts.

What is speedyanswersnow.com?

After examining speedyanswersnow.com, we discovered that it is a questionable search engine. Such search engines typically have poor search functionality and are often associated with browser hijackers. Usually, users unknowingly download and add browser hijackers to their browsers.

What is myonesearches.com?

While examining myonesearches.com we learned that this is a questionable search engine that shows ads and may provide misleading results. Thus, it is recommended to avoid using myonesearches.com. It is worth noting that search engines of this kind are often promoted via browser hijackers.

What kind of malware is BACKJOHN?

While analyzing malware samples submitted to VirusTotal, our researchers came across BACKJOHN - ransomware that belongs to the Phobos family. We found that BACKJOHN encrypts data, modifies filenames of all encrypted files, and creates "info.hta" and "info.txt" files (ransom notes).

BACKJOHN appends the victim's ID, backjohn131@gmail.com email address, and ".BACKJOHN" extension to filenames. For instance, it changes "1.jpg" to "1.jpg.id[9ECFA84E-3143].[backjohn131@gmail.com].BACKJOHN", "2.png" to "2.png.id[9ECFA84E-3143].[backjohn131@gmail.com].BACKJOHN", and so forth.

What is Cosmos Extension?

While inspecting dubious websites, our research team discovered the Cosmos Extension browser extension. After investigating this piece of software, we determined that it is a browser hijacker. Cosmos Extension makes changes to browser settings in order to promote (via redirects) the cosmosextension.com fake search engine.

What is Price Tracking Pro?

Our researchers discovered the Price Tracking Pro browser extension while investigating deceptive websites. According to its promotional material, this extension is a tool that aids with online shopping, i.e., tracks prices, seller ratings, and other related information. However, our analysis revealed that Price Tracking Pro operates as advertising-supported software (adware).

What is search-mood.com?

Search-mood.com is the address of a fake search engine. These sites cannot generate search results. However, this website is different, but its results are inaccurate and may include deceptive/harmful content.

Typically, illegitimate search engines are promoted (via redirects) by browser hijackers. These sites and the software endorsing them often have data-tracking functionalities.

What kind of application is Communique?

Communique is a rogue application that we discovered while investigating suspicious sites. After inspecting this app, we determined that it is advertising-supported software (adware). It is designed to run intrusive ad campaigns and may have additional harmful abilities.

What is flashcleaner.xyz?

Our team inspected flashcleaner.xyz and found that it is a fake search engine that shows results generated by another search engine. A big part of fake search engines is promoted through browser hijackers. Usually, these apps promote fake (or unreliable) search engines by changing browser settings.

What kind of page is vipcaptchanow[.]top?

Vipcaptchanow[.]top is a rogue page that our researchers discovered while checking out untrustworthy websites. It is designed to promote browser notification spam and redirect visitors to other (likely unreliable/harmful) webpages.

Most users access websites like vipcaptchanow[.]top through redirects caused by pages that employ rogue advertising networks.