Virus and Spyware Removal Guides, uninstall instructions

What is UtilityParse?

UtilityParse (also known as UtilityParze) is part of the Pirrit adware family. Adware-type applications feed users with various intrusive, often deceptive advertisements and collect details relating to users' browsing habits. Applications such as UtilityParse are also known as potentially unwanted applications (PUAs), since people tend to download and install them unintentionally.

What is turbostream[.]icu?

turbostream[.]icu is rogue site that presents visitors with dubious content and/or redirects to other untrusted or malicious websites. There are thousands of web pages similar to turbostream[.]icu on the internet including, for example, pushwelcome.com, thediseasetracker.com and thenickelpress.com.

Users rarely access turbostream[.]icu and similar sites intentionally - most are redirected to them by intrusive advertisements or Potentially Unwanted Applications (PUAs) already infiltrated into the system. These apps operate by causing unwanted redirects, running intrusive ad campaigns and collecting browsing-related information.

What is File Converter Live?

File Converter Live is a browser hijacker advertised as a tool for easy access to file format conversion services. It can supposedly convert DOCs, PDFs, MP3s and other formats. File Converter Live operates by making alterations to browsers to promote fileconverterlive.com (a fake search engine).

Additionally, this browser hijacker monitors and records browsing-related information. Due to the dubious proliferation methods used to spread File Converter Live, it is also classified as a Potentially Unwanted Application (PUA). Note that File Converter Live is often distributed together with another PUA called Protect My Search Daily.

What is youtubetomp3[.]sc?

youtubetomp3[.]sc is an untrusted website designed to allow people to download MP3 files from YouTube URLs. In fact, this site infringes copyright laws and employs rogue advertising networks. Therefore, visitors to youtubetomp3[.]sc might be redirected to various untrusted, deceptive and malicious web pages.

You are strongly advised against using youtubetomp3[.]sc or other similar sites.

What is MessengerPlus?

MessengerPlus is a rogue application endorsed as a Facebook messenger for desktop. In fact, this app is classified as adware, as it runs intrusive advertisement campaigns. MessengerPlus delivers unwanted and harmful ads. Since most users download/install this app inadvertently, it is also classified as a Potentially Unwanted Application (PUA).

Additionally most PUAs collect information relating to users' browsing activity, and it is highly likely that MessengerPlus has these data tracking capabilities as well.

What is protectionapps.live?

The protectionapps.live is a fake search engine, which appears in settings when the browser has been hijacked by rogue apps. These browser hijackers can change the settings and also gather information relating to users' browsing activities.

Browser hijackers are categorized as potentially unwanted applications (PUAs), since people often download and install them inadvertently.

What is videovor[.]com?

videovor[.]com is one of many websites that offers download of videos from YouTube (even though this is illegal practice). It also uses rogue advertising networks to promote other dubious websites. Typically, web pages such as videovor[.]com open sites that promote potentially unwanted applications (PUAs) such as browser hijackers and adware-type apps.

For these reasons, you should never trust or use videovor[.]com, or other websites of this type.

What is "U.S Department of Labor"?

"U.S Department of Labor" is yet another Coronavirus/COVID-19-themed spam email campaign. These messages are disguised as official notices from the "U.S. Department of Labor Wage and Hour Division", informing recipients of the latest changes made to the "Employee Request Form under the Family and Medical Leave of Act (FMLA)".

The emails advise people to carefully analyze the attached document, if they wish to request paid leave. In fact, if the malicious document is opened, it triggers the infection process of an information-stealing Trojan called TrickBot.

What kind of malware is CovidWorldCry?

CovidWorldCry was discovered by nao_sec. Like most programs of this type, it prevents victims from accessing their files by encrypting them. It also renames all files by appending an extension and creates a ransom message. CovidWorldCry appends the ".corona-lock" extension to files.

For example, it renames "1.jpg" to "1.jpg.corona-lock", "2.jpg" to "2.jpg.corona-lock" and so on. Instructions about how to contact cyber criminals regarding decryption are contained in the "README_LOCK.TXT" text file (the ransom message).

What is y2mate[.]guru?

y2mate[.]guru allows users to download videos from YouTube, however, this is illegal practice. Furthermore, most websites such as y2mate[.]guru use rogue advertising networks - they contain dubious advertisements and/or redirect visitors to other dubious websites.

Commonly, they open sites designed to advertise potentially unwanted applications (PUAs). For example, browser hijackers and adware. In any case, you are advised against using services provided by y2mate[.]guru or other similar sites.