Virus and Spyware Removal Guides, uninstall instructions

What kind of application is Online Document Converters?

After testing the Online Document Converters application (browser extension), we found that it provides no useful features and shows intrusive advertisements. Additionally, it can read and change data on all visited pages. We classified Online Document Converters as adware. Typically, apps/browser extensions of this type are promoted using deceptive methods.

What kind of page is mostongou[.]com?

Our researchers discovered the mostongou[.]com rogue webpage while inspecting questionable sites. This page operates by promoting browser notification spam and redirecting visitors to different (likely untrustworthy/malicious) websites.

Mostongou[.]com and similar sites are typically accessed through redirects caused by pages using rogue advertising networks.

What is Tin Colors?

Our research team discovered the Tin Colors browser extension while inspecting suspicious software-promoting websites. This extension is promoted as a tool capable of changing webpage background colors. However, our analysis revealed that Tin Colors operates as adware instead.

What kind of page is browse-defense[.]com?

Browse-defense[.]com is the address of a rogue page. Our researchers discovered this site during a routine inspection of suspicious webpages. Browse-defense[.]com promotes deceptive content (scams), pushes spam browser notifications, and redirects users to other (likely unreliable/malicious) pages.

Websites like browse-defense[.]com are most often accessed via redirects caused by sites that use rogue advertising networks.

What kind of malware is Exploit6?

Exploit6 is the name of ransomware designed to encrypt files, append the ".exploit6" extension to filenames of all encrypted files, and drop the "READMI.txt" file. Our malware researchers discovered Exploit6 while examining samples submitted to the VirusTotal website.

An example of how Exploit6 modifies filenames: it renames "1.jpg" to "1.jpg.exploit6", "2.png" to "2.png.exploit6", "3.exe" to "3.exe.exploit6", and so forth.

What kind of page is cimen[.]click?

After examining cimen[.]click, we found that this page runs the "McAfee - Your PC is infected with 5 viruses!" scam. It also wants to show notifications. Cimen[.]click is an untrustworthy page. We discovered it while inspecting other pages of this kind (pages that use rogue advertising networks).

What kind of software is Files Download Tool?

Files Download Tool is an application that supposedly allows users to keep track of downloads and manage or create new downloads. After testing this app, we found that it shows unwanted advertisements. For this reason, we classified Files Download Tool as adware. Our team discovered this browser extension on an untrustworthy page.

What kind of malware is 62IX?

After examining 62IX, we learned that it is ransomware that encrypts files, appends the ".62IX" extension to filenames, changes the desktop wallpaper, and creates the "КАК РАСШИФРОВАТЬ FILES.txt" file (a ransom note). Our team discovered 62IX while checking the VirusTotal page for recently submitted malware samples.

An example of how 62IX renames files: it changes "1.jpg" to "1.jpg.62IX", "2.png" to "2.png.62IX", "3.exe" to "3.exe.62IX", and so forth.

What is Cyber_Puffin ransomware?

Our research team discovered Cyber_Puffin during a routine inspection of new submissions to VirusTotal. This malicious program is classified as ransomware, a type of malware that encrypts data and demands payment for decryption.

After we launched a sample of Cyber_Puffin on our test machine, it encrypted files and appended their filenames with a ".Cyber_Puffin" extension, e.g., a file titled "1.jpg" appeared as "1.jpg.Cyber_Puffin", "2.png" as "2.png.Cyber_Puffin", etc.

Following the completion of this process, this ransomware changed the desktop wallpaper and created a text file named "Cyber_Puffin.txt", which contained the ransom-demanding message.

What kind of application is PowerSet?

While examining the PowerSet application, we noticed that various ads appear while this app is installed. Software that displays unwanted advertisements is called adware. Typically, users install software of this type unintentionally. We discovered PowerSet while inspecting deceptive websites.