Virus and Spyware Removal Guides, uninstall instructions

What is Neptun Tab?

Neptun Tab is a rogue browser extension, which our research team discovered while analyzing fake Google Chrome updates. This piece of software is endorsed as a tool capable of allowing users to customize their browsers' homepage and new tab appearance - including such widgets as weather, time, reminders, etc.

Our researchers determined that the Neptun Tab extension is a browser hijacker that promotes the search.neptuntab.com illegitimate search engine.

What is Vsbnw ransomware?

Vsbnw is a piece of malicious software categorized as ransomware, which our researchers found while inspecting new malware submissions on VirusTotal.

Once launched onto our test machine, this ransomware began encrypting files and appending their filenames with a random character string and the ".vsbnw" extension. For example, a file originally named "1.jpg" appeared as "1.jpg.cwO-rUVietD16B-n8DFjWy0gaJStKSeRJ3D_-F71iIP_NAAAADQAAAA0.vsbnw" afterwards.

Following the completion of this process, Vsbnw created a ransom note titled "yxjL_HOW_TO_DECRYPT.txt". The message in this file indicates that this ransomware targets companies rather than home users. It is noteworthy that such attacks can be heavily customized; hence, the information provided by their notes and websites may vary.

What is MultiDetail?

MultiDetail is a rogue application that our research team discovered while inspecting new submissions to VirusTotal. After analyzing this piece of software, we determined that it is an adware belonging to the AdLoad malware family.

What is the "Your Account Needs Attention!" email?

"Your Account Needs Attention!" is a spam email that we have received and subsequently analyzed. We determined that it is a phishing scam.

The letter claims that unless the recipient updates their email account - it will be deactivated in a matter of hours. This spam mail aims to trick the recipient into disclosing sensitive information, most likely the email account's log-in credentials.

What kind of scam is "Access to this PC has been blocked for due to illegal activities"?

Our team has discovered this technical support scam page while examining websites that use rogue advertising networks and have deceptive ads on them. We learned that the purpose of this page is to scare visitors into calling the provided number (into contacting scammers for fake technical support).

What is the Ask Ali browser extension?

Our researchers discovered the Ask Ali browser extension while inspecting deceptive download webpages. This extension promises easy access to "one of the most prominent online shopping services". The extension's name and the imagery used in its official webpage imply that the e-commerce platform in question is AliExpress. However, it must be emphasized that this piece of software is in no way associated with AliExpress or the Alibaba Group.

Following analysis, we have concluded that the Ask Ali browser extension operates as advertising-supported software (adware).

What kind of website is websiteshove[.]com?

We have analyzed the websiteshove[.]com page and found that it uses a clickbait technique to trick visitors into granting it permission to show untrustworthy notifications and redirects to other websites. Our team has discovered websiteshove[.]com while visiting pages that use rogue advertising networks.

What is HermeticWiper?

On February 23rd, another wave of geopolitically-motivated attacks was observed in Ukraine. This campaign employs HermeticWiper (also known as FoxBlade) - a piece of malicious software designed to wipe (delete) data and render devices using the Windows Operating System (OS) - inoperable.

Attacks of this type can be incredibly devastating. When leveraged against governmental bodies or the business sector, they can cause permanent loss of crucial data and disrupt essential services.

What kind of malware is Jjtt?

Our team has discovered the Jjtt ransomware while checking malware samples submitted to VirusTotal. It was found that Jjtt is part of the Djvu ransomware family. Jjtt encrypts files, appends the ".jjtt" extension to filenames, and creates the "_readme.txt" file.

The "_readme.txt" file is a ransom note containing mainly contact and payment information. An example of how files get renamed by Jjtt: a file named "1.jpg" gets renamed to "1.jpg.jjtt", "2.png" to "2.png.jjtt", and so on.

What kind of email is "Payment Forecast Of The Attached Invoice"?

We have analyzed this email and found that its purpose is to trick recipients into providing email account login credentials on the presented phishing website. This email is disguised as an urgent letter regarding payment status.