Virus and Spyware Removal Guides, uninstall instructions

What is trackpackage.world?

trackpackage.world is a fake search engine that is virtually identical to many other websites of this type such as advisurf.com, web-explore.com, and navig-gg.com.

This may seem to be a legitimate search engine (similar to Google, Yahoo, etc.), however, developers promote trackpackage.world using browser-hijacking download/installation set-ups that modify browser settings. This fake search engine collects data relating to users' browsing habits/activity.

What is feed.365-stream.com?

feed.365-stream.com is a fake search engine that is promoted using the 365Stream browser hijacker, a potentially unwanted application (PUA). Developers promote this app that supposedly provides access to the latest movie-related content directly from browsers.

It is categorized as a PUA, since most users install it unintentionally. Furthermore, it promotes a fake search engine and collects browsing-related and other data.

What is pohs2oom.com?

pohs2oom.com is one of many rogue websites (similar or identical to crtatix.com, nicenewsupdate.info, newsupdatesky.info, etc.) that cause redirects to other untrustworthy (potentially malicious) sites. In most cases, users arrive at pohs2oom.com unintentionally - they are redirected to it by potentially unwanted applications (PUAs) that users install inadvertently. PUAs cause redirects, deliver ads, and collect data.

What kind of malware is Lolita?

Lolita (a new version of Scarab) is a computer virus that is designed by cyber criminals and used to encrypt files (lock them), make them unusable and keep them in that state until the ransom is paid. This is a ransomware-type infection that was discovered by Emmanuel_ADC-Soft.

Once a computer is infected with Lolita, all encrypted files are changed so that they cannot be recognized (as in the screenshot below) and extensions are changed to ".lolita". For example, "1.jpg" is renamed to "1.jpg.lolita" after encryption. Lolita also places a ransom message within a text file called "How to restore files.TXT".

What is nextoptim.com?

Similar to loadoages.com, nextoptim.com is a rogue site designed to cause redirects to other untrustworthy (potentially, malicious) websites.

Most users visit nextoptim.com inadvertently - they are redirected by intrusive ads (generated by other dubious sites) or potentially unwanted adware-type programs (PUPs), which infiltrate systems without consent. As well as causing redirects, potentially unwanted programs deliver intrusive ads and monitor web browsing activity.

What is "Amazon Email Virus"?

"Amazon Email Virus" is a spam email campaign (very similar to Standard Chartered bank Email Virus, TNT Email Virus, Thanksgiving Email Virus, and many more) that is used by cyber criminals (scammers) to trick people into opening malicious attachments through a presented link.

This attachment infects computers with the Emotet virus, which is designed to steal personal data and proliferate other computer infections.

What is "Proforma Email Virus"?

"Proforma Email Virus" is a spam email campaign used to proliferate a high-risk trojan called LokiBot. Cyber criminals send deceptive emails to thousands of users. The emails contain messages encouraging users to open an attached file - this results in infiltration of the LokiBot virus.

What is "I'm is very good coder"?

"I'm is very good coder" is a typical spam email campaign used to trick people into paying scammers who threaten to proliferate compromising photos of the recipient. This is just one of many spam campaigns of this type. Note that this is simply a scam and no such embarrassing photo (or video) exists. Ignore the "I'm is very good coder" email and others of this type.

What is "Member of an international hacker group"?

"Member of an international hacker group" is a scam that criminals proliferate through a spam email campaign. Scammers make threats about having obtained compromising videos that will be sent to the recipient's contacts if their ransom demands are not met. This is a typical scam and it should not be trusted or taken seriously.

What is GoodJob24?

GoodJob24 is a ransomware virus discovered by Jakub Kroustek. This computer infection belongs to the Dharma malware family and is designed to encrypt files (data) and keep them unusable until the ransom demands are met. GoodJob24 encrypts (locks) files and renames them by adding the ".myjob" extension.

For example, "1.jpg" might become "1.jpg.id-1E857D00.[goodjob24@foxmail.com].myjob". The added extension includes an ID number and email address. GoodJob24 also creates a ransom message within a text file called "FILES ENCRYPTED.txt" and displays a pop-up window.