Virus and Spyware Removal Guides, uninstall instructions

What is mob1ledev1ces[.]com?

the mob1ledev1ces[.]com site is designed to download a .dmg file, a fake installation setup disguised as an Adobe Flash Player installer. Typically, fake Adobe Flash Player installers and updaters are designed to distribute potentially unwanted applications (PUAs) such as browser hijackers, adware, and other software of this kind.

Note that people do not usually visit sites such as mob1ledev1ces[.]com intentionally - in most cases, they are opened by a potentially unwanted program (PUA) that is already installed on the browser or operating system.

What is FlowAds?

FlowAds is adware, which is endorsed to enhance the browsing experience. It is supposedly capable of providing additional and improved search results, however, it actually runs intrusive advertisement campaigns, which significantly diminish the browsing experience.

Furthermore, it possess data tracking capabilities. Most users install FlowAds inadvertently, and therefore it is also classified as a Potentially Unwanted Application (PUA).

What is mkob.xyz?

mkob.xyz is the address of a fake search engine. Typically, fake search engines are promoted through browser hijackers, potentially unwanted applications (PUAs) that change certain browser settings. Note that mkob.xyz is promoted through a PUA called CERX, however, other apps (such as APP) can also be used. CERX is related to another app of this type called QIP.

Note that browser hijackers change settings within browsers and gather browsing data. Frequently, people download and install these apps inadvertently.

What is Mkos?

Mkos is malicious software belonging to the Stop/Djvu ransomware family. It operates by encrypting data and demanding ransom payments for decryption.

During the encryption process, all filenames are appended with the ".mkos" extension. For example, "1.jpg" appears as "1.jpg.mkos", and so on for all compromised files. Once this process is complete, a text file named "_readme.txt" is stored on the victim's desktop.

What is RedRum?

RedRum encrypts files, rendering them inaccessible unless victims recover them with decryption software and keys that can purchased from the cyber criminals who designed this ransomware. RedRum renames all encrypted files by adding the victim's ID and moncler@tutamail.com email address to their filenames and appending the ".redrum" extension.

For example, "1.jpg" might be changed to "1.jpg.id-1E857D00. [Moncler@tutamail.com] .redrum" or similar (updated variants append ".thanos" and ".grinch" extensions). It also stores ransom messages in the form of text files (named "decryption.txt") in all folders that contain encrypted files.

What is Chch?

Discovered by GrujaRS, Chch is a ransomware infection. This malicious software is designed to encrypt data and demand ransom payments for decryption tools/software.

When Chch encrypts, all affected files are renamed with the ".chch" extension. For example, "1.jpg" would appear as "1.jpg.chch" following encryption. After this process is complete, a text file ("READ_ME.TXT") is stored on the desktop. This file contains the ransom message.

What is preciseeditor[.]pw?

preciseeditor[.]pw is a deceptive website designed to trick people into installing unwanted software through a fake Adobe Flash Player updater. Its setup contains MyCouponsmart adware, the SearchMine browser hijacker and a rogue application called Mac Cleanup Pro.

Both of these apps are categorized as potentially unwanted applications (PUAs), since people usually do not download or install software of this kind intentionally. We strongly advise against trusting pages such as preciseeditor[.]pw or downloading software from them.

What is Bobelectron?

Discovered by dnwls0719, Bobelectron is a malicious program classified as ransomware. This malware is designed to encrypt the data of infected devices. Cyber criminals behind the infection demand ransom payments for decryption of files. When Bobelectron encrypts, all files are renamed with the ".bobelectron" extension.

Therefore, "1.jpg" would appear as "1.jpg.bobelectron", and so on for all compromised files. Following this process, an HTML file ("How_to_open_files.html") is created on the desktop.

What is AreaProduct?

AreaProduct is a potentially unwanted application (PUA), which is classified as adware. Generally, these apps serve various advertisements and collect browsing data. Few people download or install apps such as AreaProduct intentionally - another reason why they are classified as PUAs.

What is Nbes?

Belonging to the Stop/Djvu ransomware family, Nbes is malicious software designed to encrypt data and demand ransom payments for decryption.

During the encryption process, all compromised files are appended with the ".nbes" extension. Therefore, "1.jpg" would appear as "1.jpg.nbes", and so on. Once this process is finished, Nbes stores a text file ("_readme.txt") containing the ransom message on the victim's desktop.