Virus and Spyware Removal Guides, uninstall instructions

What kind of malware is Jyos?

During our analysis of malware samples submitted to the VirusTotal page, we came across a type of ransomware dubbed Jyos. Further investigation revealed that Jyos belongs to the Djvu ransomware family. The primary goal of this ransomware is to encrypt files.

Jyos also modifies file names by adding the ".jyos" extension (e.g., it renames "1.jpg" to "1.jpg.jyos", "2.png" to "2.png.jyos", and so forth) and leaves a ransom note in the form of a file named "_readme.txt". It is important to mention that Jyos may be distributed alongside information stealers like Vidar or RedLine.

What is Robo Tab?

While testing Robo Tab, our team discovered that this browser extension operates as a browser hijacker. The purpose of Robo Tab is to promote search.robo-tab.com (a fake search engine) by changing the settings of a web browser. Additionally, it may gather various data. Thus, it is advisable not to trust Robo Tab app.

What kind of application is Beach Browser?

While examining Beach Browser, we discovered that it is a browser extension designed to promote a shady search engine (search.beach-browser.com). Beach Browser promotes search.beach-browser.com by hijacking a web browser (by changing its settings). Users should not trust this application.

What kind of software is Online Video Platforms?

Our research team found the Online Video Platforms browser extension while investigating suspicious sites. It is promoted as an easy-access tool to popular online platforms. However, our inspection of this piece of software revealed that it is a browser hijacker. Online Video Platforms operates by modifying browsers to cause redirects to the search.online-video-platforms.com fake search engine.

What kind of software is Cosmic?

Our researchers discovered the Cosmic browser extension while inspecting untrustworthy websites. After investigating this extension, we determined that it is a browser hijacker. Cosmic makes alterations to browser settings in order to promote the search.cosmic-tab.com fake search engine.

What kind of email is "Max-Lotto"?

Our inspection of the "Max-Lotto" email revealed that it is a phishing scam. This spam letter states that the recipient has been selected as the "Max-Lotto" lottery winner. These false claims are used to trick users into disclosing their personally identifiable information.

It must be stressed that this spam mail is in no way associated with the actual Lotto Max Canadian lottery.

What kind of page is authenticpcedge[.]com?

Authenticpcedge[.]com is a rogue page that our researchers discovered while investigating suspicious sites. It is designed to promote deceptive content and push browser notification spam. Authenticpcedge[.]com can also redirect visitors to other (likely unreliable/dangerous) webpages.

Users typically access such websites through redirects caused by pages that employ rogue advertising networks.

What is My Weather?

My Weather is a browser extension that promises easy access to weather forecasts. After inspecting this piece of software, we determined that it operates as a browser hijacker.

My Weather modifies browser settings to promote (via redirects) the search.bestweatherextension.com fake search engine. Additionally, this extension spies on users' browsing activity.

What kind of page is linkforcaptcha[.]top?

During our examination of pages that use rogue advertising networks, we came across linkforcaptcha[.]top. This website uses a clickbait technique to deceive visitors into consenting to receive notifications. Moreover, linkforcaptcha[.]top may redirect visitors to other untrustworthy sites. Therefore, it is advisable not to trust or visit this page.

What is @BLOCKED ransomware?

While investigating new submissions to VirusTotal, our researchers discovered the @BLOCKED ransomware. This malicious program encrypts data and demands ransoms for its decryption.

Once we launched a sample of this ransomware on our testing system, it began encrypting files and appended their titles with a ".[random_string]@BLOCKED" extension. For example, a filename like "1.jpg" appeared as "1.jpg.i34ot23@BLOCKED" following encryption. Afterward, a ransom note named "[random_string].txt" was created.