Virus and Spyware Removal Guides, uninstall instructions

What kind of malware is Wnlu?

Wnlu is ransomware designed to block access to files and provide a ransom note. It encrypts files, appends the ".wnlu" extension to filenames (for example, renames "1.jpg" to "1.jpg.wnlu", "2.jpg" to "2.jpg.wnlu"), and creates the "_readme.txt" file. Wnlu is one of the variants belonging to the Djvu ransomware family.

What kind of malware is DoyUk 5.0?

DoyUk 5.0 is ransomware that blocks access to files by encrypting them. It also renames every encrypted file by appending the ".doyuk" extension to its filename and creates the "Warning.txt" text file (a ransom note). For example, it renames "1.jpg" to "1.jpg.doyuk", "2.jpg" to "2.jpg.doyuk". DoyUk 5.0 is a new variant of Doyuk 2.0 ransomware.

What kind of website is lukchit[.]com?

Lukchit[.]com is designed to load deceptive content, ask for permission to show notifications, and redirect visitors to potentially malicious pages. It is pretty similar to ourcoolstories[.]com, spdate[.]com, protectionyoupc[.]com, and hundreds of other pages.

What is Pyphyfe ransomware?

Pyphyfe is a malicious program belonging to the Snatch ransomware family. It operates by encrypting data (rendering files inaccessible) and demanding payment for the decryption.

Affected files are appended with the ".pyphyfe" extension. For example, a file originally named "1.jpg" would appear as "1.jpg.pyphyfe", "2.jpg" as "2.jpg.pyphyfe", and so forth. Once this process is complete, a ransom note - "HOW TO RESTORE YOUR FILES.TXT" - is dropped onto the desktop.

What is Mkp ransomware?

Mkp is a new variant of the Makop ransomware. It operates by encrypting data (locking files) and demanding payment for the decryption.

Files are renamed following this pattern: original filename, victim's unique ID, cyber criminals' email address, and the ".mkp" extension. For example, a file titled "1.jpg" would look similar to "1.jpg.[87C29B86].[icq-is-firefox20@ctemplar.com].mkp", etc. Afterwards, a ransom-demanding message with the "+README-WARNING+.txt" filename is created.

What is mobifliks[.]com?

Mobifliks[.]com is an illegal movie streaming and download website. This site not only breaks copyright laws, but it also uses rogue advertising networks that are known to promote untrustworthy/malicious pages.

Using such advertising networks is a prevalent monetization technique. Therefore, there are thousands of rogue webpages online; kissasian.cam, bitcoinshortener.top, sabishare.com, fdrama.net, fastfrom.com, and mp3fy.com are just some examples.

What is "Phantom Wallet Recovery" scam?

"Phantom Wallet Recovery" is a phishing scam promising users access recovery to their Phantom cryptocurrency wallets. Instead, the scheme records the wallet credentials provided to it. With this information in their possession, the cyber criminals behind the scam can steal the exposed cryptowallets.

What is ourcoolstories[.]com?

Similar to spdate.com, new-updates-service.com, yoursurveyprogram.com, and thousands of others, ourcoolstories[.]com is a rogue website. It is designed to load dubious content, push its browser notifications, and/or redirect visitors to other webpages.

Users are typically redirected to rogue sites by untrustworthy pages, intrusive ads, or installed PUAs (Potentially Unwanted Applications).

What is MetaMask Holders Rewards scam?

It is a phishing scam used to trick unsuspecting MetaMask account login credentials. MetaMask is a legitimate software cryptocurrency wallet that has nothing to do with this scam/phishing website. This page must be ignored and reported to corresponding authorities.

What kind of scam is Avira - Your Pc May Have Been Infected?

It is a pop-up scam designed to trick unsuspecting users into believing that the Avira virus detection engine has found items posing a threat to their computers. Typically, such scams fraudulently advertise legitimate software, ask users to install questionable software, pay money or provide personal information.