Virus and Spyware Removal Guides, uninstall instructions

What kind of malware is Nury?

Nury is the name of Djvu ransomware variant that our malware researchers discovered while checking the VirusTotal website for recently submitted samples. We found that Nury ransomware encrypts files and modifies filenames by appending ".nury" as their new extension. Also, it creates a text file ("_readme.txt") that contains a ransom note.

An example of how Nury ransomware renames files: it renames "1.jpg" to "1.jpg.nury", "2.png" to "2.png.nury", and so forth. An important detail about Djvu ransomware is that threat actors often distribute it alongside information stealers like RedLine and Vidar.

What kind of malware is Nuis?

Nuis is the name of a Djvu ransomware variant that encrypts files to make them inaccessible. Like any other ransomware, Nuis is used to extort money from victims. In addition to encrypting files, Nuis appends the ".nuis" extension to filenames and generates a text file named "_readme.txt" that contains a ransom note.

An example of how Nuis modifies filenames: it renames "1.jpg" to "1.jpg.nuis", "2.png" to "2.png.nuis", "3.exe" to "3.exe.nuis", and so forth. Our team discovered this Djvu ransomware while inspecting malware samples submitted to VirusTotal.

It is known that Djvu ransomware is often distributed alongside information stealers (e.g., Vidar, RedLine). In these cases, threat actors steal sensitive information before encrypting files.

What kind of page is nadsfit[.]com?

We examined nadsfit[.]com and learned that it displays deceptive content to trick visitors into granting it permission to show notifications. It uses a clickbait technique as a lure. Also, nadsfit[.]com redirects visitors to other pages of this type. Thus, it is highly advisable not to trust nadsfit[.]com.

What kind of page is riaeqd[.]com?

During a routine inspection of suspicious websites, our research team discovered the riaeqd[.]com rogue page. It is designed to promote browser notification spam and cause redirects to different (likely untrustworthy/harmful) sites. Most users enter webpages like riaeqd[.]com via redirects caused by sites using rogue advertising networks.

What kind of page is conatysystems[.]com?

Our researchers discovered the conatysystems[.]com rogue page during a routine inspection of dubious websites. It operates by promoting browser notification spam and redirecting visitors to different (likely unreliable/dangerous) sites. Users typically access webpages of this kind through redirects caused by sites that use rogue advertising networks.

What kind of email is "Account Termination Request"?

Our analysis of the "Account Termination Request" email revealed that it is spam that operates as a phishing scam. This letter claims that the recipient's email account will be terminated per their request. This mail attempts to lure users into disclosing their email account log-in credentials through the fake termination cancellation process.

What kind of page is myshinyinc[.]com?

Our research team discovered the myshinyinc[.]com rogue page while inspecting suspect websites. Myshinyinc[.]com is yet another browser notification spam promoting site. Additionally, it can redirect visitors to other (likely untrustworthy or malicious) websites.

Users typically access webpages akin to myshinyinc[.]com through redirects caused by sites that employ rogue advertising networks.

What kind of page is tractsupport[.]com?

Tractsupport[.]com is a rogue site that we discovered while inspecting untrustworthy webpages. It attempts to deceive visitors into enabling browser notification spam delivery. Furthermore, tractsupport[.]com can redirect users to other (likely unreliable/malicious) sites.

Most visitors to such pages enter them via redirects caused by websites using rogue advertising networks.

What kind of page is wreddismorce[.]com?

While investigating wreddismorce[.]com, we found that it is a deceptive website designed to trick visitors into allowing it to deliver notifications. Additionally, it may redirect visitors to other websites of this kind. Our team discovered wreddismorce[.]com while examining ads on shady pages and sites that use rogue advertising networks.

What kind of page is tpnwslndgm[.]com?

Our researchers discovered the tpnwslndgm[.]com rogue webpage during a routine investigation of questionable sites. It promotes browser notification spam. Additionally, tpnwslndgm[.]com can redirect visitors to other (likely untrustworthy or dangerous) websites. Users typically access pages of this kind via others that use rogue advertising networks.