Virus and Spyware Removal Guides, uninstall instructions

What kind of email is "Real Estate Investment"?

After inspecting the "Real Estate Investment" email – we determined that it is fake. The spam letter claims to be sent by an ex-government official from the opposition party in Syria. The fabricated sender expresses wishes to make the recipient a foreign partner in their business ventures. This implies that the recipient will receive a large sum of money.

Typically, spam mail of this type aims to obtain personally identifiable information and/or trick users into transferring money. Hence, this letter must be ignored and reported as spam.

What kind of malware is Nyx?

Nyx is ransomware that encrypts files, appends the victim's ID, datasupp@onionmail.com email address, and the ".NYX" extension to filenames, and drops the "READ_ME.txt" file (its ransom note). Our team discovered Nyx ransomware while inspecting malware samples submitted to VirusTotal page.

An example of how Nyx renames files: it changes "1.jpg" to "1.jpg.[R6T0SO1OCNAXIUM9].[datasupp@onionmail.com].NYX", "2.png" to "2.png.[R6T0SO1OCNAXIUM9].[datasupp@onionmail.com].NYX", and so forth.

What kind of malware is Xollam?

While examining malware samples submitted to VirusTotal, our team discovered ransomware dubbed Xollam. We found that Xollam is a new variant of Mallox ransomware with a reversed name. It encrypts files, appends the ".xollam" extension to filenames, and creates the "FILE RECOVERY.txt" text file containing a ransom note.

An example of how Xollam modifies filenames: it renames "1.jpg" to "1.jpg.xollam", "2.png" to "2.png.xollam", and so forth.

What kind of email is "Data Backup"?

Our inspection revealed that this "Data Backup" email is spam. It operates as a phishing scam targeting email account log-in credentials. The fake letter claims that the mail service will be shut down, but if the recipient uses the linked backup guide – they will be able to continue using their account. However, the link redirects to a phishing site.

What kind of page is youractualjournal[.]com?

Youractualjournal[.]com is the address of a rogue webpage that our researchers discovered while inspecting untrustworthy sites. This page promotes browser notification spam and redirects visitors to other (likely unreliable/malicious) websites.

Users typically enter such pages through redirects caused by sites using rogue advertising networks, mistyped URLs, spam notifications, intrusive ads, or installed adware.

What kind of malware is Pegasus?

Pegasus is the name of a malicious program within the spyware classification. It targets Android operating systems and can perform various commands and extract a broad range of information.

Pegasus is a highly sophisticated program developed by the Israeli cyber-arms company called NSO Group. This spyware is licensed to various governmental agencies worldwide, which has resulted in it being used for cyber-espionage against targets of interest, such as politicians, activists, journalists, and so on.

What kind of website is hiltus[.]click?

While examining hiltus[.]click, we found that this page runs various scams (shows deceptive messages) and asks for permission to show notifications. This page cannot be trusted. Typically, users do not visit such sites on purpose. Our team discovered hiltus[.]click while inspecting pages that use shady advertising networks.

What kind of application is One Click Image Downloader?

While inspecting the One Click Image Downloader application, we found that it is an advertising-supported browser extension. Apps of this type display unwanted advertisements. We discovered at least two deceptive websites promoting One Click Image Downloader.

What is Video Player Plus?

While checking out suspicious sites, we discovered one promoting the Video Player Plus browser extension. It is presented as a tool that enables users to easily download videos in multiple formats. However, after inspecting Video Player Plus – we determined that it is advertising-supported software (adware).

What is Link Locator?

While inspecting suspicious websites, our researchers discovered the Link Locator browser extension. It is promoted as a tool capable of displaying all links associated with a website in its interface. After analyzing this piece of software, we determined that it operates as adware.