Virus and Spyware Removal Guides, uninstall instructions

What is the "Federal Ministry of Health Germany" scam email?

"Federal Ministry of Health Germany email virus" is a spam campaign designed to spread GuLoader malware. The term "spam campaign" defines a mass-scale operation during which deceptive emails are sent by the thousand.

These scam email messages are presented as product quotation requests from the German Federal Ministry of Health (Bundesministerium für Gesundheit).

Note that these emails are in no way associated with the real Health Ministry, and none of the information provided by them is accurate. The files attached to the scam messages contain the GuLoader malicious program, which operates by causing chain infections.

What is ExtendedSprint?

ExtendedSprint is an adware-type application with browser hijacker qualities. It operates by delivering intrusive advertisement campaigns and modifies browsers to promote illegitimate search engines. Hence, with this app installed, users are presented with various misleading/malicious ads and experience redirects.

Furthermore, adware and browser hijackers typically collect browsing-related information. Due to the dubious techniques used to distribute ExtendedSprint, it is classified as a PUA (Potentially Unwanted Application).

It is noteworthy that this application has been observed being proliferated via fake Adobe Flash Player updates, which are employed to spread not only PUAs but also malware (e.g., trojans, ransomware, etc.).

What is ExpandedTask?

ExpandedTask is dubious software categorized as adware with browser hijacker characteristics.

This app operates by delivering intrusive advertisement campaigns and making alterations to browser settings to promote fake search engines. Additionally, most adware-type apps and browser hijackers collect browsing-related information.

Since users typically download/install ExpandedTask inadvertently, it is classified as a Potentially Unwanted Application (PUA).

What is .nz (MedusaLocker) ransomware?

Belonging to the MedusaLocker ransomware family, .nz is a malicious program designed to encrypt data and demand payment for decryption. In simple terms, this malware locks files and demands ransom payments to unlock them.

During the encryption process, all affected files are appended with the ".nz" extension. For example, a file originally named something like "1.jpg" would appear as "1.jpg.nz", "2.jpg" as "2.jpg.nz", "3.jpg" as "3.jpg.nz", and so on.

After this process is complete, ransom messages in "Recovery_Instructions.html" files are dropped into compromised folders.

What is Sarbloh?

Ransomware is a type of malware that prevents victims from using/accessing their files, or the entire operating system, unless they agree to pay a ransom. Ransomware encrypts files to block access to them.

Sarbloh is a ransomware variant that encrypts files and appends the ".sarbloh" extension to filenames. For example, "1.jpg" is renamed to "1.jpg.sarbloh", "2.jpg" to "2.jpg.sarbloh", and so on. Like most ransomware variants, Sarbloh also generates a ransom message - in this case, in a displayed pop-up window and within the "README_SARBLOH.txt" file.

What is UniversalToolSearch?

UniversalToolSearch is an adware-type application with browser hijacker characteristics. It operates by delivering intrusive advertisement campaigns and promoting fake search engines by making modifications to browser settings. Additionally, adware and browser hijackers usually have data tracking capabilities that are employed to collect browsing-related information.

Since most users download/install UniversalToolSearch unintentionally, it is classified as a Potentially Unwanted Application (PUA). One of the methods used to distribute this app is proliferation via fake Adobe Flash Player updates. These bogus software updaters/installers spread PUAs, trojans, ransomware, and other malware.

What is TechResultsSearch?

The main purpose of the TechResultsSearch application is to generate revenue for developers by serving advertisements and promoting a fake search engine. This app is designed to operate as adware and as a browser hijacker. It is also likely to record various data.

TechResultsSearch is distributed using a fake Adobe Flash Player installer. Users do not often download and install this app intentionally and, for this reason, TechResultsSearch is classified as a potentially unwanted application (PUA).

What is topfreenewsfeeds[.]com?

topfreenewsfeeds[.]com is a rogue website, which shares many similarities with artepigr.com, viralnewsobserver.com, maincaptchasource.com, and thousands of others. Visitors to this page are presented with dubious content and/or are redirected to other untrusted/malicious sites.

Websites such as topfreenewsfeeds[.]com are rarely accessed intentionally - most users are redirected to them by intrusive ads or by installed Potentially Unwanted Applications (PUAs). This software has dangerous functionality such as causing redirects, running intrusive advertisement campaigns, and collecting browsing-related information.

What is allowlucks[.]com?

allowlucks[.]com is one of many untrusted websites that force people to visit other websites of this kind or load dubious content.

Some examples of similar pages are artepigr[.]com, viralnewsobserver[.]com, and maincaptchasource[.]com. Typically, users do not visit these sites intentionally - they are opened when potentially unwanted applications (PUAs) are installed. Note that these websites are often promoted through deceptive ads or other bogus sites.

What is the "(3) Viruses have been detected on your iPhone" scam?

There are many untrusted websites that promote potentially unwanted (or even malicious) applications using a deceptive method: they display fake notifications stating that the device is infected with viruses (or damaged in some other way) and it will be damaged further if no prompt action is taken.

These pages encourage visitors to download and install an app that will supposedly remove the non-existent viruses (or solve other "problems").