Virus and Spyware Removal Guides, uninstall instructions

What is AlumniLocker?

AlumniLocker was discovered by dnwls0719. Cybercriminals use ransomware to prevent victims from accessing their files (or devices) and demand ransom payments to regain access. Typically, ransomware encrypts and renames files and creates (or displays) a ransom message.

AlumniLocker appends the ".alumni" extension to filenames. For example, "1.jpg" is renamed to "1.jpg.alumni", "2.jpg" to "2.jpg.alumni", and so on. It also creates the "HOW_TO_RECOVER_YOUR_FILES.txt" text file (ransom message).

What is phone-security[.]me?

phone-security[.]me is one of many deceptive websites that scammers use to scare visitors into downloading and installing potentially unwanted applications (PUAs). In most cases, these web pages display fake virus alerts claiming that the device is infected with viruses.

Therefore, avoid telephone-security[.]me and similar sites. If they are opened often, it is possible that the device or browser is already infected with PUAs.

These websites are also promoted via deceptive ads and other untrusted sites.

What is LockfilesKR?

LockfilesKR is malicious software belonging to the MedusaLocker ransomware family. It operates by encrypting data and demanding payment for decryption tools. I.e., this malware renders files inaccessible and demands ransom payments from victims to restore access.

During the encryption process, files are appended with the ".lockfilesKR" extension. For example, a file originally named something like "1.jpg" would appear as "1.jpg.lockfilesKR" after encryption. Once this process is complete, ransom messages within "Recovery_Instructions.html" files are dropped into affected folders.

What is netflowgroup[.]com?

Users often arrive at websites such as netflowgroup[.]com unintentionally after clicking dubious advertisements, through bogus web pages, or when installed potentially unwanted applications (PUAs) open them.

All PUAs installed on browsers/computers should be removed - these rogue apps promote bogus pages (including netflowgroup[.]com), display advertisements, and collect information.

What is theactualnewz[.]com?

theactualnewz[.]com is a rogue site, sharing many similarities with bestcaptcharesolver.com, newsfeedzscrollz.com, znews-live.com, and thousands of others. This web page operates by presenting visitors with dubious content and redirecting them to other untrusted and possibly malicious websites.

Most users access these pages via redirects caused by intrusive ads or installed Potentially Unwanted Applications (PUAs), which are proliferated using dubious techniques and can stealthily infiltrate devices.

PUAs cause redirects, deliver intrusive advertisement campaigns, and collect browsing-related information.

What is the Norton Subscription Has Expired email scam?

Scammers use various techniques to monetize their spam emails. One is to trick recipients into believing that their antivirus software is expiring (or has already expired) and into renewing their licenses via provided website links.

If they succeed, the rogue affiliates (scammers behind these emails) earn a commission from the sale (antivirus renewal). Emails of this type should be ignored. Note that most antivirus solutions inform their users regarding license expiry via notifications from the software, however, some companies do send such reminders via email.

What is the "Within 96 hours I'll ruin your prestige" scam email?

"Within 96 hours I'll ruin your prestige" is an email spam campaign. This term defines a mass-scale operation during which thousands of deceptive/scam emails are sent. The messages distributed via this campaign inform recipients that the sender has obtained an explicit video featuring the recipient and, to prevent publication, a ransom must be paid.

These emails use the 'sextortion' scam model. Note that all of the information provided by "Within 96 hours I'll ruin your prestige" is false. Therefore, no compromising recording exists, and as such, the scam message must simply be ignored.

What is searchletter.com?

searchletter.com is the address of a fake search engine designed to provide fast and accurate results. Like most search engines of this type, searchletter.com is promoted through rogue download and/or installation set-ups that modify browser settings. Furthermore, if used, this site gathers various information relating to users' internet browsing habits.

What is bestcaptcharesolver[.]com?

bestcaptcharesolver[.]com is a rogue website that operates by presenting visitors with dubious content and redirecting them to other untrusted/dangerous web pages. There are thousands of similar sites on the web, including newsfeedzscrollz.com, znews-live.com, and captcha2020.com.

Few users enter rogue these pages intentionally - most are redirected to them by intrusive ads or Potentially Unwanted Applications (PUAs). This software does not need explicit permission to be installed onto systems, and thus users may be unaware of its presence. As well as causing redirects, PUAs run intrusive advertisement campaigns and collect browsing-related information.

What is search.assistivedata.com?

search.assistivedata.com is classified as a fake search engine because it redirects users to google.com (and simply provides search results generated by Google). Like most fake search engines, search.assistivedata.com is promoted through a browser hijacker (SearchModule is one app that promotes this address).

Browser hijacking apps promote search engines by changing browser settings, and apps promoting search.assistivedata.com also add the "Managed by your organization" feature to Google Chrome browsers.