Virus and Spyware Removal Guides, uninstall instructions

What is Kjh?

First discovered by Jakub Kroustek, Kjh is high-risk ransomware belonging to the Dharma ransomware family. Immediately after infiltration, Kjh encrypts most stored data, thereby rendering files unusable. Additionally, Kjh appends filenames with the ".kjh" extension plus the victim's unique ID and developer's email address.

For example, "sample.jpg" might be renamed to a filename such as "sample.jpg.id-1E857D00.[datareturn@protonmail.com].kjh". Kjh then opens a pop-up window and stores the "RETURN FILES.txt" text file on the desktop.

What is "Windows Online Protection has detected spyware"?

"Windows Online Protection has detected spyware" is a scam designed to trick people into installing a fake antivirus tool called Live Protection Suite.

This program is promoted by displaying fake virus detections on a deceptive website. In summary, this scam website informs visitors that it has detected viruses (spyware, trojans, etc.) on computers and encourages them to remove the issues by installing Live Protection Suite. Do not trust this scam web page or the program that is promoted through it.

What is Muslat?

First discovered by malware security researcher, Michael Gillespie, Muslat is one of many ransomware-type infections that belongs to the Djvu family. Following successful encryption, Muslat encrypts most stored data and renames filenames with the ".muslat" extension (e.g., "sample.jpg" becomes "sample.jpg.muslat"). Once encrypted, data immediately becomes unusable.

Additionally, Muslat creates a text file ("_readme.txt") and stores a copy in every existing folder.

What is Zoh?

First discovered by Jakub Kroustek and belonging to the Dharma family, Zoh is high-risk ransomware which stealthily infiltrates systems and encrypts most stored data by compromising files. During encryption, Zoh appends filenames with the victim's unique ID, developer's email address and .zoh extension.

For instance, "sample.jpg" might be renamed to a filename such as "sample.jpg.id-1E857D00.[restdoc@protonmail.com].zoh". Once encrypted, data immediately becomes unusable. After successfully encrypting data, Zoh opens a pop-up window and stores the "RETURN FILES.txt" text file on the desktop.

What is "Youtube Lottery Email Scam"?

"Youtube Lottery" Email Scam (Mac) is used to trick people into believing that they have won a YouTube lottery. The main goal of this scam is to encourage recipients to send their full names, addresses, mobile telephone numbers, and other information to scammers.

Since this is merely a scam and YouTube has nothing to do with it, we recommend that you ignore "Youtube Lottery". Do not send any details whatsoever to these scammers.

What kind of page is robotcaptcha.info?

Robotcaptcha.info is a rogue website very similar to pushnotificationsite[.]com, pushnotificationapp[.]com, digitalsmirror[.]com, and many others. It is designed to lead visitors to other untrustworthy sites. Typically, people do not visit robotcaptcha.info willingly - they are redirected by potentially unwanted applications (PUAs). 

Generally, people are unaware that they have PUAs installed. Once installed, however, they deliver intrusive advertisements and collect data relating to users' browsing habits.

What is smartpackagetracker.com?

smartpackagetracker.com is a fake search engine that supposedly enhances the browsing experience by generating improved results. Judging on appearance alone, smartpackagetracker.com may seem legitimate and useful, however, this site is promoted using a browser-hijacking app called Smart Package Tracker, which supposedly allows users to track their package deliveries.

Smart Package Tracker often infiltrates systems without users’ permission and modifies browser options. In addition, Smart Package Tracker and smartpackagetracker.com continually record browsing activity.

What is wscript.exe?

The wscript.exe file belongs to the Microsoft Windows Operating System. Note that wscript.exe is also known as Windows Script, a service that provides the Windows system with scripting abilities. Unfortunately, cyber criminals often use the names of legitimate processes and files to disguise malware. It is possible that the wscript.exe might also be used for this purpose.

What is svchost.exe?

svchost.exe is the generic name of a legitimate Microsoft Windows process that can be found running in the Task Manager. Typically, there is more than one Service Host process running at once, since separate processes handle separate groups of services.

For example, one svchost.exe process might be dealing with services relating to network services, whilst another might be dealing with services relating to remote procedure calls, and so on. In many cases, however, cyber criminals disguise malicious files/processes using names similar to those of legitimate processes.

What is Ghost (Jamper)?

First discovered by malware security researcher, Sandor Nemes, Ghost (Jamper) is new variant of high-risk ransomware called Jamper.

Once infiltrated, Ghost (Jamper) encrypts most stored files and appends filenames with a random string, probably comprising the victim's unique ID (e.g., "sample.jpg" might be renamed to a filename such as "sample.jpg.38254CED-1646-C41E-8E1F-0B8268EE8D").

Following successful encryption, Ghost (Jamper) generates a text file ("===HOW TO RECOVER ENCRYPTED FILES===.TXT") and stores it on the desktop wallpaper. Note that there is another ransomware infection called Ghost, however, it is not related to Ghost (Jamper).