Virus and Spyware Removal Guides, uninstall instructions

What kind of page is aspectsofc[.]hair?

During a routine investigation of untrustworthy websites, our research team discovered the aspectsofc[.]hair rogue page. It is designed to load deceptive material, promote browser notification spam, and cause redirects to other (likely dubious/malicious) sites.

Users typically access aspectsofc[.]hair and websites akin to it through redirects caused by pages using rogue advertising networks.

What is 18plusvideos[.]me?

After examining the 18plusvideos[.]me page, we found that its purpose is to get permission to show notifications. It uses a clickbait technique to trick visitors into granting that permission. Additionally, 18plusvideos[.]me can redirect visitors to a similar web page. Typically, visitors open such pages unintentionally.

What kind of page is basitrackone[.]space?

Basitrackone[.]space is a website that shows a deceptive message to trick visitors into allowing it to show notifications and redirects them to other websites. Our team discovered this site while inspecting pages that use rogue advertising networks. Like all the other pages of this type, basitrackone[.]space is not being visited intentionally.

What kind of page is buyfunllc[.]com?

The Internet is rife with deceptive and malicious content. While inspecting untrustworthy websites, our research team found the buyfunllc[.]com rogue page. It promotes browser notification spam and redirects visitors to different (likely dubious/harmful) sites.

Most users enter webpages like buyfunllc[.]com via redirects caused by sites using rogue advertising networks.

What is Colambia ransomware?

While looking through new submissions to VirusTotal, our researchers discovered the Colambia ransomware-type program. This piece of malicious software belongs to the ZEPPELIN ransomware family.

Once we executed a sample of Colambia on our test machine, it began encrypting files and appended their filenames with an extension that follows the ".colambia.[victim's_ID]" pattern. For example, a file originally named "1.jpg" appeared as "1.jpg.colambia.D74-C53-02C" following encryption.

After this process was completed, a ransom-demanding message titled - "!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT" - was dropped onto the desktop.

What is ExpandedSystem?

During a routine investigation of new submissions to VirusTotal, we discovered the ExpandedSystem rogue application. After analyzing this app, we learned that it operates as advertising-supported software (adware) and belongs to the AdLoad malware family.

What kind of page is german0[.]xyz?

German0[.]xyz is a website that uses deception to trick visitors into agreeing to receive notifications from it. Also, it redirects visitors to scam websites. Our team discovered german0[.]xyz while examining illegal movie streaming pages, torrent sites, and similar websites.

What is darkscreen?

While inspecting questionable download webpages, our research team discovered a rogue browser extension called "darkscreen". It is promoted as a tool capable of enabling dark mode for simple design websites. However, our analysis of darkscreen revealed that it operates as advertising-supported software (adware) instead.

What kind of page is entry-system[.]xyz?

We discovered entry-system[.]xyz after clicking on a link received via email. While examining the entry-system[.]xyz, we learned that it is a deceptive website designed to trick visitors into allowing it to display notifications. We also found that entry-system[.]xyz can redirect visitors to shady websites.

What kind of malware is Ransomcrow?

While analyzing malware samples submitted to VirusTotal, we came across Ransomcrow ransomware. Like any other ransomware, Ransomcrow encrypts files and demands payment in exchange for a decryption tool. Also, it appends the ".encrypted" extension to filenames, creates the "readme.txt" file containing a ransom note, and changes the desktop wallpaper.

An example of how Ransomcrow ransomware modifies filenames: it renames "1.jpg" to "1.jpg.encrypted", "2.png" to "2.png.encrypted", and so forth.