Virus and Spyware Removal Guides, uninstall instructions

What is Mifr?

Mifr is designed to encrypt victims' files, modify their filenames and create the "!INFO.HTA" file (ransom message) in each folder that contains at least one encrypted file. Mifr renames files by adding the hiden_pro@aol.com email address, victim's ID, and appending the ".mifr" extension.

For example, "1.jpg" is renamed to "1.jpg.[Hiden_pro@aol.com][PCZ687IRV9YHTB0].mifr", "2.jpg" to "2.jpg.[Hiden_pro@aol.com][PCZ687IRV9YHTB0].mifr", and so on. Note that Mifr belongs to the family of ransomware called VoidCrypt.

What is SmartControl?

SmartControl is an adware-type application with browser hijacker traits. Once successfully infiltrated into systems, this app begins running intrusive advertisement campaigns and makes modifications to browser settings to promote fake search engines.

In addition, most adware-type apps and browser hijackers monitor users' browsing activity. Due to the dubious methods employed in SmartControl's distribution, it is also classified as a Potentially Unwanted Application (PUA).

What is sonoffer[.]online?

Users do not generally visit sonoffer[.]online or similar sites intentionally - they are redirected to them via other dubious websites, deceptive advertisements, or their browsers have potentially unwanted applications (PUAs) installed on them.

Some examples of other pages similar to sonoffer[.]online are indexspotcaptcha[.]com, atinterboa[.]space and tutupdate29[.]com.

What is 4KMovieSearch?

4KMovieSearch is dubious software classified as a browser hijacker. It modifies browser settings to promote 4kmoviesearch.com (a bogus search engine). Additionally, most browser hijackers have data tracking capabilities, which are employed to monitor users' browsing activity.

Due to the dubious techniques used to proliferate 4KMovieSearch, it is also classified as a Potentially Unwanted Application (PUA).

What is Booa?

Booa belongs to the Djvu ransomware family. It prevents victims from accessing their files by encryption and creates a ransom message ("_readme.txt" file) that contains details such as cost of decryption software and key and how to contact cyber criminals.

Booa also renames files by appending the ".boaa" extension to their filenames. For example, "1.jpg" is renamed to "1.jpg.booa", "2.jpg" to "2.jpg.booa", and so on.

What is CTRM ransomware?

CTRM ransomware encrypts files and renames them. It also creates the "CTRM_INFO.rtf" file (ransom message) in all folders that contain encrypted files. CTRM renames files by replacing their filenames with the citrteam@yahoo.com email address, a string of random characters, and appending ".CTRM" as the file extension.

For example, "1.jpg" is renamed to "[Citrteam@yahoo.com].orSl0b2S-zT5rOiZG.CTRM", "2.jpg" to "[Citrteam@yahoo.com].plDg9v3D-pR4h9kLF.CTRM", and so on. Note that CTRM belongs to the family of ransomware called Matrix.

What is Swat ransomware?

Swat is malicious software belonging to the VoidCrypt ransomware family. Systems infected with this malware experience data encryption and users receive ransom demands for decryption tools.

When this ransomware encrypts, affected files are renamed following this pattern: original filename, cyber criminals' email address, unique ID assigned to the victim, and the ".swat" extension. For example, a file named "1.jpg" would appear as something similar to "1.jpg.[coinloby@gmail.com][86GANMJB5OXRZFT].swat" following encryption.

After this process is complete, ransom messages within "!INFO.HTA" files are dropped into compromised folders.

What is cenesserie[.]fun site?

cenesserie[.]fun is a rogue website sharing many similarities with indexspotcaptcha.com, nlyimprese.fun, atinterboa.space and countless others. Visitors to this page are presented with dubious content and are redirected to other untrustworthy or possibly malicious sites.

Few visitors access cenesserie[.]fun or other similar websites intentionally - most are redirected to them by intrusive ads or by Potentially Unwanted Applications (PUAs). This software does not require explicit consent to infiltrate systems, and thus users may be unaware of its presence. PUAs cause redirects, run intrusive advertisement campaigns and collect browsing-related information.

What is AutoIncognitoSearch?

AutoIncognitoSearch is classified as browser hijacker because it promotes autoincognitosearch.com, the address of a fake search engine by modifying certain browser settings. Furthermore, it is likely that this app also gathers information relating to web browsing activities.

Typically, users do not download or install browser hijackers intentionally and, therefore, AutoIncognitoSearch and similar apps are classified as potentially unwanted applications (PUAs).

What is indexspotcaptcha[.]com?

There are many websites similar to indexspotcaptcha[.]com on the internet. Some examples are nlyimprese[.]fun, atinterboa[.]space and tutupdate29[.]com.

Note that users do not visit these web pages intentionally - they are opened by browsers with potentially unwanted applications (PUAs) installed on them.