Virus and Spyware Removal Guides, uninstall instructions

What kind of malware is Crypto24?

Crypto24 is a malicious program classed as ransomware. Software within this classification is designed to encrypt data and demand payment for the decryption.

Crypto24 encrypts files and adds a ".crypto24" extension to their filenames. For example, a file initially named "1.jpg" appears as "1.jpg.crypto24", "2.png" as "2.png.crypto24", and so on. After the encryption process is concluded, this ransomware creates a ransom note titled "Decryption.txt".

What kind of email is "Mailbox Abuse Notice"?

Our examination of the "Mailbox Abuse Notice" email revealed that it is spam. This phishing message is presented as an email security alert claiming that suspicious activity has been detected on the recipient's account. This spam mail aims to trick victims into disclosing their email log-in credentials (passwords).

What kind of email is "Smartcolor Password Expiry"?

After inspecting the "Smartcolor Password Expiry" email, we determined that it is spam promoting a phishing scam. This mail is presented as a password expiration alert, which is intended to lure recipients into disclosing their email account log-in credentials.

What kind of email is "Abu Dhabi National Oil Company (ADNOC)"?

Our inspection of the "Abu Dhabi National Oil Company (ADNOC)" email revealed that it is fake. This spam letter is presented as an invitation for vendors, contractors, suppliers, and other potential partners to receive an ITT (Invitation To Tender).

The goal of this email is likely to collect sensitive information and possibly deceive recipients into sending scammers money. It must be stressed that this fraudulent message is in no way associated with the actual Abu Dhabi National Oil Company (ADNOC).

What kind of page is totaldailyposts[.]com?

Our research team discovered totaldailyposts[.]com while browsing dubious websites. Upon inspection, we learned that this rogue page pushes browser notification spam and redirects users to other (likely unreliable/malicious) sites.

Most visitors enter webpages like totaldailyposts[.]com via redirects caused by websites utilizing rogue advertising networks.

What kind of page is suddss[.]com?

Suddss[.]com is a rogue website discovered by our research team during a routine investigative browsing session. After inspecting this page, we determined that it promotes browser notification spam and generates redirects to other (likely untrustworthy/malicious) sites.

Most visitors to suddss[.]com and similar webpages access them via redirects produced by websites using rogue advertising networks.

What kind of page is undowinowing[.]com?

During the examination of undowinowing[.]com, we found that the site employs a deceptive method to receive permission to show its notifications. Once permission is granted, undowinowing[.]com can send intrusive and deceptive notifications. Consequently, users should avoid visiting the site and, more importantly, allowing undowinowing[.]com to send notifications.

What kind of page is masented[.]com?

Our research team found the masented[.]com rogue page while investigating dubious websites. After examining it, we learned that it promotes spam browser notifications and redirects visitors to different (likely unreliable/harmful) sites.

Masented[.]com and similar pages are most commonly accessed through redirects caused by websites that employ rogue advertising networks.

What kind of page is unadshub[.]com?

While analyzing unadshub[.]com, we found that it employs a clickbait tactic to gain permission to display notifications. Usually, pages like unadshub[.]com can send fraudulent notifications. Therefore, users should avoid accepting notifications from unadshub[.]com and remove permission to show them if already granted.

What kind of malware is Cipher (Proton)?

While reviewing new malware submissions to the VirusTotal website, our researchers discovered Cipher ransomware. This malicious program is part of the Proton ransomware family. Malware of this kind encrypts data and demands payment for the decryption.

On our testing system, Cipher (Proton) ransomware encrypted files and appended their filenames with the cyber criminals' email address and a ".cipher" extension. For example, a file originally named "1.jpg" appeared as "1.jpg.[watchdogs20@tuta.io].cipher", and so on.

Once the encryption process was concluded, this ransomware created ransom notes in a full-screen message displayed before the log-in screen, desktop wallpaper, and a text file named "#Read-for-recovery.txt".