Virus and Spyware Removal Guides, uninstall instructions

What kind of malware is NoDeep?

During our analysis of NoDeep, we found that it is ransomware from the Proton family. It encrypts files, appends an email address (nodeep@tutamail.com) and its extension (".nodeep") to filenames, and drops a ransom note ("#Read-for-recovery.txt"). Our discovery of NoDeep occured while inspecting samples submitted to VirusTotal.

An example of how NoDeep modifies the filenames of encrypted files: it renames "1.jpg" to "1.jpg.[nodeep@tutamail.com].nodeep", "2.png" to "2.png.[nodeep@tutamail.com].nodeep", and so forth.

What kind of malware is Dark Eye?

Dark Eye is ransomware belonging to the Xorist family. We discovered it while checking malware samples submitted to VirusTotal. This ransomware encrypts files and appends the ".darkeye" extension to filenames. It also provides a ransom note (it displays a pop-up window, changes the desktop wallpaper, and creates the "HOW TO DECRYPT FILES.txt" file).

An illustration of how files encrypted by Dark Eye are renamed: "1.jpg" is changed to "1.jpg.darkeye", "2.png" to "2.png.darkeye", and so forth.

What kind of page is pirophackeric[.]com?

During an inspection of pirophackeric[.]com, our team discovered that this page uses a deceptive tactic known as clickbait. The aim is to lure visitors into accepting notifications from pirophackeric[.]com. Usually, when sites like pirophackeric[.]com have permission to send notifications, they bombard users with intrusive and misleading notifications.

What kind of email is "Fifth Third Bank"?

Upon examining this "Fifth Third Bank" email, we determined that it is fake. This phishing email targets Fifth Third Bank (5/3 Bank) account log-in credentials. The letter tricks recipients into disclosing this data by informing them of a bogus card purchase. It must be stressed that this email is not associated with the actual Fifth Third Bank.

What kind of email is "Bank Of Scotland"?

After inspecting this "Bank Of Scotland" email, we learned that it is spam. This phishing campaign seeks recipients' personally identifiable information by claiming that they are entitled to funds from the Bank of Scotland.

The letter namedrops several legitimate entities, and it must be emphasized that this scam mail is not associated with any of them.

What kind of page is phougets[.]com?

During our inspection of phougets[.]com, we found that this page displays deceptive content to receive permission to send notifications. Usually, notifications from pages like phougets[.]com contain fake warnings, alerts, and other messages. Users are advised not to permit such pages to send notifications.

What kind of page is tetradsgroup[.]com?

Tetradsgroup[.]com is a rogue webpage discovered by our researchers during a routine investigation of suspicious sites. After examining this page, we determined that it promotes browser notification spam and generates redirects to other (likely dubious/malicious) websites.

Users primarily access webpages like tetradsgroup[.]com via redirects caused by sites that utilize rogue advertising networks.

What kind of page is cubmotodic[.]com?

While examining cubmotodic[.]com, we found that it uses deception (a misleading message) to obtain permission to show notifications. Web pages of this type should be avoided. Allowing cubmotodic[.]com and similar sites to show notifications can expose users to various risks.

What kind of page is techadsmecity[.]com?

Our researchers discovered techadsmecity[.]com during a routine inspection of untrustworthy websites. This rogue page is designed to promote browser notification spam and redirect visitors to other (likely dubious/dangerous) sites.

The majority of users access webpages like techadsmecity[.]com via redirects generated by websites that employ rogue advertising networks.

What kind of page is thecanetdesign[.]com?

Thecanetdesign[.]com is a rogue page discovered by our researchers while browsing suspect websites. Upon inspection, we learned that thecanetdesign[.]com endorses spam browser notifications and redirects users to different (likely unreliable/hazardous) sites.

Most visitors access webpages like thecanetdesign[.]com through redirects caused by websites that employ rogue advertising networks.