Virus and Spyware Removal Guides, uninstall instructions

What is SDEN?

SDEN is a ransomware-type infection discovered by Petrovic and belonging to the Matrix ransomware family. This malware is designed to infiltrate the system and encrypt most stored files using AES-128 and RSA-2048 encryption algorithms. In doing so, SDEN renames each file using the "[developer's_email].[unique_ID].SDEN" pattern.

For example, "sample.jpg" might be renamed to a filename such as "[SmartDen@protonmail.com].qpnrZUKL-5Hx3ICAB.SDEN". Once encrypted, data becomes unusable and indistinguishable. This malware also places the "!SDEN_INFO!.rtf" file on the desktop.

What is rackcdn[.]com?

rackcdn[.]com is a legitimate website, the domain of which is owned by a company called Rackspace.

This page is a part of Rackspace CDN (Content Delivery Network) and is not malicious. The main goal of the CDN service is to provide fast content delivery for visitors to their web pages, however, some criminals exploit CDN services to deploy deceptive, untrustworthy content (dubious ads, redirects to potentially malicious websites, and so on).

What is COM Surrogate?

COM Surrogate is a genuine Windows 10 process that is designed to run various program extensions. Users are more or less certain to find this process in Windows Task Manager.

Therefore, the presence of this process does not mean that the system is infected, however, some viruses are developed to disguise themselves using COM Surrogate process names to prevent detection.

What is Atilla Stealer?

The Atilla Stealer program is a Remote Access Trojan (RAT) that cyber criminals use for malicious purposes, specifically, to steal various personal information.

They trick people into downloading and installing this program and then use the stolen data/information to generate revenue. Atilla Stealer runs in the system background and people who have computers infected by this RAT are usually not aware of this.

What is dz4link[.]com?

dz4Link[.]com is a URL shortener, a website designed to transform long links into short links. This website presents the opportunity for people to make money by creating these links. The site is not malicious, however, it causes various pop-up ads and redirects to other dubious, potentially malicious websites.

Furthermore, dz4Link[.]com uses various advertising networks. Therefore, websites of this type should be avoided.

What is JasperLoader?

JasperLoader is high-risk trojan-type virus designed to proliferate other malware. Malware of this type usually infiltrates systems without permission. Its presence might cause various problems (e.g., serious privacy issues, permanent data loss, etc.).

What is Advanced Password Manager?

Advanced Password Manager is a software tool, an application that is promoted as a password manager. According to the developers, it allows users to organize their passwords in one place without having to remember them.

This may seem to be a useful tool, especially for people who have many password-protected accounts, however, developers promote it using the "bundling" method. For this reason, Advanced Password Manager is categorized as a potentially unwanted application (PUA).

What is SadComputer?

SadComputer is a ransomware-type virus discovered by MalwareHunterTeam. This malware infection encrypts stored files so that develops can blackmail victims (files remain encrypted until a ransom is paid). Note that SadComputer deletes those files that are larger than the amount of memory SadComputer is capable of allocating.

During encryption, SadComputer adds the ".sad" appendix to the name of each compromised file. For example, "1.jpg" is renamed to "1.jpg.sad". Additionally, SadComputer opens a pop-up window and places a text file ("sadcomputer_note.txt") in every existing folder.

What is Browec?

Discovered by Michael Gillespie, Browec is yet another ransomware virus that belongs to the Djvu malware family. As with its predecessor, Browec encrypts stored data (thereby making it unusable) and adds the ".browec" extension to each filename. For example, "1.jpg" is renamed to "1.jpg.browec". Browec also stores a text file ("_readme.txt") in each folder.

What is "apple.com-clear[.]live"?

apple.com-clear[.]live is a scam website that is used to promote the Cleanup My-Mac application. This website displays a fake virus alert and encourages users to remove 'computer infections' by downloading and installing the aforementioned potentially unwanted application (PUA).

Generally, people do not visit apple.com-clear.live intentionally - they are redirected to it by PUAs that are already installed on their computers or web browsers. Most PUAs cause redirects to scams or other dubious sites, feed users with advertisements, and gather data relating to browsing habits.