Virus and Spyware Removal Guides, uninstall instructions

What is "International Official Lottery"?

"International Official Lottery" is a phishing scam promoted on various deceptive websites. It is presented as an online lottery, which users supposedly take part simply by entering the scam web page.

Once users attempt to collect their winnings, however, they are redirected to different websites, which steal the information entered into them (e.g. credit card and digital wallet details, email addresses and telephone numbers).

Most visits to these deceptive/scam pages occur via redirects caused by intrusive advertisements or Potentially Unwanted Applications (PUAs) already infiltrated into the system.

What is Kwampirs?

Kwampirs is a Remote Access Trojan (RAT), a type of malware that allows cyber criminals to control infected devices remotely. Once a RAT is connected to a computer, cyber criminals can access stored files, download malware, acquire login credentials and other personal information, and so on.

Research shows that cyber criminals behind Kwampirs target companies and organizations in various industries and attempt to access data that can be used to generate revenue.

What is the Rubly screenlocker?

Discovered by malware analyst Karsten Hahn, Rubly is screenlocker malware. It operates by locking the screen, displaying a full-screen window, and damaging the Master Boot Record (MBR) so that ransom demands can be made.

Rubly also claims to have encrypted the data stored on the infected system, which is a common characteristic of ransomware-type malicious programs.

What is KENS@TUTA.IO?

KENS@TUTA.IO was discovered by GrujaRS and belongs to the GlobeImposter ransomware family. These programs are designed to prevent victims from accessing or using their files by encryption. They also change the filenames of all encrypted files and create and/or display ransom messages.

KENS@TUTA.IO creates the "how_to_back_files.html" file and renames affected files by appending the ".KENS@TUTA.IO" extension to filenames. For example, it renames a file named "1.jpg" to "1.jpg.KENS@TUTA.IO", "2.jpg" to "2.jpg.KENS@TUTA.IO", and so on.

What is Coupon Search?

Coupon Search is a potentially unwanted application (PUA), a browser hijacker that promotes a fake search engine (searchforcoupons-svc.org) by changing certain browser settings to searchforcoupons-serp.org. Commonly, browser hijackers are designed to promote fake search engines and also to track and record information.

They are classified as PUAs, since people often download and install them inadvertently.

What is "Update to the latest version of HD Video Player"?

There are many deceptive websites designed to deceive visitors into using a fake Adobe Flash Player installer, which supposedly updates the currently installed version. Typically, these bogus installers install one or multiple potentially unwanted applications (PUAs) such as browser hijackers and adware-type apps.

In some cases, they are used to infect systems with malicious software including ransomware and Trojan-type programs. In any case, fake Adobe Flash Player installers that are promoted through unofficial websites can never be trusted and should be avoided.

What is the "2020 Web Research Survey" scam?

"2020 Web Research Survey" is a scam promoted on deceptive websites. This scheme claims that people can win a complimentary reward if they complete a short survey. Rather than receiving the promised rewards, however, users are redirected to other scam sites.

During research, the scheme redirected to various phishing websites, which steal personal information such as names, addresses, telephone numbers, emails, credit card details, etc. These sites might also request users to make fake shipping, registration, subscription fees, or similar payments.

Few users access deceptive/scam websites intentionally - most are redirected to them by intrusive ads or Potentially Unwanted Applications (PUAs) already installed on the system.

What is SearchAnything?

SearchAnything (also known as Search Anything) is an application designed to customize the browser and improve the browsing experience. In fact, it is a browser hijacker that promotes searchanything.co (the address of a fake search engine) by changing hijacked browser settings.

Furthermore, it can access and record information relating to users. Typically, apps of this type target browsing data. In most cases, users download and install apps such as SearchAnything (browser hijackers) inadvertently. Therefore, they are classified as potentially unwanted applications (PUAs).

What is Templates Here Tab?

Templates Here Tab is a rogue application categorized as a browser hijacker. It is endorsed as a tool for easy access to various templates. Following successful installation, however, it modifies browser settings to promote hp.htemplateshere.co (a fake search engine).

This app can also track browsing-related information. Since most users download/install this app inadvertently, it is classified as a PUA (Potentially Unwanted Application). Note that Templates Here Tab is often distributed together the Hide My Searches PUA.

What is ActiveTrack?

ActiveTrack is an application from the AdLoad adware family. It is designed to display advertisements, promote a fake search engine, and might also operate as an information tracking tool. This application is partly adware and partly a browser hijacker.

People often download and install apps of this type inadvertently and, therefore, they are classified as potentially unwanted applications (PUAs). Note that ActiveTrack is distributed through a fake Adobe Flash Player installer.