Virus and Spyware Removal Guides, uninstall instructions

What kind of page is topcaptchatoday[.]top?

While reviewing untrustworthy sites, our researchers encountered the topcaptchatoday[.]top rogue webpage. Our team discovered two appearance variants of this page; both employed a hoax CAPTCHA test to lure visitors into consenting to this spam browser notification delivery. It is worth mentioning that topcaptchatoday[.]top can also redirect visitors to different (likely unreliable/dangerous) websites.

Users primarily enter sites like topcaptchatoday[.]top via redirects caused by webpages that use rogue advertising networks.

What kind of malware is Insekt?

Insekt is the name of a remote access trojan (RAT). Malware of this type is designed to give an attacker remote access and control over a victim's computer system. Insekt RAT is developed using GoLang programming language and is compiled to run on both Windows and Linux systems.

What is Tils ransomware?

Tils is a ransomware-type program discovered by our researchers during a routine inspection of new submissions to VirusTotal. Malware within this category is designed to encrypt data and demand ransoms for its decryption.

After we executed a sample of Tils on our testing system, it encrypted files and added the ".tils" extension to their filenames. For example, a file originally titled "1.jpg" appeared as "1.jpg.tils", "2.png" as "2.png.tils", and so on for all of the affected files.

Once the encryption process was completed, a message titled "RECOVERY INFORMATION.txt" was dropped onto the desktop.

What kind of page is adsforcomputertech[.]com?

While investigating adsforcomputertech[.]com, we discovered that the website aims to deceive its visitors into consenting to receive notifications. Moreover, the site redirects users to similar web pages. Our team stumbled upon adsforcomputertech[.]com while examining pages that employ dubious advertising networks.

What kind of malware is SHTORM?

SHTORM is a ransomware variant that is part of the Phobos ransomware family. Our malware researchers discovered SHTORM while analyzing malware samples submitted to the VirusTotal page. They have found that SHTORM encrypts data, modifies filenames, and creates info.hta and info.txt files (ransom notes).

SHTORM appends the victim's ID, mjk20@tutanota.com email address, and the ".SHTORM" extension to filenames. For instance, it renames "1.jpg" to "1.jpg.id[9ECFA84E-3351].[mjk20@tutanota.com].SHTORM", "2.png" to "2.png.id[9ECFA84E-3351].[mjk20@tutanota.com].SHTORM", and so forth.

What kind of page is gadsmedia[.]com?

We discovered the gadsmedia[.]com rogue site during a routine investigation of untrustworthy webpages. It operates by promoting browser notification spam and redirecting visitors to different (likely unreliable/harmful) pages.

Users primarily enter webpages like gadsmedia[.]com through redirects caused by websites that use rogue advertising networks.

What kind of page is asrelatercond[.]com?

While inspecting untrustworthy sites, our research team discovered the asrelatercond[.]com rogue page. At the time of research, this webpage used fake CAPTCHA to trick visitors into allowing it to display spam browser notifications. Additionally, asrelatercond[.]com can redirect users to other (likely unreliable/harmful) websites.

Most visitors to such pages access them via redirects caused by sites that employ rogue advertising networks.

What is World Clock Tab?

After inspecting the World Clock Tab browser extension, we determined that it is a browser hijacker. This piece of software modifies browser settings to promote (through redirects) the worldclocktab.com fake search engine. It is likely that the World Clock Tab extension also spies on users' browsing activity.

What is DeckData?

After analyzing the DeckData application, our team has determined that it produces advertisements, leading us to classify it as a standard form of adware. Another important detail about this adware is that we have discovered it while inspecting deceptive websites.

What kind of email is "PayPal - Order Has Been Completed"?

After inspecting the "PayPal - Order Has Been Completed" email – we determined that it is spam. This letter is presented as a notification regarding a successful purchase made via PayPal. This spam mail aims to trick recipients into calling the provided helpline and thus getting lured into the scam.

It must be emphasized that this email is in no way associated with PayPal Holdings, Inc.