Virus and Spyware Removal Guides, uninstall instructions

What is Osiris?

Osiris is an updated variant of a high-risk trojan called Kronos. This malware records various personal information and modifies the content of visited websites. The presence of this infection on your system can lead to many issues.

What is "CRITICAL WARNING!"?

Discovered by Michael Gillespie, "CRITICAL WARNING!" is a fake security warning categorized as a tech-support scam. Its main purpose is to trick people into contacting scammers via the telephone number provided. This scam is displayed in full-screen mode, and thus cannot be closed in the normal way.

It can, however, be closed by entering a product key within a text (see below). We strongly recommend that you do not trust this scam or contact the scammers who designed it.

What is MacSecurityPlus?

MacSecurityPlus is an adware-type application that people usually download and install unintentionally. Once installed, it tracks (records) users' browsing activity and displays various pop-ups ads. It also prevents users from closing the Safari and Google Chrome browsers - it reopens them when they are closed. We strongly recommend that you uninstall this application immediately.

What is newchannel[.]club?

The newchannel[.]club website is virtually identical to hatnofort[.]com, terjuscalbuttont[.]info, ninghimpartidi[.]info and many others of this type.

When opened, it displays dubious content or causes redirects to other untrustworthy sites. Typically, people are redirected to newchannel[.]club by potentially unwanted apps (PUAs) that are installed on their browsers and they do not generally visit the site intentionally. PUAs collect data and serve users with advertisements.

What is "Hard Drive Safety Delete"?

"Hard Drive Safety Delete" is a tech-support scam promoted via a deceptive, untrustworthy website. The main purpose of these scam pages is to trick people into calling scammers who then try to extort money by offering purchase of dubious software or use of paid technical services.

Websites of this type cannot be trusted. They are often opened by potentially unwanted applications (PUAs) installed on the system. In addition to redirects, PUAs feed users with ads and gather browsing-related data.

What is Phoenix-Phobos?

First discovered by GrujaRS and belonging to the Phobos ransomware family, Phoenix-Phobos is high-risk ransomware designed to encrypt data and make ransom demands. During encryption, Phoenix-Phobos renames each file by appending the filenames with the ".phoenix" extension plus the victim's unique ID and developer's email address.

For example, "sample.jpg" might be renamed to a filename such as "sample.jpg.id[1E857D00-0001].[absonkaine@aol.com].phoenix". Updated variants of Phoenix-Phobos ransomware use ".[britt.looper@aol.com].phoenix" extension for encrypted files. In addition, Phoenix-Phobos places the "info.hta" (which is also opened) and "info.txt" files on the desktop.

What is hatnofort[.]com?

The natnofort[.]com website operates in a very similar manner to other pages of this type such as arberittertwa[.]info, vercallactont[.]com, and butitereventwil[.]info. When opened, it causes redirects to other rogue sites or simply displays dubious content.

People do not generally arrive at this site intentionally - mostly this is due to potentially unwanted applications (PUAs) installed on their browsers. PUAs usually cause unwanted redirects, serve users with ads, and collect data.

What is Moresa?

Discovered by Michael Gillespie and belonging to the Djvu ransomware family, Moresa is a malicious program categorized as ransomware. Typically, cyber criminals use programs of this type to encrypt data and prevent victims from accessing their files unless a ransom is paid (decryption tool is purchased).

Moresa changes names of all encrypted files by adding the ".moresa" extension. For example, "1.jpg" becomes "1.jpg.moresa". It also creates a ransom message within the "READ_ME.txt" file, which it places in every folder that contains encrypted files.

What is Norvas?

First discovered by malware researcher Petrovic, Norvas is yet another ransomware-type virus belonging to the Djvu malware family.

As with other infections of this type, Norvas encrypts most stored files (thereby rendering them unusable) and appends filenames with an extension (in this case, ".norvas"). For example, "sample.jpg" is renamed to "sample.jpg.norvas". A text file ("_readme.txt") is then created and placed in every existing folder.

What is "apple.com-fast[.]live"?

apple.com-fast[.]live (www.apple.com-fasting.live or www.apple.com-faster.live) is a scam website that should not be trusted. Its purpose is to trick people into downloading and installing the CleanupMy-Mac potentially unwanted app (PUA).

To achieve this, scammers designed apple.com-fast[.]live to show fake notifications about 'detected' viruses that should be removed immediately using the aforementioned application. Websites of this type and apps promoted by them cannot be trusted.

Typically, people do not open these websites intentionally. Unwanted redirects are often responsible and are caused by installed PUAs, which also feed people with unwanted ads and gather information.