Virus and Spyware Removal Guides, uninstall instructions

What is bestevervideoplayers[.]info?

bestevervideoplayers[.]info is a deceptive/scam web page. Visitors to this site are informed that Flash Player might be outdated and are offered fake updates. Note that bogus software updaters are often used to proliferate untrusted content and programs such as adware, browser hijackers and other Potentially Unwanted Applications (PUAs).

Fake updaters are also high risk, as they can infect systems with malware (e.g. trojans, ransomware, etc.). Few visitors arrive at these deceptive pages intentionally - they are redirected by intrusive ads or PUAs already installed on their devices.

What kind of application is Max Uninstaller?

Max Uninstaller is a rogue program. It is advertised as a tool for efficient, effective and thorough program removal (uninstallation). In fact, it is classed as an unwanted application, due to its dubious proliferation methods - most users install Max Uninstaller unintentionally, or it infiltrates their systems under false pretences.

What kind of malware is Deal?

Discovered by dnwls0719, Deal is malicious software belonging to the Phobos ransomware family. It is designed to encrypt data and keep it locked, until a ransom is paid for decryption. During the encryption process, all files are renamed with the victim's unique ID number, developer's email address, and the ".deal" extension.

For example, "1.jpg" might be renamed to "1.jpg.id[1E857D00-2423].[butters.felicio@aol.com].deal". After the process is complete, this malicious program creates two files named "info.txt" and "info.hta", and stores them on the desktop.

What kind of malware is Glupteba?

Glupteba is a trojan-type program, malicious software that installs other programs of this type.

Cyber criminals distribute Glupteba through malicious advertisements that can be injected into legitimate websites or advertising networks. Research shows that Glubteba can be used to distribute a browser stealer or router exploiter. In any case, this malware should be uninstalled immediately.

What is BlueCheeser?

Discovered by Raby, BlueCheeser is malicious software categorized as ransomware. Devices infected with this program have their data encrypted and users receive ransom demands for decryption tools/software. When BlueCheeser encrypts, all affected files are appended with the ".himr" extension.

For example, a file originally named "1.jpg" would appear as "1.jpg.himr", and so on for all compromised files. After this process is complete, a text file ("Instructions.txt") containing the ransom message is created on the victim's desktop.

What is "Activation Warning Alert"?

"Activation Warning Alert" is a scam run by rogue web pages. It warns users of 'threats' present on their device, supposedly detected by Windows Security. Note that this scheme has no connection to Microsoft. The scam urges people to call a fake technical support number and share their Windows account and operating system details.

Most visitors to deceptive websites, which run "Activation Warning Alert" and similar scams, usually access them inadvertently - they are redirected by intrusive ads or Potentially Unwanted Applications (PUAs) already infiltrated into the device.

What is worldofcontenting[.]info?

worldofcontenting[.]info is a scam web page promoting a fake Adobe Flash Player updater. Visitors to this site are presented with deceptive information claiming that Flash Player software is out of date on the system. Note that bogus software updaters often infiltrate dubious content into devices.

For example, they can be used to proliferate adware, browser hijackers and other Potentially Unwanted Applications (PUAs) and even infect systems with malware (e.g. ransomware, trojans, etc.). Websites like worldofcontenting[.]info are usually accessed through redirects caused by intrusive ads or PUAs.

What is Easy Email Login?

Easy Email Login is a potentially unwanted application (PUA), a browser hijacker designed to provide quick access to email and social networking platforms, and various shopping and weather forecast websites. In fact, it promotes search.easyemaillogintab.net (a fake search engine) by changing browser settings, and also gathers browsing data.

People usually download and install browser hijackers (and other PUAs) unintentionally. Furthermore, Easy Email Login is installed together with another PUA called Encrypted Search.

What is PassLock?

Discovered by S!Ri, PassLock damages files irreversibly by changing their content and renaming them by appending the ".encrypted" extension. For example, "1.jpg" becomes "1.jpg.encrypted", and so on. It also displays a pop-up window, which contains instructions about what victims should do next.

Unlike most cyber criminals behind ransomware-type programs, PassLock's developers do not demand ransom payments, however, they might release an updated version that actually encrypts files and demands ransoms to restore them.

What is Template Finder Now?

Template Finder Now is a rogue app, which is advertised as a tool for easy access to various popular templates. In fact, it operates as a browser hijacker, modifying browsers and promoting a fake search engine (search.templatefindernowtab.com). Template Finder Now can also track data relating to browsing activity.

Due to its dubious proliferation methods (i.e., most users install this app inadvertently), it is also classified as a Potentially Unwanted Application (PUA). Note that Template Finder Now is often distributed together with Encrypted Search, another PUA.