Virus and Spyware Removal Guides, uninstall instructions

What is "Amazon loyalty program" scam?

This deceptive website may appear similar to a legitimate survey from Amazon, however, the official Amazon company has nothing to do with this scam. Generally, scammers behind such web pages attempt to trick visitors into believing that, in return for participation in a survey, they can receive a prize.

Commonly, these survey scams are used to extract personal, sensitive information. Do not to trust this or other deceptive, unofficial websites. Note that these bogus web pages are often opened through other untrusted sites, deceptive ads, or by installed potentially unwanted applications (PUAs).

What is VAGGEN?

This ransomware was discovered by Marcelo Rivero. VAGGEN encrypts and renames files, changes desktop wallpaper, displays a pop-up window, and creates the "AboutYourFiles.txt" text file. This ransomware renames encrypted files by appending the ".VAGGEN" extension to filenames.

For example, "1.jpg" is renamed to "1.jpg.VAGGEN", "2.jpg" to "2.jpg.VAGGEN", and so on. The "AboutYourFiles.txt" file (which VAGGEN creates in all folders that contain encrypted files) and modified desktop wallpaper are the ransom messages.

What is Smashtab?

Smashtab is rogue software classified as a browser hijacker. Following successful installation, it makes changes to browser settings to promote smashtab.net (a fake search engine). Additionally, Smashtab has data tracking capabilities, which are used to monitor users' browsing activity.

Due to the dubious methods used to proliferate browser hijackers, they are classified as Potentially Unwanted Applications (PUAs).

What is Beijing ransomware?

Beijing is typical ransomware, which encrypts files, appends its extension to the filenames of all encrypted files, and creates a ransom message with instructions about how to contact the developers. Beijing renames encrypted files by appending the ".beijing" extension to filenames.

For example, "1.jpg" is renamed to "1.jpg.beijing", "2.jpg" to "2.jpg.beijing", and so on. Beijing creates a ransom message (within the "!RECOVER.txt" text file) in all folders that contain encrypted files. This ransomware is another variant of LeakTheMall ransomware.

What is the Montana ransomware?

Montana is a variant of LeakTheMall ransomware. This malicious program is designed to encrypt data and demand payment for decryption. During the encryption process, all affected files are appended with the ".montana" extension. For example, a file originally named something like "1.jpg" would appear as "1.jpg.montana" following encryption.

Once this process is complete, ransom messages in "!HELP!.txt" files are dropped into compromised folders.

What is alltopposts[.]com?

alltopposts[.]com and similar web pages should never be trusted. Typically, they are opened by browsers that have potentially unwanted applications (PUAs) installed on them, through deceptive ads, or other untrusted pages. In any case, users do not often open/visit these sites intentionally.

Some examples of other web pages similar to alltopposts[.]com are reightpainf[.]top, content4you[.]net and mylot[.]com. Note that PUAs promote dubious websites, serve ads, and collect data.

What is PDF Mighty?

PDF Mighty is rogue software endorsed as a tool capable of converting files (e.g. Microsoft Office documents) into the PDF format, however, due to the dubious methods used to proliferate this application, it is classified as a Potentially Unwanted Application (PUA).

One of the primary purposes of PDF Mighty is to promote the SearchMighty browser hijacker. Furthermore, PUAs often have undisclosed, dangerous capabilities and the advertised features are rarely operational.

What is FileConvertGiant?

FileConvertGiant is advertised as the most comprehensive file converter that works with a wide range of file types including various documents, archive files, spreadsheets, and audio and video files. In fact, this app is categorized as potentially unwanted application (PUA) because of the method that is used to distribute the software.

The installer for FileConvertGiant also includes an offer to install MySearchGiant, a browser hijacker (another PUA). You are advised not to download or install FileConvertGiant, MySearchGiant, or any other PUAs.

What is LeakTheMall ransomware?

Discovered by Amigo-A, LeakTheMall is a ransomware-type malicious program. Systems infected with this malware have their data encrypted and users receive ransom demands for decryption tools. During the encryption process, files are appended with the ".crypt" extension.

For example, a file originally named something like "1.jpg" would appear as "1.jpg.crypt", "2.jpg" as "2.jpg.crypt", and so on. After this process is complete, ransom-demand messages in "ReadMe.txt" files are dropped into affected folders.

What is Clay?

Discovered by xiaopao, Clay encrypts files and provides instructions about how to pay a ransom, contact the developers, and various other details. Unlike other malware of this type, Clay does not rename encrypted files or append any extension to the compromised filenames, however, it displays a ransom message in a pop-up window.