Virus and Spyware Removal Guides, uninstall instructions

What is CetaRAT?

CetaRAT is a malicious program classified as a Remote Access Trojan (RAT). Malware of this type can remotely access and control infected machines. CetaRAT has been observed being proliferated via spam mail and heavily targeting governmental bodies.

What is Decaf ransomware?

Decaf is a ransomware-type program. It is designed to encrypt data and demand ransoms for the decryption. In other words, this software renders files inaccessible and asks for payment to restore access.

Files are appended with the ".decaf" extension. For example, a file initially titled "1.jpg would appear as "1.jpg.decaf", "2.jpg" as "2.jpg.decaf", "3.jpg" as "3.jpg.decaf", and so forth. Once this process is complete, a ransom note - "README.txt" - is created.

What is FlexProduct?

FlexProduct is a piece of rogue software. It is classified as adware, and it has browser hijacker qualities as well. Since most users inadvertently download/install apps of this type, they are also considered to be PUAs (Potentially Unwanted Applications).

What is Cggbt ransomware?

Cggbt is a ransomware-type programs. It operates by encrypting data (rendering files inaccessible) and demanding payment for the decryption.

Files are appended with a random character string and a ".cggbt" extension. For example, a file like "1.jpg" would appear similar to "1.jpg.a0Q9UvAfTJE8ExLh3D_4SLTw5zGdCLfG9FMzuLU5KJD_0f7EROYY2T40.cggbt", and so on for all of the affected files.

Once the encryption process is finished, a text file titled "rn9D_HOW_TO_DECRYPT.txt" is dropped onto the desktop. This file contains Cggbt's ransom note.

What is FocusGuide?

FocusGuide is an adware-type app with browser hijacker qualities. Due to the questionable methods used to distribute such software products, they are also classified as PUAs (Potentially Unwanted Applications).

What is GoCouponSearch?

GoCouponSearch is a browser hijacker promoting the gocouponsearch.com fake search engine. Since most users unintentionally download/install software products of this type, they are also categorized as PUAs (Potentially Unwanted Applications).

What is "HP ePrint" email scam?

"HP ePrint Email Scam" refers to a spam campaign. These emails attempt to trick recipients into trying to log into their mail accounts through a phishing website - in order to view a fake scanned document sent to them. Therefore, by trusting these fake letters - recipients can lose their email accounts and experience other serious issues.

What is Macube Cleaner?

Macube Cleaner is advertised as a professional cleaning and optimization tool for macOS that can quickly clean up trash, old or large files, rarely used files and applications, free up disk space. However, this app is distributed questionable methods.

Therefore, it is likely that users who have installed Macube Cleaner on their computers did it unknowingly. Apps that users download and install inadvertently are called potentially unwanted applications (PUAs). It is not recommended to have PUAs installed on browsers or computers.

What is "Windows_Firewall_Protection_Alert"?

"Windows_Firewall_Protection_Alert" is a technical support scam promoted on various rogue websites. It makes fake claims about users' devices being infected with malware and urges them to contact Microsoft's support. It must be emphasized that this scam is in no way associated with the Microsoft Corporation, and all of its claims are false.

Scams are designed to generate revenue at victims' expense; tech support scams do so in various ways - mostly incorporating calls to fraudulent helplines and remote access to victims' devices. Furthermore, it must be stressed that no site can detect issues/threats present on visitors' computers; hence, all that make such statements - are scams.

What is Huylock ransomware?

Part of the MedusaLocker ransomware group, Huylock is a malicious program designed to encrypt data (render files inaccessible) and demand ransoms for the decryption.

During the encryption process, files are appended with the ".huylock" extension. For example, a file like "1.jpg" would appear as "1.jpg.huylock", "2.jpg" as "2.jpg.huylock", etc. Afterwards, a ransom note - "HOW_TO_RECOVER_DATA.html" - is dropped onto the desktop.