Virus and Spyware Removal Guides, uninstall instructions

What is Advanced Password Manager?

Advanced Password Manager is a software tool, an application that is promoted as a password manager. According to the developers, it allows users to organize their passwords in one place without having to remember them.

This may seem to be a useful tool, especially for people who have many password-protected accounts, however, developers promote it using the "bundling" method. For this reason, Advanced Password Manager is categorized as a potentially unwanted application (PUA).

What is SadComputer?

SadComputer is a ransomware-type virus discovered by MalwareHunterTeam. This malware infection encrypts stored files so that develops can blackmail victims (files remain encrypted until a ransom is paid). Note that SadComputer deletes those files that are larger than the amount of memory SadComputer is capable of allocating.

During encryption, SadComputer adds the ".sad" appendix to the name of each compromised file. For example, "1.jpg" is renamed to "1.jpg.sad". Additionally, SadComputer opens a pop-up window and places a text file ("sadcomputer_note.txt") in every existing folder.

What is Browec?

Discovered by Michael Gillespie, Browec is yet another ransomware virus that belongs to the Djvu malware family. As with its predecessor, Browec encrypts stored data (thereby making it unusable) and adds the ".browec" extension to each filename. For example, "1.jpg" is renamed to "1.jpg.browec". Browec also stores a text file ("_readme.txt") in each folder.

What is "apple.com-clear[.]live"?

apple.com-clear[.]live is a scam website that is used to promote the Cleanup My-Mac application. This website displays a fake virus alert and encourages users to remove 'computer infections' by downloading and installing the aforementioned potentially unwanted application (PUA).

Generally, people do not visit apple.com-clear.live intentionally - they are redirected to it by PUAs that are already installed on their computers or web browsers. Most PUAs cause redirects to scams or other dubious sites, feed users with advertisements, and gather data relating to browsing habits.

What is vercallactont[.]com?

vercallactont[.]com is one of many, virtually identical, rogue websites. Other examples are butitereventwil[.]info, refrebrepheon[.]info, and ketintontrat[.]info. This site causes redirects to other dubious, deceptive websites or displays dubious content.

Generally, users arrive at vercallactont[.]com unintentionally - potentially unwanted applications (PUAs) installed on their systems force redirects to it. Typically, people install PUAs inadvertently. Furthermore, when installed, they deliver intrusive ads and gather data relating to users' browsing habits.

What is youtubnow[.]com?

The youtubnow[.]com websites allows users to download videos from YouTube in the .mp4 video format, or audio only in .mp3 or .webm formats. This service can be used via the website and a desktop application. Note that youtubnow[.]com is not malicious, however, downloading videos from YouTube is illegal.

Furthermore, this page uses advertising networks. Therefore, it displays pop-up and other ads, opens dubious web pages, and causes redirects that might lead to download or installation of various potentially unwanted applications (PUAs).

What is "Hiding Taxes"?

The "Hiding Taxes" scam is proliferated by sending emails to many people. Scammers behind it attempt to trick people into sending money (cryptocurrency). They threaten to proliferate information about the supposed recipient's tax evasion activity. In fact, all statements in this scam are false. Never trust these emails.

What is LOVE?

Discovered by Jakub Kroustek and Belonging to the Dharma malware family, LOVE is a malicious program that cyber criminals (developers) use to block access to data. This ransomware-type program is used to encrypt files and prevent access to them unless a ransom is paid.

 This ransomware renames encrypted files by adding an extension which contains the victim's ID, an email address for contacting cyber criminals, and the name of the ransomware.

For example, "1.jpg" might be renamed to a filename such as "1.jpg.id-1E857D00.[seeyoubro@tutanota.com].LOVE". It also creates a short ransom message with the "FILES ENCRYPTED.txt" text file and displays an extended version of this in a pop-up window.

What is Guvara?

Discovered by Michael Gillespie, Guvara is a malicious program that belongs to the Djvu ransomware family. As with most ransomware, Guvara encrypts data and keeps it that state until a ransom is paid. Guvara renames each encrypted file by adding the ".guvara" extension.

For example, "1.jpg" becomes "1.jpg.guvara". It also stores a text file ("_readme.txt") containing a ransom message in every folder that contains encrypted files.

What is French101?

Discovered by security researcher Petrovic, French101 is malicious software categorized as ransomware. Developers use it to block access to users' files by encryption. To regain access to their data, victims are encouraged to pay a ransom. Like most ransomware-type programs, it renames encrypted files by adding its own extension.

In this case, it changes the name of the file to a random string and adds the ".french101" extension. For example, "1.jpg" might be renamed to a filename such as "bvMqp5yz0AL98A.french101". French101 also creates a ransom message within the "HOW TO RECOVER ENCRYPTED FILES.TXT" text file.