Virus and Spyware Removal Guides, uninstall instructions

What kind of application is Auto Play?

Auto Play is a browser extension that our team discovered while inspecting a deceptive website instructing us to add this extension to continue watching a video. After adding this app to a browser, we learned that it functions as adware - it shows annoying advertisements. Thus, we recommend not to trust the Auto Play app.

What kind of page is notadvertise[.]com?

Notadvertise[.]com is a deceptive website designed to trick visitors into agreeing to receive notifications and redirect them to other untrustworthy websites. Typically, pages like notadvertise[.]com are visited unintentionally. We found this site while examining websites that use rogue advertising networks.

What kind of email is "Password Verification"?

After analyzing this "Password Verification" email, we determined that it is a phishing spam email. Like many of its ilk, this letter attempts to trick recipients into revealing their email log-in credentials (passwords) by making false claims about their account's impending deactivation.

What kind of malware is KOK08?

While checking the VirusTotal page for recently submitted malware samples, our malware researchers discovered the KOK08 ransomware. This ransomware is part of the Matrix ransomware family. It encrypts files, modifies their filenames, and creates the "!README_KOK08!.rtf" file that contains a ransom note.

An example of how KOK08 ransomware renames files: it replaces "1.jpg" with "[KOK08@QQ.COM].2B6ICLL1-lLPufkux.KOK08", "2.png" with "[KOK08@QQ.COM].3C7LGKO4-lLPufkux.KOK08", and so forth. It replaces filenames with the kok08@qq.com email address and a string of random characters and appends the ".KOK08" as the file extension.

What kind of application is ExecutiveMethod?

After downloading and using a fake installer downloaded from a shady website, our team discovered an application called ExecutiveMethod. It is a useless application designed to bombard users with unwanted advertisements. Therefore, we classified ExecutiveMethod as adware (advertising-supported application).

What is NMO ransomware?

While looking through new submissions to VirusTotal, our researchers found yet another ransomware-type program - called NMO - that belongs to the Dharma ransomware family.

After executing a sample of NMO on our test machine, it encrypted files and altered their filenames. The original titles were appended with a unique ID, the cyber criminals' email address, and a ".NMO" extension. For example, a file named "1.jpg" appeared as "1.jpg.id-9ECFA84E.[dr.nemo@tutanota.com].NMO".

Once the encryption was finished, the ransomware displayed a pop-up window and dropped a text file titled "info.txt" onto the desktop. Both the pop-up and text file contained ransom notes.

What kind of application is LinearRadial?

LinearRadial is an application designed to bombard users with annoying advertisements. Apps of this type are classified as adware. We discovered LinearRadial while inspecting a shady installer downloaded from a deceptive web page.

What kinf of page is topsurvey24[.]top?

While visiting (and inspecting) illegal movie streaming, torrent, and similar pages, we discovered topsurvey24[.]top. This page runs a fake survey to promote other deceptive pages and asks permission to show notifications. It is not recommended to visit such pages and allow them to deliver notifications.

What is EntrySample?

EntrySample is a piece of rogue software that we discovered while checking out new submissions to VirusTotal. After analyzing this application, we determined that it is adware belonging to the AdLoad malware family.

What is Easy Files Downloading?

While inspecting dubious software-promoting sites, our research discovered the Easy Files Downloading browser extension. It is presented as a download management tool. After analyzing this extension, we determined that it operates as adware.