Virus and Spyware Removal Guides, uninstall instructions

What kind of malware is RatMilad?

RatMilad is the name of an Android Remote Access Trojan (RAT) with spyware capabilities targeting users in the Middle Eastern. It is known that this malware is distributed via NumRent - a VPN and phone number spoofing application. Previously, RatMilad was hiding behind an app called Text Me.

NumRent is renamed and graphically modified version of the Text Me app. It allows threat actors to collect sensitive data and performs other actions.

What is MafiaWare666 ransomware?

MafiaWare666 is a piece of malicious software classified as ransomware. Malware within this classification operates by encrypting victims' data (i.e., rendering it inaccessible) and demanding payment for the decryption.

Once we launched a sample of this ransomware on our test machine, it began encrypting files and appended their filenames with a ".MafiaWare666" extension. To elaborate, a file initially named "1.jpg" became "1.jpg.MafiaWare666", "2.png" - "2.png.MafiaWare666", etc. Afterwards, a ransom note was displayed in a pop-up window.

Fortunately, all current versions of MafiaWare666 ransomware are decryptable; Avast has developed a free decryption tool for this malware (more information below).

What kind of application is Moviesm?

Moviesm is described as an extension that allows users to watch movies and TV shows anytime and everywhere. Our team has tested Moviesm and learned that this app barely provides useful features and shows intrusive advertisements. Thus, we classified Moviesm as adware. Additionally, this app can read data on all websites.

What kind of page is desktopsecurityradar[.]com?

Desktopsecurityradar[.]com is a website running the "Norton Security - Your PC Might Be Infected With Viruses!" scam. Our team discovered this page while inspecting other pages that use rogue advertising networks. We also found that desktopsecurityradar[.]com wants to show notifications. This page cannot be trusted.

What is Cyberone ransomware?

Cyberone is a ransomware-type program. It is designed to encrypt data and make ransom demands for the decryption. After we executed a sample of this ransomware in our testing system, it appended the filenames of encrypted files with a ".cyberone" extension. For example, a file originally named "1.jpg" appeared as "1.jpg.cyberone", "2.png" as "2.png.cyberone", etc.

Once the encryption process was completed, Cyberone created ransom notes in the form of a pop-up window and text file ("___RECOVER__FILES__.cyberone.txt").

Fortunately, currently known Cyberone variants are decryptable; Avast has released a free decryption tool for this ransomware (more information below).

What kind of application is TravelSmart?

Wikitravel is a travel guide based on the wiki format. Its website promotes an advertising-supported software (adware) called TravelSmart. The purpose of adware is to show annoying advertisements. It is known that it installs on computers as "TravelSmart - TravelSmart for Desktop" and runs in the Task Manager as "TravelSmart".

What is AnalogManager?

AnalogManager is a piece of rogue software that our researchers discovered while looking through new submissions to VirusTotal. After analyzing this app, we determined that it operates as adware. Additionally, AnalogManager is part of the AdLoad malware family.

What kind of page is software-saver[.]com?

While examining software-saver[.]com, our team discovered that it is an untrustworthy page designed to trick visitors into believing that their computers are infected. This page runs the "McAfee - Your PC is infected with 5 viruses!" scam. Additionally, it wants to show notifications. This page (messages displayed by it) should be ignored.

What is ThrillAlgorithm?

ThrillAlgorithm is the name of an application that we discovered while examining untrustworthy websites offering to download fake updates for the Adobe Flash Player. After downloading and installing ThrillAlgorithm, we found that it generates intrusive advertisements. Software of this type is called adware.

What kind of page is law-antivirus[.]com?

Our research team discovered the law-antivirus[.]com rogue site during a routine investigation of suspicious websites. This page endorses deceptive content, pushes browser notification spam, and redirects visitors to different (likely unreliable/malicious) sites.

Most users access law-antivirus[.]com and websites akin to it - through redirects caused by pages that use rogue advertising networks.