Virus and Spyware Removal Guides, uninstall instructions

What is Zendaya ransomware?

Zendaya is a malicious program belonging to the VoidCrypt ransomware family. Our researchers discovered this program while inspecting new submissions to VirusTotal.

After we executed a sample of Zendaya on our test machine, it encrypted files and changed their filenames. Original titles were appended with a unique ID, the cyber criminals' email address, and a ".Zendaya" extension. For example, a file named "1.jpg" appeared as "1.jpg.(MJ-VY3946857120)(Decryption.helper@aol.com).Zendaya".

Once the encryption process was concluded, this ransomware created identical ransom notes – "Decryption-Guide.HTA" and "Decryption-Guide.txt".

What kind of email is "People's Postcode Lottery"?

After inspecting this "People's Postcode Lottery" email, we determined that it is spam. This phishing scam targets personally identifiable information by claiming to be a notification regarding a win in the People's Postcode Lottery - a legitimate lottery in the United Kingdom. However, this letter is fake and not associated with the actual subscription lottery – hence, it cannot be trusted and must be reported as spam.

What kind of page is batus[.]click?

While examining batus[.]click, our team learned that it runs the "McAfee - Your Card Payment Has Failed!" scam and wants to show notifications. We discovered batus[.]click while inspecting other shady websites that use rogue advertising networks. It is recommended to ignore sites like batus[.]click and never agree to receive notifications from them.

What kind of application is Snetchball?

While analyzing the Snetchball application, we found that it functions as adware - it shows intrusive advertisements. It is common for adware to be promoted and distributed using shady methods. We discovered Snetchball after downloading a malicious installer from an untrustworthy web page.

What is Split Files?

While inspecting suspicious websites, our researchers found a deceptive page promoting a malicious download assistant. Following installation on our test machine, we learned that it was bundled with a variety of harmful software, including Split Files (alternatively titled Split Files Setup). This application operates as adware and may have additional dangerous functionalities.

What is Library Games?

We have discovered the Library Games application after downloading and using a malicious installer. After testing Library Games, we found that it shows intrusive advertisements. Thus, we classified Library Games as adware. This app runs in the Task Manager as Library Games 1.1.

What kind of malware is Tanki X?

Tanki X is ransomware - malware that blocks access to files by encrypting them. Also, Tanki X appends ".TANKIX" extension to filenames, drops the "READ_ME.txt" file, and displays a pop-up window. Its text file and pop-up window contain a ransom note. An example of how Tanki X renames files: it changes "1.jpg" to "1.jpg.TANKIX", "2.png" to "2.png.TANKIX", and so forth.

What kind of page is desktopanalyticscenter[.]site?

Desktopanalyticscenter[.]site is the address of a rogue page that we discovered while investigating untrustworthy websites. This site runs scams, promotes spam browser notifications, and redirects visitors to different (likely unreliable/harmful) webpages.

Most users access pages like desktopanalyticscenter[.]site through redirects caused by websites that use rogue advertising networks.

What is Page Downloader?

While inspecting suspicious websites, our researchers discovered the Page Downloader browser extension. It is presented as a tool capable of converting webpage content into a single downloadable text file. However, our investigation of Page Downloader revealed that it is adware.

What is Upsilon ransomware?

Our researchers found the Upsilon ransomware-type program while inspecting new submissions to VirusTotal. It operates by encrypting data in order to demand payment for decryption.

On our testing system, Upsilon encrypted files and appended their filenames with a ".upsil0n" extension. For example, a file originally titled "1.jpg" appeared as "1.jpg.upsil0n", "2.png" as "2.png.upsil0n", etc. Afterward, a ransom note ("Upsilon.txt") was created, and the desktop wallpaper was changed.