Virus and Spyware Removal Guides, uninstall instructions

What is Full System Care?

Full System Care is advertised as software that cleans, optimizes, and improves computer performance. In fact, this program is distributed through the download and/or installation set-ups of other programs. People often download and install software of this type unintentionally. Therefore, Full System Care is categorized as a potentially unwanted application (PUA).

What is "HARASSMENT COMPLAINT" email scam?

"HARASSMENT COMPLAINT" is an email scam designed to proliferate TrickBot trojan-type malicious software. This scam employs social engineering (scare tactics) to trick users into opening the attached file, consequently infecting the system with TrickBot. The user's personal details (such as name, workplace, etc.) are used in an attempt to give the impression of legitimacy.

The email is allegedly from the U.S. Equal Employment Opportunity Commission, claiming that the addressee (individual, to whom the letter is intended) is the subject in a filed sexual harassment complaint. Spam campaigns used to send scam/deceptive emails such as this often disguise the messages as "official", "important", and similar priority mail.

Note that they often contain spelling errors and other inconsistencies, which ease their identification as fraudulent mail. You are expressly advised against opening suspicious and/or irrelevant emails. Attachments and links found within them must never be opened, as they are the source of potential system infections.

What is robotornotcheckonline[.]club?

robotornotcheckonline[.]club is similar to many other rogue websites including, for example, pushstack[.]co, readmenewz[.]com, and rednews7[.]com. Visitors to these sites are all provided with dubious content or redirected to other untrustworthy websites.

Generally, they do not visit websites such as robotornotcheckonline[.]club intentionally - browsers open them due to installed potentially unwanted applications (PUAs). These apps are designed to gather information about people and feed them with intrusive ads.

What is reforeperc[.]pro?

reforeperc[.]pro is one of many rogue websites that, if visited, redirects visitors to other web pages of this kind or presents dubious content. Some examples of other websites similar to reforeperc[.]pro include asonsbirthi[.]pro, pushstack[.]co, and readmenewz[.]com.

Typically, browsers open these sites when potentially unwanted applications (PUAs) are installed on browsers and/or operating systems. I.e., people do not open them intentionally. Apps categorized as PUAs display advertisements and collect information relating to web browsing activity.

What is Mespinoza?

Discovered by GrujaRS, Mespinoza is malicious software that encrypts data and blocks access to it unless a ransom is paid. Programs of this type are classified as ransomware. Mespinoza adds the ".locked" extension to each encrypted file. For example, "1.jpg" becomes "1.jpg.locked", and so on. It also creates a ransom message within the "Readme.README" file.

What is Sun?

Discovered by Michael Gillespie, Sun is malicious software categorized as ransomware. This infection performs data encryption and makes ransom demands (i.e., payment for decryption tools/software). When Sun encrypts data, all files are appended with the ".sun" extension.

For example, "1.jpg" becomes "1.jpg.sun", and so on for all affected files. After this process is complete, an HTML file ("DECRYPT_INFORMATION.html") is stored in each affected folder.

What is Kr?

Discovered by Jakub Kroustek, Kr ransomware is part of Dharma, a family of ransomware-type programs. Ransomware is a type of malicious software that makes files inaccessible by encrypting them. To use regain access to their files, victims of ransomware attacks are encouraged to pay ransoms.

Kr renames all encrypted files by adding the victim's ID, email address, and ".kr" extension to filenames.

For example, "sample.jpg" might be renamed to a filename such as "sample.jpg.id-1E857D00.[blablacar@airmail.cc].kr", and so on. Instructions about how to pay the ransom and contact cyber criminals are provided in a pop-up window and the "FILES ENCRYPTED.txt" file.

What is "yourfine4updatesset[.]best"?

yourfine4updatesset[.]best is a scam website, which operates by alerting users that the Adobe Flash Player is outdated and requires updating. The updater offered by yourfine4updatesset[.]best is bogus. At the time of research, it installed the Mac Cleanup Pro Potentially Unwanted Application (PUA), rather than the promised updates.

Content endorsed and/or proliferated by these deceptive sites is often rogue and nonoperational. Therefore, do not trust yourfine4updatesset[.]best or similar sites. These web pages are rarely opened intentionally, since most visitors are redirected to them by intrusive ads or PUAs already present on the system.

What is notube[.]net?

notube[.]net is presented as the best free and fast YouTube downloader and converter. Note, however, that it is illegal to download videos from YouTube. Another reason not to use the notube[.]net video downloading service is that this web page uses rogue advertising networks. Therefore, people who use it are redirected to other untrustworthy websites.

What is "Ministry of Justice Email Virus"?

"Ministry of Justice Email Virus" is a spam campaign employed to trick users into downloading/installing Predator The Thief malware. The scare tactics employed by this scam urge users into investigating the web link detailed within the email, thereby leading them through certain actions resulting in a system infection.

The term "spam campaign" refers to mass sending of deceptive/scam emails, typically containing infectious attachments or links redirecting to them. This mail is usually disguised as "important", "urgent", "official" or similar. You are strongly advised against opening suspicious or irrelevant emails.

Furthermore, do not open any attached files or web-links found in these messages. Read our article about phishing campaigns that summoner recipients to court, which is also related to "Ministry of Justice Email Virus".