Virus and Spyware Removal Guides, uninstall instructions

What is Power_user_jo ransomware?

Power_user_jo refers to malicious software classified as ransomware. Systems infected with this malware experience data encryption and users receive ransom demands for decryption. During encryption process, affected files are appended with a seemingly random character string, which is the unique ID assigned to the victim.

For example, "1.jpg" would appear as something similar to "1.jpg.3vb5NzHy7fxY_RSA" following encryption. Once this process is complete, ransom messages in "Data recovery.hta" files are dropped into compromised folders.

What is Vovalex?

Vovalex is a form of malware that encrypts files (prevents victims from accessing them) and demands ransom payments to restore access. It also renames each encrypted file by appending the ".vovalex" extension. For example, "1.jpg" is renamed to "1.jpg.vovalex", "2.jpg" to "2.jpg.vovalex", and so on.

Contact and payment information is provided in the "README.VOVALEX.txt" file (ransom message). Vovalex is written in the D (Dlang) programming language, possibly the first ransomware using this language.

What is MusicStreamSearches?

MusicStreamSearches is a typical browser hijacker: it changes browser settings and gathers browsing-related information. It might also collect private, sensitive details.

Browser hijackers are often downloaded by users unintentionally and, therefore, MusicStreamSearches and other apps of this type are classified as potentially unwanted applications (PUAs).

What is continue-site[.]site?

People do not often visit pages such as continue-site[.]site intentionally - they are opened by installed potentially unwanted applications (PUAs), after clicking dubious advertisements, or visiting bogus web pages.

There are many pages similar to continue-site[.]site online. Some examples are freshnewmessage[.]com, pointcaptchaspot[.]com, and check-me[.]online. None are trusted websites.

What is FreePDFConverterSearch?

FreePDFConverterSearch is a browser hijacker that promotes the freepdfconvertersearch.com bogus search engine. This piece of software promotes its web searcher by making modifications to browser settings.

In addition, FreePDFConverterSearch has data tracking capabilities, which are employed to monitor users' browsing activity. Since most users download/install browser hijackers inadvertently, they are also classified as Potentially Unwanted Applications (PUAs).

What is ConvertorSearch?

ConvertorSearch is dubious software categorized as a browser hijacker. Following successful infiltration, it makes alterations to browser settings to promote convertorsearch.com (a bogus search engine).

Most browser hijackers monitor users' browsing habits. Due to the dubious methods employed to proliferate ConvertorSearch, it is also classified as a Potentially Unwanted Application (PUA).

What is Zasifrovano.zaplat.za klic 2021?

Zasifrovano.zaplat.za klic 2021 belongs to the Xorist ransomware family. Ransomware is a type of malware that prevents victims from accessing or using their files by encrypting them. Unless victims pay the ransom, their files remain encrypted. Usually, only the attackers have valid decryption tools.

The rogue program renames encrypted files by appending ".Zasifrovano.zaplat.za klic 2021" to filenames. For example, "1.jpg" is renamed to "1.jpg.Zasifrovano.zaplat.za klic 2021", "2.jpg" to "2.jpg.Zasifrovano.zaplat.za klic 2021", and so on.

This ransomware also displays a pop-up window and creates the "HOW TO DECRYPT FILES.txt" file, both of which contain ransom messages.

What is the mysearch Pro browser hijacker?

Mysearch Pro is a browser hijacker promoting the tailsearch.com fake search engine. Typically, software within this classification promotes fake search engines by making modifications to browser settings, however, mysearch Pro does not always operate in this way (see below). Additionally, it collects browsing-related information.

Since most users download/install browser hijackers unintentionally, they are also classified as Potentially Unwanted Applications (PUAs).

What is NOV?

NOV is a type of malware that prevents victims from accessing their files: it encrypts files and keeps them inaccessible unless victims pay a ransom.

This ransomware encrypts files and renames them by adding the victim's ID, yourfiles1@cock.li email address, and appending the ".NOV" extension to filenames. For example, "1.jpg" is renamed to "1.jpg.id-C279F237.[yourfiles1@cock.li].NOV".

NOV also displays a pop-up window and creates the "MANUAL.txt" file. These contain instructions about how to contact the attackers.

Note that NOV belongs to the Dharma ransomware family and was discovered by Ravi.

What is Idecrypt ransomware?

Idecrypt is a ransomware-type program, which is part of the VoidCrypt malware family. Systems infected with Idecrypt experience data encryption and users receive ransom demands for decryption.

During the encryption process, files are renamed according to this pattern: original filename, cyber criminals' email address, unique ID assigned to the victims, and the ".idecrypt" extension. For example, a file like "1.jpg" would appear as something similar to "1.jpg.[Idecrypt.plz.dontworry@gmail.com][T137KZQEBAWDS6R].idecrypt" following encryption.

After this process is complete, ransom-demand messages in "!INFO.HTA" files are dropped into compromised folders.