Virus and Spyware Removal Guides, uninstall instructions

What is the justmedia24[.]biz site?

justmedia24[.]biz is a rogue website and practically identical to news06.biz, lokpresearch.club, meetclick.biz and countless others. Visitors to this page are presented with dubious content and/or are redirected to other dubious and possibly malicious sites.

Most users access these web pages through redirects caused by intrusive advertisements or by Potentially Unwanted Applications (PUAs) already installed on their devices. These unwanted apps do not need explicit user consent to be infiltrated into systems. PUAs cause redirects, run intrusive ad campaigns and collect browsing-related information.

What is PUBG hack scam?

PlayerUnknown's Battlegrounds is an online multiplayer game. Players can earn Battle Points (BP) or Unknown Cash (UC) by completing missions, matches, etc., and use them to change the avatar's appearance (buy skins, outfits) or purchase other items from the PUBG shop.

This scam website offers free PUBG currency (BP and UC) in exchange for certain information. You are strongly advised not to enter any details on this or other similar scam pages, since it can be misused for malicious purposes.

What is the ytbmp3[.]club site?

ytbmp3[.]club is an untrusted website, which operates as a YouTube video converter. It offers the service of converting YouTube videos (via links) into MP3 files, which users can then download. As well as infringing copyright law, this web page also uses rogue advertising networks for monetization.

Therefore, when it is accessed or users interact with the content presented, they are redirected to dubious and possibly malicious sites.

What is Mame Vse ransomware?

Mame Vse is a malicious program classified as ransomware. Typically, this type of malware operates by encrypting data and demanding payment for decryption. During the encryption process, all compromised files are appended with the ".mame vse" extension.

For example, a file originally named something like "1.jpg" would appear as "1.jpg.mame vse", "2.jpg" as "2.jpg.mame vse", and so on. Once this process is complete, Mame Vse creates "HOW TO DECRYPT FILES.txt" files (with text in the Czech language) and drops them into affected folders. Additionally, this ransomware changes the desktop wallpaper.

What is LiveConverterSearch?

LiveConverterSearch promotes liveconvertersearch.com (by modifying browser settings) and collects information relating to users' browsing activities. In most cases, users download and install browser hijackers inadvertently and, for this reason, they are categorized as potentially unwanted applications (PUAs).

What is "Windows Defender - Security Warning"?

Generally, scammers behind technical support scams such as this attempt to trick users into believing that their computers are infected, errors exist, etc. They urge users to call the provided number and then pay for unnecessary services and software. In some cases, scammers behind these pages attempt to trick visitors into providing remote access to their computers.

In most cases, users arrive at these sites through other dubious web pages, by clicking deceptive ads, or when installed PUAs open them. In any case, people do not often visit these scam pages intentionally. Note that this site is hosted using the Amazon AWS service provided by Amazon. Scammers and cyber criminals commonly employ this service for malicious purposes.

What is the Geneve ransomware?

Geneve is the name of a ransomware-type malicious program. Systems infected with this malware experience data encryption and users receive ransom demands for decryption tools/software. When Geneve encrypts, it appends all affected files with a random extension.

For example, a file originally named "1.jpg" would appear as something similar to "1.jpg.fezmm" following encryption. Once this process is complete, ransom-demand messages in "DECRYPT.HTML" files are dropped into compromised folders.

What is Lockz?

Lockz ransomware is a type of malware that encrypts files, modifies their filenames and displays a ransom message in a pop-up window. It renames encrypted files by appending the ".lockz" extension. For example, "1.jpg" is renamed to "1.jpg.lockz", "2.jpg" to "2.jpg.lockz", and so on.

What is the heiipiossuport[.]info website?

heiipiossuport[.]info is a deceptive website promoting various scams. At the time of research, this site ran a scam targeting iPhone users, however, heiipiossuport[.]info can also be accessed through other Apple products. This scheme has many similarities with technical support scams.

It claims that suspicious activity has been detected on the web pages users have recently visited and, to protect their mobile devices, they have been blocked. To unblock them, users are instructed to contact the scammers. Note that all of the information provided by heiipiossuport[.]info is false and in no way associated with Apple Inc.

Furthermore, no website can detect issues/threats present on visitors' systems and, hence, any that make such claims are scams. Few users access these deceptive/scam pages intentionally - they enter them via mistyped URLs or are redirected by intrusive advertisements or Potentially Unwanted Applications (PUAs).

This software does not need explicit user consent to be installed onto devices.

What is PracticalSystem?

PracticalSystem is classified as adware and a browser hijacker: this app serves advertisements and promotes fake search engines (0yrvtrh.com and search.dominantmethod.com) by changing certain browser settings. PracticalSystem can also read sensitive information from websites.

It is categorized as a potentially unwanted application (PUA), since users often download and install it inadvertently.