Virus and Spyware Removal Guides, uninstall instructions

What is PLAY ransomware?

PLAY is the name of a ransomware-type program. Malware categorized as such operates by encrypting data and demanding ransoms for the decryption.

After we executed a sample of this ransomware on our test machine, it encrypted files and appended their filenames with a ".PLAY" extension. For example, a file titled "1.jpg" appeared as "1.jpg.PLAY", "2.png" as "2.png.PLAY", etc. Once the encryption process was completed, PLAY created a text file named "ReadMe.txt" on the desktop.

What kind of malware is Dracarys?

Dracarys is the name of Android spyware - malware that monitors activity and steals sensitive information. This spyware is distributed via fake websites by disguising it as legitimate applications. Trojanized apps have malicious code inserted into them to avoid detection.

What is the "Apple Security Center" scam?

While inspecting dubious websites, our research team discovered the "Apple Security Center" tech support scam that targets Apple device users. Schemes of this kind trick victims into calling fake support lines by making claims about nonexistent system infections.

What kind of scam is "Email Storage Warning Message"?

After analyzing this email, we concluded that it is a phishing email used to trick recipients into providing personal information. It masquerades as a warning message from the email service provider. This email contains a link designed to open a deceptive page.

What kind of email is "Windows Defender Subscription"?

Our analysis of the "Windows Defender Subscription" email revealed that it is spam. This fake letter is presented as a notification regarding the purchase of a one-year subscription for the Windows Defender security software.

It must be emphasized that this is a scam, and it is in no way associated with the Microsoft Defender Antivirus (formerly known as Windows Defender).

What kind of website is imilroshoors[.]com?

After examining imilroshoors[.]com, we learned that the purpose of this page is to trick visitors into agreeing to receive notifications and redirect them to other pages. We discovered imilroshoors[.]com while inspecting other pages (websites that use rogue advertising networks). Such pages do not get visited intentionally.

What kind of page is captchastate[.]link?

Captchastate[.]link is a rogue webpage that promotes browser notification spam and redirects visitors to other (likely dubious/malicious) sites.

Our researchers found this page while inspecting websites that use rogue advertising networks. It is noteworthy that the redirects caused by such sites are how most users enter captchastate[.]link and similar webpages.

What kind of malware is Oiltraffic?

Oiltraffic is ransomware that our team discovered while analyzing malware samples submitted to the VirusTotal website. We learned that Oiltraffic is part of the VoidCrypt family. It encrypts files, appends the victim's ID, lokilocker@tutanota.com email address, and ".Oiltraffic" extension to filenames. Also, it drops the "unlock-info.txt" file/a ransom note.

An example of how Oiltraffic renames files: it changes "1.jpg" to "1.jpg.(CW-RO1267394058)(lokilocker@tutanota.com).Oiltraffic", "2.png" to "2.png.(CW-RO1267394058)(lokilocker@tutanota.com).Oiltraffic", and so forth.

What is AdjustableRotator?

AdjustableRotator is a rogue application that our researchers discovered during a routine investigation of new submissions to VirusTotal. Our analysis of this app revealed that it works as advertising-supported software (adware). We also determined that AdjustableRotator belongs to the AdLoad malware family.

What kind of application is VibeProfile?

After examining the VibeProfile application, we learned that it displays annoying advertisements and can read sensitive information. We found this app on a deceptive page claiming that some installed software is out of date. Apps that generate advertisements are classified as adware. In most cases, adware is promoted without disclosing that it shows ads.