Virus and Spyware Removal Guides, uninstall instructions

What is AboutDynamic?

AboutDynamic is an adware-type application with browser hijacker qualities. It operates by running intrusive ad campaigns and modifying browsers to promote fake search engines. Furthermore, apps of this type are classified as PUAs (Potentially Unwanted Applications) due to being distributed using dubious methods.

What kind of malware is MS?

MS ransomware is part of the Dharma ransomware family. This variant encrypts files, appends the victim's ID, crpt4mn@onionmail.org email address, and ".MS" extension to filenames, and generates two ransom notes (pop-up window and the "MANUAL.txt" file).

For example, it renames "1.jpg" to "1.jpg.id-1E857D00.[crpt4mn@onionmail.org].MS", "2.jpg" to "2.jpg.id-1E857D00.[crpt4mn@onionmail.org].MS", "sample.jpg" to "sample.jpg.id-1E857D00.[crpt4mn@onionmail.org].MS", and so on.

What kind of application is UpgradeSearchView?

UpgradeSearchView displays ads and promotes a fake search engine. It has the qualities of advertising-supported software and a browser-hijacking application. Apps like UpgradeSearchView are categorized as potentially unwanted applications (PUAs). It is because the majority of users download and install them inadvertently.

What is Cool ransomware?

Cool is ransomware that prevents victims from accessing files by encrypting them. Also, it appends the ".cool" extension to filenames (for example, it renames "1.jpg" to "1.jpg.cool", "2.jpg" to "2.jpg.cool") and creates the "_readme.txt" file - a ransom note. Cool is part of the Djvu ransomware family.

What is Palq ransomware?

Palq is the name of a ransomware variant that belongs to a family of ransomware called Djvu. It encrypts files and appends the ".palq" extension to filenames. For example, it renames "1.jpg" to "1.jpg.palq", "2.jpg.palq" to "2.jpg.palq". Palq provides contact and payment information in a ransom note named "_readme.txt".

What kind of website is news-wavaye[.]cc?

News-wavaye[.]cc uses a clickbait technique to lure visitors into allowing it to deliver notifications and opens untrustworthy pages. There are plenty of pages of this type. Some examples are thdedukicatio[.]xyz, beparaspr[.]com, and news-helaga[.]cc.

What kind of page is thdedukicatio[.]xyz?

Thdedukicatio[.]xyz displays untrustworthy content to trick visitors into agreeing to receive notifications and promotes various potentially malicious pages. It uses a clickbait technique to get permission to show notifications. Users do not open pages like thdedukicatio[.]xyz intentionally.

What type of malware is 38dpz ransomware?

38dpz is the name of a ransomware variant that encrypts files, modifies filenames by appending a string of random characters and the ".38dpz" extension to them, and creates a ransom note (the "WKFr_HOW_TO_DECRYPT.txt" text file).

For example, 38dpz renames a file named "1.jpg" to "1.jpg.ux9-od4j6RdXRnowzW3Lg-022alfZReD1Nf96kK_BNn_-sT7JcvH2pM0.38dpz", "2.jpg" to "2.jpg.ux9-od4j6RdXRnowzW3Lg-022alfZReD1Nf96kK_BNn_-sT7JcvH2pM0.38dpz", and so on.

What is favtab.com?

Favtab.com is both the address of a fake search engine and the name of a browser hijacker used to promote that address. Most users download and install browser hijackers inadvertently. Thus, they are categorized as potentially unwanted applications (PUAs). Apps of this type hijack browsers by changing their settings.

What type of malware is Extortionist?

Extortionist ransomware encrypts files and appends the openthefile@mailfence.com email address, a string of ransom characters, and the ".Extortionist" extension to filenames. For example, it renames "1.jpg" to "1.jpg.[openthefile@mailfence.com][MJ-PQ4931720865].Extortionist", "2.jpg" to "2.jpg.[openthefile@mailfence.com][MJ-PQ4931720865].Extortionist".

Also, it creates the "Decrypt-me.txt" file containing instructions on how to contact the attackers. Extortionist is part of the ransomware family called VoidCrypt.