Virus and Spyware Removal Guides, uninstall instructions

What kind of page is aughableleade[.]xyz?

While inspecting untrustworthy websites, we discovered the aughableleade[.]xyz rogue page. It promotes browser notification spam and redirects users to other (likely unreliable/harmful) webpages. Most users access aughableleade[.]xyz and sites akin to it - through redirects caused by webpages using rogue advertising networks.

What is SkyWebProcess?

SkyWebProcess is a rogue application that our researchers found while inspecting new submissions to VirusTotal. After analyzing this app, we determined that SkyWebProcess operates as adware and belongs to the AdLoad malware family.

What is UnitySquad?

Our research team found the UnitySquad application during a routine checkup of new submissions to VirusTotal. After inspecting this app, we learned that it operates as advertising-supported software (adware). Additionally, we determined that UnitySquad belongs to the AdLoad malware family.

What kind of page is watchvideo[.]cc?

While inspecting websites that use rogue advertising networks (and shady ads), we came across watchvideo[.]cc - another untrustworthy page. We learned that watchvideo[.]cc is a website that wants to show notifications (it displays deceptive content to trick visitors into agreeing to receive notifications). Also, it redirects to another untrustworthy site.

What kind of application is text background?

Our team has discovered an adware-type application (a browser extension) called text background during an analysis of deceptive websites. We learned that text background has no real value. The main purpose of this app is to bombard users with intrusive advertisements. Thus, it is recommended not to have the text background app added to a web browser.

What kind of page is advtstudio[.]com?

During a routine inspection of dubious websites, our researchers discovered advtstudio[.]com - yet another rogue page. It promotes browser notification spam and redirects visitors to different (likely untrustworthy/malicious) sites.

Users typically access such websites via redirects caused by pages that use rogue advertising networks, spam notifications, intrusive advertisements, or installed adware.

What kind of page is cardiidae[.]com?

Cardiidae[.]com is one of the many deceptive websites that use clickbait techniques to trick visitors into agreeing to receive notifications. Also, it redirects visitors to deceptive websites. Users do not visit pages cardiidae[.]com intentionally. We found this page while examining other sites (illegal movie streaming, torrent, and similar sites).

What is StormByte ransomware?

While inspecting new submissions to VirusTotal, our researchers discovered the StormByte ransomware. Malware within this classification operates by encrypting files and demanding payment for the decryption. We determined that this malicious program is part of the Nominatus ransomware family.

We executed a sample of StormByte on our test machine, and the malware encrypted its files. Typically, ransomware renames affected files (e.g., appends them with specific extensions) - however, StormByte did not modify the filenames. After this process was completed, a pop-up window containing the ransom note was displayed.

What kind of application is AuroraFit?

While examining shady websites claiming that some installed software is out of date, we discovered an application called AuroraFit. After downloading and installing this app, we learned that it has no useful features and displays annoying advertisements. Thus, we concluded that AuroraFit functions as adware.

What kind of malware is Oori?

Oori is ransomware that belongs to the Djvu ransomware family. Our malware researchers discovered Oori while examining samples submitted to VirusTotal. We found that Oori encrypts files and appends its extension (".oori") to filenames. Also, it drops the "_readme.txt" file on the desktop (this file contains a ransom note).

An example of how files encrypted by Oori ransomware are renamed: "1.jpg" is renamed to "1.jpg.oori", "2.png" to "2.png.oori", "3.exe" to "3.exe.oori", and so forth.