Virus and Spyware Removal Guides, uninstall instructions

What is "Phone Update Recommended"?

While inspecting rogue webpages, our researchers discovered the "Phone Update Recommended" scam, which targets Android device users. This scheme attempts to trick visitors into downloading/installing and/or purchasing recommended software - by claiming that it will improve the device's poor performance.

What is Nitrokod?

Nitrokod is a malicious program that operates as a backdoor for cryptocurrency mining malware. At the time of writing, Nitrokod was designed to infect systems with the XMRIG cryptominer.

It is noteworthy that Nitrokod has been actively spread via malicious applications disguised as legitimate software, most successfully through a trojanized app presented as Google Translate Desktop. According to Check Point Research, Nitrokod is used by Turkish-speaking cyber criminals, and it has infected devices throughout eleven countries.

What kind of email is "Annual Open Vacation Plan"?

After inspecting the "Annual Open Vacation Plan" email, we learned that it is spam operating as a phishing scam. This letter is presented as a notification regarding vacation approval from an HR (Human Resources) department.

To view the document supposedly containing the list of employees approved for vacation, the recipient is to log-in by using their email credentials. However, this letter and the promoted website are fake; hence, by entering their credentials into the latter - users will expose them to the scammers behind this spam campaign

What kind of page is adforyounews[.]com?

While looking through untrustworthy websites, our researchers discovered the adforyounews[.]com rogue page. It is designed to deceptively promote browser notification spam. Additionally, adforyounews[.]com can redirect visitors to other (likely unreliable/malicious) websites.

Most users enter sites like adforyounews[.]com through redirects caused by webpages using rogue advertising networks.

What is "Norton LifeLock" email scam?

After inspecting this "Norton LifeLock" email, we determined that it is fake. It must be emphasized that this spam mail is in no way associated with either NortonLifeLock Inc. or PayPal Holdings, Inc.

This scam letter is presented as a purchase invoice, which states that the payment has already been processed. The aim is to trick recipients into calling the provided number to cancel the bogus payment/subscription.

What is Xbtl ransomware?

Xbtl is a ransomware-type program that our research team discovered while looking through new malware submissions to VirusTotal. Ransomware is designed to encrypt data and demand payment for decryption.

Once we launched a sample of Xbtl on our test machine, it encrypted files and appended their filenames with a ".xbtl" extension. For example, a file originally titled "1.jpg" appeared as "1.jpg.xbtl", "2.png" as "2.png.xbtl", and so on for all of the compromised files.

Afterwards, this ransomware changed the desktop wallpaper and created a text file named "README.txt". Both contained identical ransom notes, which were in the Russian and English languages.

What is View-Dark?

View-Dark is a rogue browser extension that our research team discovered while inspecting deceptive software-endorsing sites. While View-Dark is promoted as a dark-mode tool for simple design websites, it operates as advertising-supported software (adware) instead.

What is K1ng ransomware?

During a routine inspection of new malware submissions, our researchers found a ransomware-type program named K1ng. It belongs to the Dharma ransomware family.

After we executed a sample of K1ng on our test system, it encrypted files and appended their filenames with a unique ID assigned to the victim, the cyber criminals' email address, and a ".k1ng" extension. For example, a file originally titled "1.jpg" appeared as "1.jpg.id-9ECFA84E.[king2022@tutanota.com].k1ng".

Once the encryption was finished, the ransomware created two ransom notes: one was displayed as a pop-up window, and the other - a text file named "info.txt" was dropped onto the desktop.

What is Playless videos?

Our research team discovered the "Playless videos" browser extension while inspecting dubious software-promoting webpages. It is presented as a tool capable of disabling/auto-skipping ads on YouTube. However, our analysis revealed that Playless videos works as adware. Hence, instead of removing advertisements - this browser extension displays them.

What is Fopra ransomware?

While investigating new malware submissions to VirusTotal, our research team discovered another malicious program belonging to the Phobos ransomware family - called Fopra.

We executed a sample of Fopra on our test machine, and it encrypted files and altered their titles. Original filenames were appended with a unique ID assigned to the victim, the cyber criminals' email address, and a ".fopra" extension. For example, a file initially named "1.jpg" appeared as "1.jpg.id[9ECFA84E-3388].[poshix@tfwno.gf].fopra", etc.

After the encryption was completed, this ransomware created two ransom notes - "info.hta" (pop-up) and "info.txt" - and dropped them onto the desktop.