Virus and Spyware Removal Guides, uninstall instructions

What is news-back[.]best?

news-back[.]best is similar to sombes[.]com, cooperativasantamargherita[.]com, click-to-win-prize[.]com and a number of other rogue web pages that display dubious content or redirect visitors to other bogus sites.

Generally, users do not open sites such as news-back[.]best intentionally - in most cases, they are opened through clicked deceptive ads, other dubious web pages, or by installed potentially unwanted applications (PUAs). Note that PUAs often gather data and serve advertisements as well.

What is MyDoom malware?

MyDoom (also known as LunaStorm) is malicious software designed to carry out DDoS (distributed denial-of-service) attacks. MyDoom is self-proliferating and self-sufficient malware. This malicious program poses a significant threat to device integrity and, therefore, you are strongly advised to remove it from operating systems immediately.

What is Soltern?

Soltern is a computer worm, a type of malware that copies itself for installation on other computers - it uses already infected systems as hosts to scan and infect the other machines.

Typically, worms such as Soltern use computer networks, email services, instant messaging apps, and Peer-to-Peer (P2P) networks to proliferate. Soltern does not infect files, however, it might install other malware.

What is Base?

Base is a malicious program, which is part of the Dharma ransomware family. This malware encrypts data and demands payment for decryption. During the encryption process, all affected files are renamed according to this pattern: original filename, unique ID, cyber criminals email address and the ".base" extension.

For example, a file like "1.jpg" would appear as something similar to "1.jpg.id-1E857D00.[savebase@aol.com].base" following encryption. After this process is complete, ransom messages are created in a pop-up window and "FILES ENCRYPTED.txt" file.

What is Bozok?

Bozok is a Remote Access (Administration) Trojan, or simply a RAT. Malware of this type allows cyber criminals responsible to monitor and control victims' computers. Bozok can be used to upload and download files to/from the victim's computer, start and end processes, modify the registry, steal stored (saved) passwords and execute various commands.

Bozok is free, which increases the number of cyber criminals who could try to infect computers with it.

What is securityvpnapp[.]com?

securityvpnapp[.]com is an untrusted website running various scams. At the time of research, this site promoted a scheme claiming that visitors' internet connections might be vulnerable. To secure the allegedly exposed connections, users are urged to download a free application.

Scams of this type often promote adware, browser hijackers and other Potentially Unwanted Applications (PUAs), as well as Trojans, ransomware and other malware. Few users access securityvpnapp[.]com or similar web pages intentionally - most are redirected to them by intrusive advertisements or PUAs already infiltrated into the system.

What is Cobra Locker?

Discovered by dnwls0719, Cobra Locker (also known as Cobra_Locker or CobraLocker) is a malicious program classified as ransomware. Following successful infiltration, this malware encrypts data in order to demand payment for decryption tools. During the encryption process, files are appended with the ".Cobra" extension.

For example, a file named something like "1.jpg" would appear as "1.jpg.Cobra" following encryption, and so on for all affected files. After this process is complete, a ransom message is displayed in a pop-up window.

What is Badboy?

Badboy ransomware was discovered by dnwls0719. It encrypts files, displays a pop-up window and creates a text file ("ReadME-BadboyEncryption.txt"), both of which are ransom messages that contain instructions about how to contact the cyber criminals behind Badboy.

This ransomware also renames encrypted files by appending the ".Badboy" extension to filenames. For example, would rename "1.jpg" to "1.jpg.Badboy", "2.jpg" to "2.jpg.Badboy", etc.

What is search.handlersection.com?

search.handlersection.com is a fake search engine that displays results generated by Yahoo after redirecting users to one of the addresses promoted by Safe Finder. Note that search.handlersection.com also redirects to search.anysearchmanager.com, the address of another dubious search engine.

Generally, addresses of fake search engines such as search.handlersection.com are promoted by potentially unwanted applications (PUAs) classified as browser hijackers. These apps are usually designed to promote fake search engines by modifying browser settings, and they also collect data.

What is SkilledControl?

SkilledControl is a rogue application categorized as adware, which also possesses browser hijacker traits. SkilledControl operates by delivering intrusive advertisement campaigns, making modifications to browser settings, and promoting fake search engines. This app promotes Safe Finder via akamaihd.net. 

Most adware-type apps and browser hijackers monitor users' browsing activity, and it is likely that SkilledControl does so as well. Due to the dubious methods used to proliferate SkilledControl, it is also classified as a Potentially Unwanted Application (PUA).

One of the distribution techniques observed in use for this software was through bogus Adobe Flash Player updaters and installers. Note that fake installation set-ups proliferate malware (e.g. Trojans, ransomware, etc.) and not just PUAs.