Virus and Spyware Removal Guides, uninstall instructions

What kind of application is Get colors?

While inspecting a shady website instructing us to add some extension to a browser to continue, we discovered an app called Get colors. After adding it to a browser, we learned that it manipulates the settings of a browser to promote a fake search engine. Get color is a browser hijacker that promotes search-good.com.

What kind of page is news-tecayu[.]cc?

While inspecting dubious websites, our researchers discovered the news-tecayu[.]cc rogue page. It operates by pushing spam browser notifications and redirecting visitors to different (likely untrustworthy/malicious) webpages. Most users enter news-tecayu[.]cc and similar sites through redirects caused by webpages using rogue advertising networks.

What is GenesisOdyssey?

GenesisOdyssey is a piece of rogue software that our research team found while inspecting new submissions to VirusTotal. Our analysis of this app revealed that it operates as adware and belongs to the AdLoad malware family.

What is Helphack ransomware?

Our researchers discovered the Helphack ransomware during a routine inspection of new submissions to VirusTotal. We determined that Helphack is based on the Chaos ransomware.

Once we executed a sample on our test machine, Helphack encrypted files and appended their names with an extension consisting of four random characters. For example, a filename like "1.jpg" appeared as "1.jpg.mz4c", "2.png" as "2.png.wvq7", and so on. Afterwards, a ransom note titled "read_it.txt" was created on the desktop.

What is PixelUnlimited?

Our research team discovered the PixelUnlimited application while inspecting new submissions to VirusTotal. After analyzing it, we determined that PixelUnlimited operates as advertising-supported software (adware) and is part of the AdLoad malware family.

What kind of application is ConnectionInteractive?

ConnectionInteractive is the name of an application our team discovered after using a fake installer downloaded from a deceptive website. During our analysis, we found that ConnectionInteractive is a useless application designed to generate advertisements. Thus, we classified ConnectionInteractive as adware.

What kind of page is jerenga[.]click?

Our team has discovered jerenga[.]click while inspecting various illegal movie streaming, torrent, and other sites. We found that jerenga[.]click runs the "McAfee - Your PC is infected with 5 viruses!" scam. Additionally, this page wants to show untrustworthy notifications.

What kind of malware is Agenda?

Petrovic has recently discovered ransomware called Agenda (also known as Qilin). This malware encrypts files, appends a string of random characters as a file extension, and drops the "[random_string]-RECOVER-README.txt" file (with the same random string in its filename as encrypted files have). The file created by Agenda contains a ransom note.

An example of how Agenda ransomware modifies filenames: it renames "1.jpg" to "1.jpg.OnHnnBvUej", "2.png" to "2.png.OnHnnBvUej", "3.exe" to "3.exe.OnHnnBvUej", and so forth.

What kind of application is CoralMajesty?

While examining shady websites instructing visitors to update the Adobe Flash Player (download a fake installer), we discovered an application called CoralMajesty. After testing the app, we found that it displays advertisements. Software of this type is called advertising-supported software (adware). Typically, users install it inadvertently.

What is AIVARAT?

AIVARAT is a piece of malicious software classified as a RAT (Remote Access Trojan). This program targets Android Operating Systems (OSes). RATs are designed to enable remote access and control over infected machines.

AIVARAT is a multifunctional trojan - hence, it can exert a high level of control over devices and has various information-stealing capabilities. Furthermore, there is another version of AIVARAT that can operate as data-encrypting and screen-locking ransomware.