Virus and Spyware Removal Guides, uninstall instructions

What kind of page is stonecoremason[.]top?

While browsing suspicious websites, our researchers discovered the stonecoremason[.]top rogue page. It promotes browser notification spam and redirects visitors to other (likely dubious/malicious) sites. Users most commonly enter webpages like stonecoremason[.]top via redirects caused by websites that employ rogue advertising networks.

What kind of email is "Someone Used Your Webmail Password"?

After inspecting the "Someone Used Your Webmail Password" email, we determined that it is spam. This mail is promoting a phishing scam that targets email log-in credentials by claiming that an unrecognized sign-in attempt was blocked.

What kind of application is GxuApp?

While inspecting a deceptive download page, our researchers discovered a rogue installer carrying the GxuApp PUA (Potentially Unwanted Application). Programs within this category typically possess harmful functionalities.

PUAs are often bundled with other suspicious software, and the GxuApp installer that we investigated is no exception – it also installs a malicious browser extension – "Save to Google Drive" – which imitates legitimate software.

What kind of malware is ZAKI ESCOVINDA?

Our research team discovered the ZAKI ESCOVINDA ransomware during a routine investigation of new file submissions to the VirusTotal platform. This malicious program belongs to the Chaos ransomware family. ZAKI ESCOVINDA encrypts data and demands payment for the decryption.

On our test machine, this ransomware encrypted files and appended their filenames with a ".escovinda" extension. To elaborate, a file initially titled "1.jpg" became "1.jpg.escovinda", "2.png" – "2.png.escovinda", and so on for all of the affected files. Once this process was finished, the ransomware dropped a ransom note named "read_it.txt".

What kind of software is SmartSearch?

Our researchers discovered the SmartSearch browser hijacker while analyzing a rogue installation setup. SmartSearch modifies browser settings to produce redirects to promoted websites. This browser extension is also considered a privacy threat, as software within this classification typically spies on users' browsing activity.

What kind of malware is RedRose?

RedRose is the name of a ransomware-type virus. Malicious software within this category operates by encrypting files and demanding payment for their decryption.

RedRose functions the same. It renames encrypted files to a random string of numbers and appends them with a ".RedRose" extension. To elaborate, an original filename such as "1.jpg" can appear as "-2650834605_-870247881.RedRose".

Once the encryption process is finished, this ransomware creates a ransom-demanding message. This text file follows the naming manner used for the locked data – the title is a random string of numbers, so it can look like "-7868066620_-932203791.txt".

What kind of malware is Pgp (Makop)?

While investigating new submissions to the VirusTotal site, our researchers discovered the Pgp ransomware. This malicious program belongs to the Makop ransomware family. Malware within this classification encrypts data and demands payment for its decryption.

Pgp (Makop) ransomware encrypted files on our testing system and renamed them. Original filenames were appended with a unique ID, the cyber criminals' email address, and a ".pgp775" extension. Note that the number in the ".pgp775" extension might differ depending on the ransomware's variant.

On our test machine, a file initially named "1.jpg" appeared as "1.jpg.[2AF20FA3].[datarestore@cyberfear.com].pgp775" following encryption.

After this process was concluded, Pgp (Makop) ransomware created a ransom-demanding message titled "+README-WARNING+.txt".

What kind of page is sscreenads[.]com?

During our inspection of sscreenads[.]com, we found that it is a deceptive web page created to deceive visitors by displaying misleading content. The purpose of sscreenads.com is to obtain permission to show notifications. Usually, notifications originating from such sites take users to dubious pages (if clicked).

What kind of scam is "Dangerous Email Detection"?

We have examined this email and found that it is a fraudulent letter posing as a notification from an email service provider. It is created to trick visitors into providing personal information on a fake web page. Emails of this type are classified as phishing emails. Recipients should be cautious when encountering such communications and ignore them.

What is "Vlaanderen Verbeelding Werkt"?

We have analyzed the email and concluded that it is a phishing attempt. This email is written by scammers who pretend to be a company that delivers packages (a courier). The goal is to trick recipients into disclosing personal information and (or) sending money to scammers. Such emails should be ignored to avoid potential risks.