Virus and Spyware Removal Guides, uninstall instructions

What kind of malware is Crocodile Smile?

While investigating file submissions to the VirusTotal platform, our researchers discovered the Crocodile Smile ransomware. This malicious program operates by encrypting data and demanding ransoms for the decryption.

After we executed a sample of Crocodile Smile on our test machine, it began encrypting files. Names of the affected files were appended with a ".CrocodileSmile" extension, e.g., "1.jpg" appeared as "1.jpg.CrocodileSmile", "2.png" as "2.png.CrocodileSmile", and so forth for all of the encrypted files.

Once this process was completed, Crocodile Smile changed the desktop wallpaper and created a ransom note titled "READ_SOLUTION.txt".

What kind of scam is a fake notification from Reserve Bank of Australia?

Following our inspection, it is clear that this email is a phishing scam posing as a notification from the Reserve Bank of Australia. Crafted by scammers, the deceptive email aims to lure unsuspecting recipients into disclosing sensitive personal information. Recipients should exercise caution to avoid falling victim to such malicious tactics.

What kind of malware is L00KUPRU?

During our analysis of malware samples submitted to VirusTotal, we encountered L00KUPRU, a ransomware variant belonging to the Xorist family. This ransomware encrypts files, triggers a pop-up window, and generates a "HOW TO DECRYPT FILES.txt" file, both of which contain a ransom note.

Also, L00KUPRU renames files by appending its extension (".L00KUPRU") to filenames. For instance, it changes "1.jpg" to "1.jpg.L00KUPRU", "2.png" to "2.png.L00KUPRU", and so forth.

What kind of application is IndexerTask?

Upon thorough analysis, it has been determined that IndexerTask is a deceitful application designed to flood users with intrusive advertisements. As a result, IndexerTask has been categorized as adware. Users commonly unknowingly download and install such software, unaware of its tendency to showcase unwanted ads.

What kind of application is DynamicPositive?

After careful examination, it has been established that DynamicPositive is an untrustworthy application crafted to inundate users with intrusive advertisements. Consequently, DynamicPositive has been categorized as adware. Typically, users inadvertently download and install such software, unaware of its propensity to display unwanted ads.

What kind of page is idesmasp[.]com?

We discovered idesmasp[.]com while investigating suspicious sites. This rogue page promotes browser notification spam and can redirect users to different (likely unreliable/hazardous) websites.

Most visitors to webpages similar to idesmasp[.]com access them through redirects caused by sites using rogue advertising networks.

What kind of application is SyncProcess?

We discovered SyncProcess adware while browsing new submissions to the VirusTotal platform. This application belongs to the AdLoad malware family. SyncProcess is designed to generate through advertising.

What kind of page is moltenmoldmaster[.]com?

Moltenmoldmaster[.]com is a rogue webpage found by our researchers during a routine inspection of untrustworthy sites. Our examination revealed that this page endorses spam browser notifications and redirects to other (likely dubious/dangerous) websites.

Most users access webpages like moltenmoldmaster[.]com via redirects caused by sites utilizing rogue advertising networks.

What kind of malware is Charity?

Charity is a ransomware-type program. Typically, malware within this classification encrypts files and demands ransoms for the decryption. However, the Charity malicious program did not encrypt data at the time of research.

Instead, Charity displayed a fullscreen message containing a standard ransom note. It must be mentioned that updated variants of Charity that will operate as file-encrypting ransomware might be released in the future.

What kind of application is PracticalDisplay?

Our researchers found the PracticalDisplay application while reviewing new submissions to the VirusTotal website. After investigating this piece of software, we determined that it is adware. PracticalDisplay is part of the AdLoad malware family. This app operates by delivering intrusive advert campaigns.