Virus and Spyware Removal Guides, uninstall instructions

What is CleanBlocker?

CleanBlocker is a rogue browser extension that our researchers discovered while inspecting deceptive websites. This piece of software is presented as an adblocker that can stop website tracking and block various advertisements. However, our analysis revealed that CleanBlocker's operates oppositely - it runs intrusive advertisement campaigns. Due to this behavior, this extension is classified as adware.

What kind of application is Web Video Player?

While testing the Web Video Player browser extension, we found that it shows intrusive advertisements, can read and change data on all websites, and display notifications. We discovered Web Video Player on a deceptive website. Since this app shows ads, we classified it as adware.

What is "Movies" adware?

"Movies" is a piece of advertising-supported software (adware) belonging to the ChromeLoader malware family. This software operates by running intrusive advertisement campaigns.

Furthermore, ChromeLoader apps are known to install multiple unwanted/malicious extensions on Chrome browsers. Hence, if Movies is present on your system, it is likely that harmful browser extensions have infiltrated the device as well.

Our researchers discovered Movies when they downloaded a VHD file from a deceptive website.

What is Chily ransomware?

While checking out new malware submissions to VirusTotal, our research team found the Chily ransomware. This malicious program is designed to encrypt data and demand ransoms for decryption.

Once we executed a sample of Chily on our test machine, it began encrypting files and altered their filenames. Original file titles were appended with a ".[Chily@Dr.Com]" extension, e.g., a file like "1.jpg" appeared as "1.jpg.[Chily@Dr.Com]", "2.png" as "2.png.[Chily@Dr.Com]", and so forth on our testing system.

Afterwards, this ransomware changed the desktop wallpaper and created a ransom-demanding message named "Read Me.Hta".

What kind of email is "Incoming Failed Messages"?

After investigating this email, we found that it is a fake letter from an email service provider. It is created by scammers who aim to trick recipients into providing sensitive information on a phishing website. This email must be ignored.

What kind of email is "Annual Salary Adjustment"?

After inspecting the "Annual Salary Adjustment" email, we determined that it is spam. This mail operates as a phishing scam. It aims to deceive recipients into disclosing their email log-in credentials by promoting a fake file-sharing website that requests this information for identity confirmation.

What kind of malware is CrySpheRe?

CrySpheRe is one of the Xorist ransomware variants designed to encrypt files. We discovered CrySpheRe ransomware while checking the VirusTotal page for recently submitted malware samples. While investigating CrySpheRe, we learned that it appends the ".CrySpheRe" extension to filenames, displays a pop-up window, and creates the "КАК РАСШИФРОВАТЬ ФАЙЛЫ.txt" file.

CrySpheRe's pop-up window and text file contain the same ransom note. An example of how CrySpheRe renames files: it changes "1.jpg" to "1.jpg.CrySpheRe", "2.png" to "2.png.CrySpheRe", and so forth.

What is the Ouroboros browser?

Ouroboros is a rogue browser that our research team discovered while inspecting suspicious software-promoting websites.

This browser likely has advertising-supported software (adware) functionalities. Ouroboros also shares traits with browser hijackers in that it can cause redirects to fake search engines, specifically the ouroborosbrowser.com website. It is pertinent to mention that this browser likely spies on users' browsing activity as well.

Due to the dubious methods used to distribute Ouroboros, it is classified as a PUA (Potentially Unwanted Application).

What kind of page is erbi90s[.]click?

We examined erbi90s[.]click and found that it displays deceptive messages to trick visitors into believing that their computers are infected and purchasing antivirus software. It runs the "McAfee - Your PC is infected with 5 viruses!" scam. Also, erbi90s[.]click can show untrustworthy notifications (if allowed).

What kind of malware is RPC?

RPC is ransomware that blocks access to files by encrypting them. Also, it renames files by appending the victim's ID, pcrec@tuta.io email address, and ".RPC" extension to filenames. RPC ransomware provides two ransom notes: it displays a pop-up window and creates the "recinfo.txt" file.

RPC is one of the Dharma ransomware variants. We discovered it while inspecting malware samples submitted to the VirusTotal website. An example of how RPC renames files: it changes "1.jpg" to "1.jpg.id-9ECFA84E.[pcrec@tuta.io].RPC", "2.png" to "2.png.id-9ECFA84E.[pcrec@tuta.io].RPC", and so forth.