Virus and Spyware Removal Guides, uninstall instructions

What is DC ransomware?

Belonging to the Dharma ransomware family, DC is a piece of malicious software that encrypts data (renders files unusable) and demands ransoms for the decryption.

Files are appended with a unique ID assigned to the victim, the cyber criminals' email address, and a ".DC" extension. For example, a file initially titled "1.jpg" would appear similar to "1.jpg.id-9ECFA84E.[dc1@imap.cc].DC", etc. Once this process is finished, ransom notes are created in a pop-up window and "FILES ENCRYPTED.txt".

What kind of malware is Intercobros?

Intercobros is designed to encrypt files and provide instructions on how to contact cybercriminals for data recovery. This ransomware creates a ransom note, a text file named "is_it_possible_return_back lost documents.txt".

It also appends ".intercobros-9k7syfus" extension to filenames. For instance, it renames "1.jpg" to "1.jpg.intercobros-9k7syfus", "2.jpg" to "2.jpg.intercobros-9k7syfus", and so forth.

What is OnlinePDF-Converter?

OnlinePDF-Converter is a rogue browser extension promoting the onlinepdf-converter.com fake search engine. Due to this behavior, OnlinePDF-Converter is classified as a browser hijacker. Furthermore, software products of this type are considered to be PUAs (Potentially Unwanted Applications).

What kind of software is HoroscopeZone?

The purpose of HoroscopeZone is to hijack a web browser by changing some of its settings to horoscope-zone.com (a fake search engine). Additionally, this app might be designed to gather information about its users. Most users end up having their browsers hijacked inadvertently.

What kind of malware is Hgsh?

Hgsh is the name of ransomware belonging to the Djvu ransomware family. Hgsh encrypts files and changes their extension to ".hgsh". For example, it renames "1.jpg" to "1.jpg.hgsh", "sample.png" to "sample.png.hgsh". Hgsh provides contact information and other details in a ransom note named "_readme.txt".

What is 2n7fo ransomware?

2n7fo is a piece of malicious software categorized as ransomware. It operates by encrypting data (rendering files inaccessible) and demanding payment for the decryption.

Affected files are appended with a random character string and the ".2n7fo" extension. For example, a file titled "1.jpg" would appear similar to "1.jpg.kZ62pTmbICJk_zzDPkPGxqV0XdLaKsh4_KJY1-42VvT_KWJjzS1OEWQ0.2n7fo", and so on for all of the compromised files.

Afterward the encryption process is completed, a ransom-demanding message - "zcKy_HOW_TO_DECRYPT.txt" - is dropped onto the desktop.

What is Miner RavenCoin ransomware?

Miner RavenCoin is a malicious program designed to encrypt data (render files inaccessible) and demand ransoms for the decryption. It is also a new variant of the Chaos ransomware.

Encrypted files are appended with the ".Miner RavenCoin" extension. For example, a file originally titled "1.jpg" would appear as "1.jpg.Miner RavenCoin", and so on. Afterwards, this ransomware changes the desktop wallpaper and creates a text file named "read_me.txt". Both the wallpaper and text file contact identical ransom notes.

What kind of malware is 4eoq7?

4eoq7 is ransomware that encrypts files, appends a string of random characters and the ".4eoq7" to filenames, and generates the "xAAB_HOW_TO_DECRYPT.txt" file (a ransom note).

It renames a file named "1.jpg" to "1.jpg.8-qox1JMGU9m3OS5G_bfmGT-ZgTp21IB14Hasr3Oa5j_-xKxYioG20k0.4eoq7", "2.jpg" to "2.jpg.8-qox1JMGU9m3OS5G_bfmGT-ZgTp21IB14Hasr3Oa5j_-xKxYioG20k0.4eoq7", and so on.

What is GCNl ransomware?

GCNl is a new variant of the Spora ransomware. It encrypts data (locks files) and demands ransoms from the decryption (access recovery).

Affected files are appended with a unique ID, the cyber criminals' email address, and a ".GCNl" extension. For example, a file initially titled "1.jpg" would appear similar to "1.jpg[ID=spi4sB-Mail=FilesRecoverEN@Gmail.com].GCNl", and so forth.

Once this process is completed, ransom notes are created/displayed - "ReadMe_Now!.hta" (pop-up window) and "Read_Me!_.txt".

What is "Hacker is tracking you!"?

"Hacker is tracking you!" is a scam promoted on various rogue sites. This scheme urges visitors not to close the webpage because a hacker is monitoring them. It must be emphasized that this warning is fake; furthermore, no website can detect threats present on visitors' devices.

Scams of this kind usually push various fake anti-viruses, browser hijackers, adware, and other PUAs (Potentially Unwanted Applications). Typically, users enter deceptive websites through mistyped URLs or redirects caused by untrustworthy pages, intrusive ads, or installed PUAs