Virus and Spyware Removal Guides, uninstall instructions

What is Btc (Oled)?

Btc (Oled) a variant of Oled ransomware. It encrypts victims' files, changes the filenames and creates a ransom message. Btc (Oled) renames files by adding the victim's ID, markmontgomery2020@hotmail.com email address and appending the ".btc" extension to filenames.

For example, it would rename "1.jpg" to "1.jpg.[E38D7F03].[markmontgomery2020@hotmail.com].btc", "2.jpg" to "2.jpg.[E38D7F03].[markmontgomery2020@hotmail.com].btc", etc. Other variants of this ransomware append the ".[cocacoder@hotmail.com].btc" extension.

Instructions about how to contact cyber criminals (and some other information) is provided in a text file named "readme-warning.txt".

What is "Supreme Court Email Virus"?

The "Supreme Court" email is a deceptive message designed to proliferate the AsyncRAT (Remote Access Trojan). This scam email is disguised as a notice of a new filing from the Supreme Court. The malicious file attached to the message is presented as containing important information concerning the filing. If this file is opened, the infection process of AsyncRAT malware starts.

What is "Office Depot Email Virus"?

There are many spam campaigns that are used by cyber criminals who attempt to trick people into installing malware. They send emails that contain a malicious attachment or website link that downloads the rogue file. They attempt to trick recipients into opening the malicious file (which then installs malware) by disguising their emails as important and official.

In this case, they spread an email disguised as a message from Office Depot, a legitimate retail company. It contains an archive file containing a malicious document designed to distribute Gozi (also known as Ursnif).

What is Stream Radio Live?

Stream Radio Live is rogue software categorized as a browser hijacker. It is endorsed as a tool for easy access to online radio streaming services. In fact, Stream Radio Live modifies browsers and promotes a fake search engine (streamradiolive.co). Additionally, it tracks browsing activity and gathers sensitive information extracted from it.

Due to the dubious tactics used to proliferate Stream Radio Live, it is also classified as a Potentially Unwanted Application (PUA). Note that Stream Radio Live is often distributed together with another PUA called Protect My Search App.

What is Easy Games Tab?

Easy Games Tab is a typical browser hijacker, which promotes a fake search engine by changing certain browser settings to easygamestab.com. Commonly, browser hijackers also collect data. Note that many users download and install browser hijackers inadvertently, and therefore apps of this type are categorized as potentially unwanted applications (PUAs).

What is How To Watch?

How To Watch is a rogue application advertised as a tool for easy access to movie and TV streaming services. It is classified as a browser hijacker, due to the modifications it makes to browsers to promote hhowtowatch.live (a bogus search engine). This app also tracks and collects information relating to browsing activity.

Due to the dubious methods used to proliferate How To Watch, it is classified as a Potentially Unwanted Application (PUA). Additionally, How To Watch is often distributed with Hide My History, another PUA.

What is VentureSprint?

VentureSprint is designed not only to display various advertisements but also to promote the address of a fake search engine (by changing browser settings) and the Safe Finder web page (by opening it through akamaihd.net). In this way, VentureSprint operates both as adware and a browser hijacker. 

It is likely that this app will also collect data. Few users download or install apps such as VentureSprint intentionally and, therefore, they are categorized as potentially unwanted applications (PUAs).

What is enerativearea[.]pro?

enerativearea[.]pro is a rogue site similar to oawhaursaith.com, globallyreinvation.com, findyourpleasure3.life and thousands of others. It presents visitors with dubious content and/or redirects to other untrusted, even malicious web pages.

These websites are seldom accessed intentionally - most users are redirected to them by intrusive ads or Potentially Unwanted Applications (PUAs). These apps do not require express user permission to be installed onto systems. PUAs operate by causing redirects, running intrusive ad campaigns and collecting browsing-related information.

What is Trends Finder?

Trends Finder is a browser hijacker which promotes htrendsfinder.net (the address of a fake search engine). Like most apps of this type, it achieves this by modifying certain browser settings.

Apps of this type often collect browsing and/or other data. Many people download and install browser hijackers unintentionally, and therefore they are categorized as potentially unwanted applications (PUAs). Trends Finder is distributed with another PUA called Hide My History.

What is Banks1?

Banks1 is a malicious program belonging to the ransomware category. It is designed to encrypt the data of infected systems in order to demand payment for decryption tools/software. During the encryption process, files are renamed following this pattern: original filename, unique ID assigned to the victim, cyber criminals' email address and the ".banks1" extension.

For example, a file like "1.jpg" would appear as something similar to "1.jpg.id-1E857D00.[jerjis@tuta.io].banks1" after encryption, and so on for all affected files. Once this process is complete, ransom messages in "info.hta" and "ReadMe.txt" files are created on the desktop.