Virus and Spyware Removal Guides, uninstall instructions

What kind of malware is CY3?

CY3 is ransomware belonging to the Dharma family. Our team discovered CY3 while checking the VirusTotal website for recently submitted malware samples. We found that CY3 encrypts files, appends the victim's ID, cybercrypt@tutanota.com email address, and ".CY3" extension to filenames.

CY3 also displays a pop-up window and drops the "info.txt" file (two ransom notes). An example of how CY3 modifies filenames: it renames "1.jpg" to "1.jpg.id-9ECFA84E.[cybercrypt@tutanota.com].CY3", "2.png" to "2.png.id-9ECFA84E.[cybercrypt@tutanota.com].CY3", and so forth.

What kind of pages are video***[.]space?

While examining video***[.]space pages (e.g., videofin[.]space, videobtc[.]space, videoeth[.]space, videofun[.]space), we found that they display deceptive content to lure visitors into agreeing to receive notifications. Users do not visit such pages on purpose. Our team discovered them while visiting sites that use rogue advertising networks.

What kind of scam is "Mega Millions International Lottery"?

After examining this email, our team determined that it is a scam email written by scammers who try to trick recipients into believing they have won a lottery but have not claimed their prize. They aim to lure recipients into providing personal information and (or) transferring money. This email should be ignored.

What kind of malware is MortalKombat?

MortalKombat is ransomware our malware researchers have discovered while inspecting samples submitted to the VirusTotal website. It encrypts files, changes the desktop wallpaper, drops the "HOW TO DECRYPT FILES.txt" file, and modifies filenames. MortalKombat is based on Xorist ransomware.

MortalKombat appends the ".Remember_you_got_only_24_hours_to_make_the_payment_if_

you_dont_pay_prize_will_triple_Mortal_Kombat_Ransomware" extension to filenames. The "HOW TO DECRYPT FILES.txt" file created by this ransomware is a ransom note.

What kind of scam is "Crypto Payment Notification"?

We have inspected this email and concluded that it is written by scammers who aim to trick recipients into providing sensitive information. It is disguised as a letter regarding a cryptocurrency transaction and contains links designed to open phishing pages. This email should be marked as spam and deleted.

What kind of malware is Znto?

While examining malware samples submitted to VirusTotal, we discovered a ransomware belonging to the Djvu family called Znto. It encrypts files, appends the ".znto" extension to filenames of encrypted files, and creates a text file ("_readme.txt") containing a ransom note.

An example of how Znto changes filenames: it renames "1.jpg" to "1.jpg.znto", "2.png" to "2.png.znto", and so forth. Since Znto is part of the Djvu family, it is important to know that Znto may be distributed alongside Vidar, RedLine, and other information stealers.

What kind of malware is Block_file12?

Block_file12 is ransomware designed to encrypt files and append an email address and the ".block_file12" extension to filenames. An example of how Block_file12 renames filenames: it changes "1.jpg" to "1.jpg!===contact_mail===itankan12@gmail.com===.block_file12", "2.png" to "2.png!===contact_mail===itankan12@gmail.com===.block_file12", and so forth.

What kind of malware is Ekipa?

Ekipa is the name of a Remote Administration Trojan (RAT) sold on a hacker forum for $4500. Threat actors use RATs to perform remote malicious activities on infected computers. Ekipa RAT can gather system information, manage files, and perform other tasks. It should be removed from the infected computers immediately.

What kind of application is Cats fanpage?

After testing the Cats fanpage browser extension, we found that it is a browser hijacker designed to promote search.cats-fan.com - a fake search engine. Cats fanpage hijacks a web browser by changing some of its settings. Usually, browser hijackers are promoted in deceptive ways.

What kind of application is CyberBlock?

While examining CyberBlock browser extension, we found that it displays annoying advertisements. Also, it can read various data. Apps that show advertisements are categorized as adware. Usually, users download and install (or add) advertising-supported apps like CyberBlock inadvertently.