Virus and Spyware Removal Guides, uninstall instructions

What is "PRIZE EMAIL"?

"PRIZE EMAIL" is a scam run by deceptive websites. It claims that users' emails have been selected as participants in a prize promotion, and therefore they have won certain prizes. In fact, the scam operates by tricking users into making monetary transactions, which are supposedly necessary to receive these fake prizes.

Most visitors to deceptive/scam sites enter them inadvertently - they are redirected by intrusive advertisements or Potentially Unwanted Applications (PUAs) already infiltrated into the system. Note that PUAs do not need express permission to be installed onto devices.

What is Hets?

Hets is malicious software belonging to the Stop/Djvu ransomware family. Devices infected with this malware have their data encrypted and the cyber criminals behind this infection demand ransom payments for decryption. When it encrypts files, the program renames them with the ".hets" extension.

For example, "1.jpg" appears as "1.jpg.hets", and so on for all compromised files. Once this process is complete, a text file named "_readme.txt" is created on the desktop.

What is "Microsoft Protected Your Computer"?

"Microsoft Protected Your Computer" is a notification that is displayed on the website of a technical support scam. This web page is disguised as an official Windows Support website, however, Microsoft has nothing do to with it.

The main purpose of this scam is to trick people into calling scammers who seek to extort money from unsuspecting people. We strongly recommend that you ignore this scam and do not call the number provided.

What is essaemiaaut[.]com?

Similar to newsredirect.net, giantttraffic.com, ewaglongoo.com, and thousands of others, essaemiaaut[.]com is a rogue website. It operates by presenting dubious content and/or redirects visitors to other untrustworthy web pages.

Most users enter these sites unintentionally when they are redirected by intrusive ads or Potentially Unwanted Applications (PUAs) already infiltrated into the system. These apps do not need explicit user permission to be installed onto devices. PUAs generate redirects, run intrusive ad campaigns, and record browsing-related information.

What is BigBossRoss?

BigBossRoss is a new variant of Garrantydecrypt ransomware. It is designed to prevent victims from accessing their files by encryption. In order to decrypt files, victims are forced to purchase a decryption tool from the cyber criminals who designed this ransomware.

BigBossRoss appends the ".bigbossross" extension to filenames of all encrypted files. For example, "1.jpg" becomes "1.jpg.bigbossross". It also creates the "#Decryption#.txt" file, which contains instructions about how to contact the developers of BigBossRoss ransomware.

What is MT88?

MT88 is a malicious program belonging to the Matrix ransomware family. It is designed to encrypt data and demand ransom payments for decryption. During the encryption process, affected files are renamed using the following pattern: "[MarkTrue88@protonmail.com].[random_string].MT88".

For example, following encryption, "1.jpg" might appear as something similar to "[MarkTrue88@protonmail.com].4j03ZPDY-IOlEpJJV.MT88", and so on.

After this process is finished, MT88 stores a ransom message ("!MT88_README!.rtf") in each existing folder and five additional files on the victim's desktop. The five desktop files are: "log.txt", "LFIN_[random_string].txt", "bad_[random_string].txt", "[random_string].exe", and "ALL_dmpfl.fldp".

What is Msop?

Msop is malicious software belonging to the Stop/Djvu ransomware family. It is designed to encrypt data and demand ransom payments for decryption. When it encrypts data, all affected files are appended with the ".msop" extension. Therefore, "1.jpg" becomes "1.jpg.msop", and so on for all compromised files.

After this process is complete, a text file ("_readme.txt") is stored on the desktop.

What is newsredirect[.]net?

newsredirect[.]net is an untrusted website. If opened, it loads dubious content or redirects visitors to other untrustworthy sites. Most people arrive at web pages such as newsredirect[.]net inadvertently, since they are redirected to them by potentially unwanted applications (PUAs) installed on their browsers and/or operating systems.

These apps are classed as PUAs, since few people download or install them intentionally. Furthermore, they usually record browsing data and display intrusive ads. Other examples of web pages similar to newsredirect[.]net are giantttraffic[.]com, localmylife[.]info, and ewaglongoo[.]com.

What is All Day Forecast?

All Day Forecast is a browser hijacker, endorsed as a tool for quick access to weather forecasts. It operates by modifying browsers to promote a fake search engine (search.halldayforecast.com).

Furthermore, this rogue application also possesses data tracking capabilities, which it employs to monitor users' browsing activity. Most users install All Day Forecast inadvertently, and therefore it is additionally categorized as a Potentially Unwanted Application (PUA).

What is Mapo?

Mapo is a new variant of another ransomware infection called Outsider. Like most programs of this type, it encrypts data, changes extensions of encrypted files, and creates a ransom message. It appends the ".mapo" extension to the filename of each encrypted file.

For example, "1.jpg" becomes "1.jpg.mapo", and so on. It also creates "MAPO-README.txt" containing the ransom message. Cyber criminals use Mapo to extort money from victims by leaving them with no other choice than to pay a ransom.