Virus and Spyware Removal Guides, uninstall instructions

What kind of malware is Pegasus?

Pegasus is the name of a malicious program within the spyware classification. It targets Android operating systems and can perform various commands and extract a broad range of information.

Pegasus is a highly sophisticated program developed by the Israeli cyber-arms company called NSO Group. This spyware is licensed to various governmental agencies worldwide, which has resulted in it being used for cyber-espionage against targets of interest, such as politicians, activists, journalists, and so on.

What kind of website is hiltus[.]click?

While examining hiltus[.]click, we found that this page runs various scams (shows deceptive messages) and asks for permission to show notifications. This page cannot be trusted. Typically, users do not visit such sites on purpose. Our team discovered hiltus[.]click while inspecting pages that use shady advertising networks.

What kind of application is One Click Image Downloader?

While inspecting the One Click Image Downloader application, we found that it is an advertising-supported browser extension. Apps of this type display unwanted advertisements. We discovered at least two deceptive websites promoting One Click Image Downloader.

What is Video Player Plus?

While checking out suspicious sites, we discovered one promoting the Video Player Plus browser extension. It is presented as a tool that enables users to easily download videos in multiple formats. However, after inspecting Video Player Plus – we determined that it is advertising-supported software (adware).

What is Link Locator?

While inspecting suspicious websites, our researchers discovered the Link Locator browser extension. It is promoted as a tool capable of displaying all links associated with a website in its interface. After analyzing this piece of software, we determined that it operates as adware.

What is Seiv ransomware?

Seiv is a ransomware-type program. It operates by encrypting data in order to demand ransoms for the decryption. On our testing system, this ransomware appended the filenames of encrypted files with a ".seiv" extension. For example, a file originally named "1.jpg" appeared as "1.jpg.seiv", "2.png" as "2.png.seiv", etc. Afterward, Seiv changed the desktop wallpaper and created a text file titled "read_me_seiv.txt", both containing ransom notes.

What kind of page is broadmaster[.]top?

Our research team discovered the broadmaster[.]top rogue webpage during a routine investigation of questionable websites. This page aims to trick visitors into allowing it to deliver spam browser notifications. At the time of research, it did so by using fake CAPTCHA verification.

Users typically access sites like broadmaster[.]top through redirects caused by pages that use rogue advertising networks. However, they can also be entered via spam notifications, intrusive ads, mistyped URLs, or force-opened by installed adware.

What kind of website is gazpachuisthree[.]xyz?

We have examined gazpachuisthree[.]xyz and learned that it is a deceptive website that shows fake messages to trick visitors into believing that their computers are infected. Also, gazpachuisthree[.]xyz wants to show notifications. Users do not visit sites like gazpachuisthree[.]xyz willingly.

What is "USPS - Shipment Is Still Pending"?

While analyzing this email, we found that it is a fake letter from USPS created by scammers. Scammers behind it aim to trick recipients into opening a fake login page and entering credentials on it. Emails of this type are called phishing emails.

What kind of malware is Septwolves?

While checking the VirusTotal website for recently submitted samples, we discovered malware dubbed Septwolves. We learned that Septwolves is ransomware designed to encrypt files, append the ".septwolves" extension to filenames, and drop two ransom notes ("RESTORE_FILES_INFO.txt" and "RESTORE_FILES_INFO.hta").

An example of how Septwolves modifies filenames: it renames "1.jpg" to "1.jpg.septwolves", "2.png" to "2.png.septwolves", and so forth.