Virus and Spyware Removal Guides, uninstall instructions

What is Topi?

Discovered by Michael Gillespie, Topi is a malicious program and part of the Stop/Djvu ransomware family. Systems infected with this malware have their data encrypted and receive ransom demands for decryption. When Topi ransomware encrypts, all files are appended with the ".topi" extension.

For example, "1.jpg" would appear as "1.jpg.topi" following encryption. After the process is complete, a text file ("_readme.txt") is stored on the desktop.

What is getmackeepersoftpro[.]xyz?

getmackeepersoftpro[.]xyz is a dubious website, usually opened through others of this kind, clicked deceptive advertisements or potentially unwanted applications (PUAs) that are installed on the browser and/or operating system.

At the time of research, getmackeepersoftpro[.]xyz offered download of an application called Hotspot Shield Free VPN Proxy & Wi-Fi Security, which is supposedly designed to protect operating systems from various threats. Since getmackeepersoftpro[.]xyz cannot be trusted, do not download or install any software advertised on this site.

What is "Sextortion Email (Dash)"?

Criminals behind this scam attempt to trick recipients into transferring Dash cryptocurrency to them. They state that they have recorded a compromising video and will distribute it to other people unless recipients pay a specific cryptocurrency sum. Never trust emails of this type and simply ignore them.

What is guj5.xyz?

guj5.xyz is one of many fake search engines promoted through a potentially unwanted application (PUA), a browser hijacker called CERX. This PUA is related to another app of this type called QIP. Generally, browser hijackers promote fake search engines by changing certain browser settings.

Furthermore, most collect data relating to users' browsing activities. Note that guj5.xyz might also be promoted through other browser hijackers (such as Smash App +).

What is showeverig[.]info?

When opened, showeverig[.]info opens various untrustworthy websites or loads dubious content. This is a rogue website which is very similar to wbamedia[.]net, sawhitpew[.]site, fastnewstream[.]com and many others of this type.

Typically, visitors do not open these sites intentionally - they are opened by browsers that with potentially unwanted applications (PUAs) installed on them. PUAs gather information relating to users' browsing habits and display intrusive advertisements.

What is Easy Internet Speed Test?

Easy Internet Speed Test is a rogue application supposedly designed to provide easy access to internet speed testing tools. It is categorized as a browser hijacker, due to the alterations it makes to browsers to promote search.easyinternetspeedtesttab.com, a fake search engine.

Furthermore, this app has data tracking capabilities, which are employed to monitor and record browsing-related information. Since most users install Easy Internet Speed Test inadvertently, it is classified as a Potentially Unwanted Application (PUA). Note that it is often distributed together with Hide My Searches (another PUA).

What is search.friendlysocket.com?

Identical to search.cucumberhead.com, search.listchack.com, search.smacklek.com, and dozens of other bogus sites, search.friendlysocket.com is a fake Internet search engine claiming to improve the web browsing experience by generating the most relevant search results.

These false claims often trick users into believing that search.friendlysocket.com is a legitimate website, however, developers promote this site using deceptive app 'installers' that stealthily modify web browser settings. Furthermore, this bogus website continually records various information relating to users' web browsing activity.

What is My Maps Homepage?

My Maps Homepage is a rogue app endorsed as a tool for easy access to various maps and route-related content. This application is categorized as a browser hijacker due to the changes it makes to browsers to promote search.hmymapshomepage.com, a fake search engine.

Furthermore, most browser hijackers have data tracking capabilities, which are used to monitor users' browsing activities. Since most users download/install My Maps Homepage unintentionally, it is also classified as a Potentially Unwanted Application (PUA).

What is search.gratziany.com?

search.gratziany[.]com is the address of a fake search engine. Typically, fake search engines are promoted through potentially unwanted applications (PUAs). I.e., through browser hijackers. Apps of this type promote addresses such as search.gratziany[.]com by changing certain browser settings.

Furthermore, most operate as information tracking tools and collect details relating to users' browsing habits. Generally, people download PUAs inadvertently.

What is installflash-upgrade[.]com?

InstallFlash-upgrade[.]com is a deceptive website running a fake Flash Player updater scam. Once accessed, the web page claims that visitors' Flash software might be outdated and recommends bogus updates.

Note that fake software updaters are typically used to infiltrate untrusted (e.g. Potentially Unwanted Applications - PUAs) and even malicious content (e.g. trojans, ransomware, etc.) into devices.

Sites such as installFlash-upgrade[.]com are rarely accessed intentionally - most users are redirected to them by intrusive advertisements and/or PUAs already installed on the system.