Virus and Spyware Removal Guides, uninstall instructions

What is Clown (Chaos) ransomware?

While investigating new submissions to VirusTotal, our researchers discovered the Clown ransomware. This malicious program is based on the Chaos ransomware.

When we executed a sample of Clown (Chaos) ransomware on our testing system, it encrypted files and appended their filenames with a ".clown" extension. For example, a file named "1.jpg" appeared as "1.jpg.clown", "2.png" as "2.png.clown", and so on. Afterward, this ransomware dropped a ransom note – "read_it.txt" – onto the desktop.

What kind of page is advnotreviews[.]com?

After examining advnotreviews[.]com, we have determined that its main purpose is to deceive visitors into agreeing to receive notifications. We came across this website during an inspection of pages that use suspicious advertising networks, and it is not a site that users intentionally visit.

What kind of malware is Tuslamon?

Our team recently came across a ransomware variant called Tuslamon, which is associated with the Xorist family. We discovered Tuslamon while inspecting samples submitted to VirusTotal. Tuslamon encrypts files and adds the ".tuslamon" extension to their filenames.

Additionally, it generates an error window and creates a ransom note in the form of a file named "HOW TO DECRYPT FILES.txt", which contains the same message as the error window. An example of how files encrypted by Tuslamon are renamed: "1.jpg" is changed to "1.jpg.tuslamon", "2.doc" to "2.doc.tuslamon", and so forth.

What kind of page is iageandinone[.]com?

Our researchers discovered the iageandinone[.]com rogue page during a routine investigation of suspicious websites. This webpage is designed to promote browser notification spam; at the time of research, it employed fake CAPTCHA for this purpose. Additionally, the page can redirect visitors elsewhere (likely untrustworthy/dangerous sites).

Most users visit webpages like iageandinone[.]com via redirects caused by sites that employ rogue advertising networks.

What kind of page is globalvantnow[.]com?

While investigating untrustworthy sites, our research team found the globalvantnow[.]com rogue webpage. It is designed to promote browser notification spam and redirect visitors to other (likely unreliable/harmful) websites. Users typically access globalvantnow[.]com and similar sites through redirects caused by pages that use rogue advertising networks.

What is Global Ad Blocker?

Our research team discovered the Global Ad Blocker browser extension while checking out suspicious websites. According to its promotional material, Global Ad Blocker is an ad-blocking tool capable of impeding the display of various online advertisements like banners, overlays, video ads, and others. However, our inspection of this extension revealed that it operates as adware. In other words, instead of blocking adverts – Global Ad Blocker displays them.

What kind of page is bestvenadvertising[.]com?

Bestvenadvertising[.]com is a rogue page we discovered while checking out suspicious websites. It operates by pushing spam browser notifications and redirecting users to other (likely unreliable/dangerous) sites.

Most visitors access bestvenadvertising[.]com and similar webpages via redirects caused by sites that employ rogue advertising networks.

What kind of page is advbeach[.]com?

While investigating dubious websites, our researchers discovered the advbeach[.]com rogue page. It is designed to promote browser notification spam and redirect visitors to other (likely unreliable/harmful) sites. Most users access webpages like advbeach[.]com through redirects caused by websites that are monetized via rogue advertising networks.

What kind of page is addsdata[.]com?

After analyzing addsdata[.]com, we have determined that its primary objective is to entice visitors into granting permission to display notifications. Our team encountered addsdata[.]com while investigating websites that employ dubious advertising networks. Users typically access sites like addsdata[.]com unintentionally.

What kind of page is inalours[.]com?

Upon investigation, our team has determined that inalours[.]com displays a deceptive message to entice visitors to agree to receive notifications. Usually, users open pages like inalours[.]com inadvertently. We discovered inalours[.]com while inspecting websites that use shady advertising networks.