Virus and Spyware Removal Guides, uninstall instructions

What kind of website is searches-world.com?

While investigating deceptive sites, our researchers found an installer containing a browser hijacker that promotes the searches-world.com fake search engine.

Typically, browser-hijacking software endorses (via redirects) such sites by modifying browser settings. However, this setup made no alterations to the browser on our test machine. It also used an intricate persistence-ensuring mechanism to complicate its removal.

What kind of website is searchtabs.io?

Searchtabs.io is the address of a fake search engine. During a routine inspection of suspicious sites, our researchers found a deceptive page using a pornographic lure to push an installation setup. This installer contained a browser hijacker promoting the searchtabs.io website.

While software within this classification usually endorses sites by making changes to browser settings, this setup made no alterations to the browser on our testing system. It is noteworthy that this hijacker utilizes a persistence-ensuring mechanism to prevent users from recovering their browsers.

What kind of software is Your Errors Team?

Your Errors Team is a rogue browser extension that we discovered during a routine inspection of questionable websites. This piece of software is endorsed as a tool with access to a database of over 500 website errors and glitches.

Our examination of this extension revealed that it is advertising-supported software (adware). Your Errors Team is designed to run intrusive advertisement campaigns.

What kind of software is Wikiped Today?

Our researchers discovered the Wikiped Today browser extension while inspecting suspect websites. It promises quick access to tidbits concerning historical events from Wikipedia.

After analyzing this extension, we determined that it is a browser hijacker. Wikiped Today makes modifications to browser settings in order to promote (through redirects) the goog.wikipedtoday.com fake search engine. Additionally, this piece of software spies on users' browsing activity.

What kind of scam is "Operating System Blocked Due To Questionable Activity"?

While investigating suspicious websites, our researchers discovered the "Operating System Blocked Due To Questionable Activity" technical support scam. The aim of this deceptive content is to trick users into calling fake Microsoft support in order to unblock their device and resolve other potential issues.

It must be stressed that all the information provided by this scam is false, and it is in no way associated with Windows or its developer – Microsoft.

What kind of page is gemshaper[.]top?

Our research team found the gemshaper[.]top rogue page while reviewing questionable websites. Two appearance variants of this webpage were discovered, both using fake CAPTCHA tests to promote browser notification spam. Additionally, this site can generate redirects to other (likely dubious/malicious) pages.

Most visitors to gemshaper[.]top and similar webpages enter them via redirects caused by websites that utilize rogue advertising networks.

What kind of application is Close All Tabs?

The Close All Tabs application is marketed as a convenient tool for swiftly closing all open tabs, including pinned tabs and those in incognito mode, with just one click. However, upon inspection, it has come to light that Close All Tabs exhibits intrusive advertisements. Such applications are typically classified as adware due to their ad-displaying behavior.

What kind of application is New key?

Upon examining the New key browser extension, it has been concluded that its purpose is to function as a browser hijacker. More precisely, this app is created to change the settings of hijacked browsers to force users to use keysearchs.com, a fake search engine. Applications of this nature should not be regarded as trustworthy.

What kind of malware is Keylock?

Keylock is a ransomware-type program discovered by our researchers during a routine inspection of new file submissions to the VirusTotal platform. Ransomware operates by encrypting files to demand payment for the decryption.

On our testing system, Keylock encrypted files and appended their filenames with a ".keylock" extension. To elaborate, a file originally named "1.jpg" appeared as "1.jpg.keylock", "2.png" as "2.png.keylock", and so forth for all of the affected files.

After the encryption process was completed, a ransom-demanding message titled "README-id-[username].txt" was created (filename varying based on the username; "README-id-KAROLISLIUC875C.txt" on our test machine). Keylock also changed the desktop wallpaper.

What is "Intuit QuickBooks Database Encryption Upgrade"?

After careful analysis, it has been established that this email intends to entice recipients to open the attached file and submit their personal information. This email is disguised as correspondence from Intuit, an American business software company. Such emails, often referred to as phishing emails, are a common form of online deception.