Remove Roxaq Apps (PUA)

Roxaq Apps is a Potentially Unwanted Application (PUA) that acts as a dropper for malware, specifically Legion Loader. This application infiltrates systems via deceptive installation methods, often bundled with other free software or rogue pop-ups. Once installed, it facilitates the spread of various malware strains, including information stealers, trojans, ransomware, cryptocurrency miners, and malicious browser extensions.

During testing, Roxaq Apps was found to be installed alongside a fake “Save to Google Drive” browser extension, which had functionalities that could alter browser behavior, steal clipboard content, collect browsing history, and turn browsers into proxies for malicious activities. Users who encounter this software may experience severe privacy issues, system infections, financial losses, and potential identity theft.

How Does Roxaq Apps Spread?

Roxaq Apps typically infiltrates systems through deceptive pop-up advertisements and software bundling. Rogue web pages often promote misleading software installations, tricking users into downloading malicious applications. Once installed, Roxaq Apps facilitates the execution of Legion Loader, which in turn deploys multiple other malware strains.

Threat Summary

Threat Name	Roxaq Apps
Threat Type	PUP (Potentially Unwanted Program), PUA (Potentially Unwanted Application), Dropper
Payload	Legion Loader
Symptoms	Unexpected software installations, intrusive ads, browser redirections, slow internet browsing, decreased system performance
Detection Names	N/A (VirusTotal)
Distribution Methods	Deceptive pop-ups, free software installers (bundling)
Related Domains	feedshareeasyfile[.]com
Damage Potential	Multiple malware infections, financial loss, privacy breaches, identity theft, slow computer performance
Danger Level	High

How Does Roxaq Apps Work?

Dropper for Legion Loader

Roxaq Apps is categorized as a dropper, which means its primary function is to download and execute additional malware on the system. The dropper facilitates the installation of Legion Loader, a sophisticated malware tool used to distribute:

• Information Stealers – Extracts login credentials, financial data, and other sensitive information.
• Trojans – Opens backdoors for further infections and data theft.
• Ransomware – Encrypts files and demands a ransom for decryption.
• Cryptocurrency Miners – Uses system resources to mine digital currencies, slowing down the computer.
• Malicious Browser Extensions – Hijacks web browsers, modifying settings and injecting unwanted ads.

Browser Hijacking Capabilities

On our test machine, Roxaq Apps was installed along with a fake “Save to Google Drive” extension. This extension had malicious capabilities, including:

• Altering the browser’s behavior and appearance.
• Stealing and modifying clipboard data.
• Tracking browsing activities and history.
• Displaying intrusive pop-up ads.
• Turning browsers into HTTP proxies for fraudulent purposes.

Symptoms of Roxaq Apps Infection

Users who unknowingly install Roxaq Apps may experience the following symptoms:

• Unfamiliar programs appearing on the system.
• Increased frequency of pop-up advertisements.
• Rogue browser redirects to unknown pages.
• Browser settings changes (e.g., altered homepage, new extensions).
• System slowdown due to high resource consumption.
• Privacy breaches and potential data theft.

Complete Guide to Removing Potentially Unwanted Programs (PUPs)

Potentially Unwanted Programs (PUPs) infiltrate devices through software bundling and can cause slow performance, intrusive ads, and security risks. This guide provides manual removal instructions for Windows and Mac users, along with an automated method using SpyHunter.

---

Manual Removal Guide for Windows & Mac

If you suspect a PUP is installed on your system, follow these steps to remove it manually.

Step 1: Uninstall Suspicious Programs

Windows Users

1. Open Control Panel:
   • Press Win + R, type appwiz.cpl, and hit Enter.
2. Locate and Remove Unwanted Programs:
   • Look for unfamiliar or suspicious applications.
   • Right-click the program and select Uninstall.
3. Follow the Uninstallation Process:
   • If prompted, confirm by clicking Yes.

Mac Users

1. Open Finder → Click Applications.
2. Find and Remove Suspicious Apps:
   • Look for programs that you don’t remember installing.
3. Move to Trash:
   • Drag the unwanted application to Trash.
4. Empty the Trash:
   • Right-click the Trash icon and select Empty Trash.

---

Step 2: Remove PUP-Related Browser Extensions

PUPs often install browser extensions that display ads or redirect search results.

Google Chrome

1. Open Chrome → Click the three-dot menu.
2. Go to More Tools → Extensions.
3. Find any suspicious extensions and click Remove.

Mozilla Firefox

1. Open Firefox → Click the Menu button (≡).
2. Select Add-ons and themes → Extensions.
3. Remove any unwanted extensions.

Microsoft Edge

1. Open Edge → Click the three-dot menu.
2. Select Extensions → Manage Extensions.
3. Locate and Remove any unknown extensions.

Safari (Mac)

1. Open Safari → Click Safari in the menu bar → Preferences.
2. Navigate to the Extensions tab.
3. Find and Uninstall any unfamiliar extensions.

---

Step 3: Reset Browser Settings (If Necessary)

If PUPs have altered your browser settings, reset them.

Google Chrome

1. Open Chrome → Click three-dot menu → Settings.
2. Scroll down and select Reset settings.
3. Click Restore settings to their original defaults → Confirm.

Mozilla Firefox

1. Open Firefox → Click Menu (≡) → Help.
2. Select More Troubleshooting Information.
3. Click Refresh Firefox and confirm.

Microsoft Edge

1. Open Edge → Click Settings.
2. Select Reset settings → Restore settings to their default values.
3. Confirm the reset.

Safari (Mac)

1. Open Safari → Click Safari in the menu bar.
2. Select Clear History → Choose All History → Click Clear History.

---

Step 4: Check for Leftover PUP Files

Even after uninstallation, some PUPs leave traces behind.

Windows

1. Press Win + R, type %temp%, and press Enter.
2. Delete all files in the Temp folder.
3. Repeat the process for:
   • %appdata%
   • %localappdata%
   • C:\ProgramData

Mac

1. Open Finder → Click Go → Go to Folder.
2. Enter:javascriptCopyEdit~/Library/Application Support/
3. Look for and delete suspicious folders.

---

Automatic PUP Removal Using SpyHunter

For a faster, more thorough, and easier solution, use SpyHunter, an advanced anti-malware tool.

Step 1: Download and Install SpyHunter

1. Go to the official SpyHunter download page:
   • Download SpyHunter
2. Click the Download button and follow the installation instructions.

Step 2: Scan Your System

1. Launch SpyHunter.
2. Click Start Scan Now to initiate a full system scan.
3. Wait for SpyHunter to detect any PUPs and malware.

Step 3: Remove Detected Threats

1. Click Fix Threats to remove all detected PUPs.
2. Restart your computer to complete the cleanup.

For detailed SpyHunter download and installation steps, refer to: SpyHunter Installation Guide

---

Final Recommendations

• Avoid Software Bundles: Always choose custom installation when installing free software.
• Use an Anti-Malware Tool: SpyHunter ensures your system stays protected from PUPs.
• Regularly Check Installed Programs & Browser Extensions: Be proactive in removing suspicious apps.

By following this guide, you can effectively remove and prevent Potentially Unwanted Programs (PUPs). If you want a quick and effortless solution, use SpyHunter to scan and remove threats.

Download SpyHunter for PUP Removal: SpyHunter Official Download

Conclusion

Roxaq Apps is a dangerous PUA that acts as a dropper for Legion Loader, leading to severe malware infections, privacy breaches, and system performance issues. If you suspect its presence on your system, follow the removal steps outlined above. To prevent future infections, practice safe browsing habits and use reputable security software.

---

If you are still having trouble, consider contacting remote technical support options.