Virus and Spyware Removal Guides, uninstall instructions

What is Honor ransomware?

Honor is malicious software belonging to the Voidcrypt ransomware family. It operates by encrypting the data of infected systems in order to demand ransoms for decryption tools. During the encryption process, all compromised files are renamed following this pattern: original filename, cyber criminals' email address, unique ID assigned to the victims and the ".honor" extension.

For example, a file originally named "1.jpg" would appear as something similar to "1.jpg.[honorsafe@keemail.me][LZAW2OJ9F10CEHK].honor" following encryption. Once this process is complete, ransom-demand messages within "!INFO.HTA" files are dropped into affected folders.

What is Pulpit?

Discovered by S!Ri, Pulpit ransomware appends the ".pulpit" extension to the filenames of all encrypted files. For example, "1.jpg" is renamed to "1.jpg.pulpit", "2.jpg" to "2.jpg.pulpit", and so on. It also creates the "HOW_TO_DECYPHER_FILES.txt" text file (a ransom message) in all folders that contain encrypted files.

This file contains instructions about how to contact the cyber criminals who developed Pulpit.

What is brkdown[.]com?

brkdown[.]com is a deceptive site running various scams. At the time of research, this web page has been observed promoting a variant of the "Your Apple iPhone is severely damaged" scheme. This scam states that multiple viruses have been detected on the user's device and pose a significant threat to its content.

No website can detect threats/issues present on systems, and any that make such claims are scams. Schemes of this kind endorse various dubious software, most commonly, potentially unwanted applications (PUAs) such as fake anti-virus tools, adware, browser hijackers, etc.

Some might even proliferate malware (e.g. Trojans, ransomware, etc.). Typically, these deceptive pages are accessed via mistyped URLs, redirects caused by intrusive advertisements, or PUAs.

What is privex-protection[.]com?

privex-protection[.]com is an untrusted website that claims to have found an infection on the visitor's device and advises removal of it with a potentially unwanted application (PUA), which can be downloaded via a provided website link.

Generally, users do not visit privex-protection[.]com or similar sites intentionally - they are opened via other visited untrusted web pages, clicked deceptive advertisements, or by PUAs already installed on the system.

What is StreamBee?

StreamBee promotes keysearchs.com, the address of a fake search engine. It can also read certain browsing data. Apps of this type (browser hijackers) are classified as potentially unwanted applications (PUAs), since, in most cases, users download and install them unintentionally.

What is Sophos ransomware?

Sophos is a malicious program belonging to the VoidCrypt ransomware family. It is likely that the name of this malware has been chosen with the intention of vilifying the British security software and hardware company (dealing in communication endpoint, encryption, network security, email and mobile security, and unified threat management) called Sophos.

It must be emphasized that the genuine Sophos company is in no way associated with this ransomware. The malware is designed to encrypt the data of compromised systems in order to demand payment for decryption.

During the encryption process, all affected files are renamed following this pattern: original filename, cyber criminals' email address, unique ID assigned to the victims and the ".Sophos" extension. For example, a file originally named "1.jpg" would appear as something similar to "1.jpg.[encryptadm@criptext.com][ZRDUT4AGKS5CVM7].Sophos" following encryption.

After this process is complete, ransom messages within "!INFO.HTA" files are dropped into affected folders.

What is Konx ransomware?

Konx is a malicious program, which is part of the VoidCrypt ransomware family. Systems infected with this malware experience data encryption and users receive ransom demands for decryption tools.

During the encryption process, files are renamed following this pattern: original filename, cyber criminals' email address, unique ID assigned to the victims and the ".konx" extension. For example, a file named "1.jpg" would appear as something similar to "1.jpg.[konxnobx@tutanota.com][BRF0YLQ3IDTPC6Z].konx" after encryption.

Once this process is complete, ransom messages within "!INFO.HTA" files are dropped into compromised folders.

What is Shiton?

Shiton is a malicious program belonging to the VoidCrypt ransomware family. This software is designed to encrypt files, modify their filenames, and create ransom messages. Shiton renames encrypted files by adding the ad.decrypt01@gmail.com email address and victim's ID, and appending the ".shiton" extension to their filenames.

For example, "1.jpg" is renamed to "1.jpg.[Ad.Decrypt01@Gmail.com][K90SQC1F24EG7WV].shiton", "2.jpg" to "2.jpg.[Ad.Decrypt01@Gmail.com][K90SQC1F24EG7WV].shiton", and so on. It also creates a ransom message (within the "!INFO.HTA" file) in all folders that contain encrypted files.

What is the fake "WhatsApp" email?

"WhatsApp email scam" refers to a spam email campaign. The term "spam campaign" is used to define a large-scale operation, during which thousands of deceptive/scam messages are sent. As the name implies, the emails distributed through this spam campaign are disguised as important notifications from WhatsApp, a cross-platform messaging and VoIP (Voice over IP) service.

These deceptive emails are in no way associated with the genuine WhatsApp company. The scam messages are in Portuguese and claim that they contain recipients' WhatsApp message/call history backups, however, the attached HTML file and the link listed in the emails redirects to a phishing website, which attempts to trick recipients into providing their personal information.

What is Teco New Order email virus?

Cyber criminals behind these malspam emails attempt to trick recipients into clicking a download link for a malicious file, and then opening the file, or executing the file attached to an email. The main purpose of these emails is to deceive recipients into infecting their computers with malicious software.

This particular malspam email is used to distribute a Remote Access Trojan called Agent Tesla.