Virus and Spyware Removal Guides, uninstall instructions

What is Orion?

Orion is the name of malicious software classified as ransomware. Like most programs of this type, Orion blocks access to files stored on the system by encryption until a ransom is paid. It also renames all encrypted files by adding the ".orion" extension plus a random string of numbers and an email address to the filename.

For example, "1.jpg" might be renamed to a filename such as "1.jpg.15061104651492.foxnitro@tutanota.com.orion". Orion also generates a ransom message within a text file called "READ_ME.txt".

What is Quick Email Login?

Quick Email Login is a deceptive application similar to My Email Fast, Easy Speed Tracker, Get Coupons For Free, and many others. By offering easy access the email service provider, Quick Email Login attempts to give the impression of legitimacy, however, this application is categorized as a potentially unwanted application (PUA) and a browser hijacker.

There are three main reasons for these negative associations: 1) stealth installation without users' consent; 2) tracking of browsing activity; 3) modification of browser settings.

What is DriverFixer?

Developers present DriverFixer as a program that updates and maintains computer drivers with innovative real-time scanning technology and provides instant optimization for system components and peripherals.

Despite these claims, do not trust this software, since the developers promote it using deception - they bundle it into set-ups of other software. Therefore, many people are likely to install this app unintentionally.

What is Watch Your TV Shows Now?

Watch Your TV Shows Now is a potentially unwanted application (PUA), a browser hijacker that changes settings and collects data relating to users' browsing activities. This app supposedly allows people to search for various TV shows and other content directly from a new browser tab. In fact, its main purpose is to promote search.hwatchyourtvshowsnow.com

What is [LOCKED]?

[LOCKED] ransomware was discovered by Michael Gillespie. This malicious program is designed to block access to files stored on a computer by encrypting them. To decrypt their files, victims are encouraged to buy a decryption tool. Like most programs of this type, [LOCKED] renames all encrypted files, in this case, by adding the " [LOCKED]" string to the filename.

For example, "1.jpg" becomes "1.jpg [LOCKED]". Instructions about how to unlock files can be found in a text file called "UNLOCK INSTRUCTIONS.txt".

What is 292news[.]biz?

Similar to ughitilagu.info, newsmagic.net, knowwoow.com, and many others, 292news[.]biz is a rogue website designed to feed visitors with dubious content and redirect them to other dubious sites.

Most visitors arrive at 292news[.]biz inadvertently - they are redirected by potentially unwanted applications (PUAs) or intrusive advertisements delivered by other rogue sites. PUAs usually infiltrate systems without users' consent and, as well as causing redirects, deliver intrusive advertisements and gather information.

What kind of malware is 0day?

Discovered by Jakub Kroustek, 0day is another ransomware-type infection that belongs to the Dharma family. Once infiltrated, 0day encrypts stored data using RSA-1024 cryptography and appends filenames with the ".0day" extension plus the developer's email address and victim's unique ID. Another variant of this ransomware appends ".0day0" extension.

For example, "sample.jpg" might be renamed to a filename such as "sample.jpg.id-1E857D00.[my0day@aol.com].0day". Encrypted data immediately becomes unusable. After successful encryption, 0day stores the "RETURN FILES.txt" text file on the desktop and opens a pop-up window.

What is HACK?

Discovered by Jakub Kroustek and belonging to the Dharma ransomware family, HACK is a malicious program that is classified as ransomware. HACK's main objective is to encrypt data within files and prevent victims from accessing them. To decrypt their files, victims are encouraged to pay a ransom.

This ransomware renames each encrypted file by adding ".id-1E857D00.[mr.hacker@tutanota.com].HACK" to the filenames. For example, "1.jpg" becomes "1.jpg.id-1E857D00.[mr.hacker@tutanota.com].HACK". It also displays a pop-up window and creates a ransom message within the "RETURN FILES.txt" text file.

What is markably[.]info?

markably[.]info is a rogue website that shares similarities with ughitilagu.info, videosp.pro, feedmedia.me, and dozens of other similar sites. Once opened, markably[.]info delivers dubious content and/or redirects users to other rogue sites.

Visitors often arrive at this site inadvertently - they are redirected by potentially unwanted applications (PUAs) or intrusive advertisements displayed on other dubious websites. In addition, PUAs typically infiltrate computers without permission. As well as causing redirects, they deliver intrusive advertisements and gather information relating to browsing activity.

What is My Email Fast?

Developers advertise My Email Fast as an app that allows people to access various email accounts (such as Gmail, Yahoo Mail, Outlook, and Hotmail) from the new browser tab. In fact, this is a potentially unwanted application (PUA) and a browser hijacker. Developers promote My Email Fast by including it into set-ups of other software.

The app changes browser settings, thereby promoting a fake search engine (search.hmyemailfast.com or search.hmyemailfast.net). Furthermore, PUAs often gather browsing-related information.