Virus and Spyware Removal Guides, uninstall instructions

What is BoY ransomware?

Our research team discovered the BoY ransomware-type program while reviewing new submissions to VirusTotal. This malicious program is part of the Xorist ransomware family. Malware within this classification operates by encrypting data and demanding payment for decryption.

On our test machine, BoY appended the encrypted files with a ".BoY" extension. For example, a file originally titled "1.jpg" appeared as "1.jpg.BoY", "2.png" as "2.png.BoY", etc. Afterward, this ransomware displayed a pop-up window and created a text file named "HOW TO DECRYPT FILES.txt" – containing identical ransom notes.

What kind of application is LifeProxy?

Our team has tested the LifeProxy application and found that it operates as adware. While installed, LifeProxy displays unwanted advertisements. Also, this app can read sensitive information. Most users download and install adware unknowingly since it is often promoted and distributed using shady methods.

What kind of website is q3rrassa[.]click?

While analyzing q3rrassa[.]click, we learned that it runs the "McAfee - Your PC is infected with 5 viruses!" scam. This page uses a scare tactic to trick visitors into believing that their computers are infected and purchasing a legitimate antivirus solution. Also, q3rrassa[.]click asks for permission to show notifications.

What kind of application is Page Links Loader?

After examining the Page Links Loader browser extension, our team determined that it is an advertising-supported application (adware) - it shows annoying advertisements. We discovered Page Links Loader on a shady website. Users often download and install or add adware inadvertently.

What kind of email is "Your Account Failed To Update"?

After investigating the "Your Account Failed To Update" email, we determined that it is spam. This letter operates as a phishing scam seeking to extract the recipient's email account log-in credentials. The mail achieves this by falsely claiming that the recipient's account could not be updated.

What is "Statement Of Account (SOA) email virus"?

After examining this email, we concluded that this is a fake email regarding a statement of account. It has a malicious PDF document attached to it. Cybercriminals behind this email aim to lure recipients into downloading and executing malware called Rhadamanthys.

What is Tabs Organizer?

During a routine inspection of suspicious websites, our researchers discovered a page promoting the Tabs Organizer browser extension, wherein it is endorsed as an adblocker. Although, in the extension's description, this software is presented as a browser tab, bookmark, and history navigation optimization tool. However, our analysis revealed that Tabs Organizer operates as advertising-supported software (adware).

What is 725 ransomware?

While checking out new submissions to VirusTotal, our researchers discovered the 725 ransomware. Evidence suggests that this malicious program could have been developed by the threat actors behind 32T ransomware.

After we executed a sample of 725 on our test machine, it encrypted files and appended their filenames with a ".725" extension. For example, a file originally titled "1.jpg" appeared as "1.jpg.725", "2.png" as "2.png.725", and so on. Once this process was completed, a ransom note named "RECOVER-FILES.html" was created.

What is "Your Email Has Reached An Upgrade Stage Scam"?

"Your Email Has Reached An Upgrade Stage Scam" refers to an email spam campaign. Our analysis of a letter belonging to this campaign revealed that it operates as a phishing scam. This spam mail aims to extract recipients' email account log-in credentials by claiming that their accounts will be closed unless they are upgraded.

What is WebAge?

WebAge is the name of a rogue piece of software that we discovered while checking out new submissions to VirusTotal. After analyzing this application, we learned that it is adware belonging to the AdLoad malware family.