Virus and Spyware Removal Guides, uninstall instructions

What is "Sextortion Email (Dash)"?

Criminals behind this scam attempt to trick recipients into transferring Dash cryptocurrency to them. They state that they have recorded a compromising video and will distribute it to other people unless recipients pay a specific cryptocurrency sum. Never trust emails of this type and simply ignore them.

What is guj5.xyz?

guj5.xyz is one of many fake search engines promoted through a potentially unwanted application (PUA), a browser hijacker called CERX. This PUA is related to another app of this type called QIP. Generally, browser hijackers promote fake search engines by changing certain browser settings.

Furthermore, most collect data relating to users' browsing activities. Note that guj5.xyz might also be promoted through other browser hijackers (such as Smash App +).

What is showeverig[.]info?

When opened, showeverig[.]info opens various untrustworthy websites or loads dubious content. This is a rogue website which is very similar to wbamedia[.]net, sawhitpew[.]site, fastnewstream[.]com and many others of this type.

Typically, visitors do not open these sites intentionally - they are opened by browsers that with potentially unwanted applications (PUAs) installed on them. PUAs gather information relating to users' browsing habits and display intrusive advertisements.

What is Easy Internet Speed Test?

Easy Internet Speed Test is a rogue application supposedly designed to provide easy access to internet speed testing tools. It is categorized as a browser hijacker, due to the alterations it makes to browsers to promote search.easyinternetspeedtesttab.com, a fake search engine.

Furthermore, this app has data tracking capabilities, which are employed to monitor and record browsing-related information. Since most users install Easy Internet Speed Test inadvertently, it is classified as a Potentially Unwanted Application (PUA). Note that it is often distributed together with Hide My Searches (another PUA).

What is search.friendlysocket.com?

Identical to search.cucumberhead.com, search.listchack.com, search.smacklek.com, and dozens of other bogus sites, search.friendlysocket.com is a fake Internet search engine claiming to improve the web browsing experience by generating the most relevant search results.

These false claims often trick users into believing that search.friendlysocket.com is a legitimate website, however, developers promote this site using deceptive app 'installers' that stealthily modify web browser settings. Furthermore, this bogus website continually records various information relating to users' web browsing activity.

What is My Maps Homepage?

My Maps Homepage is a rogue app endorsed as a tool for easy access to various maps and route-related content. This application is categorized as a browser hijacker due to the changes it makes to browsers to promote search.hmymapshomepage.com, a fake search engine.

Furthermore, most browser hijackers have data tracking capabilities, which are used to monitor users' browsing activities. Since most users download/install My Maps Homepage unintentionally, it is also classified as a Potentially Unwanted Application (PUA).

What is search.gratziany.com?

search.gratziany[.]com is the address of a fake search engine. Typically, fake search engines are promoted through potentially unwanted applications (PUAs). I.e., through browser hijackers. Apps of this type promote addresses such as search.gratziany[.]com by changing certain browser settings.

Furthermore, most operate as information tracking tools and collect details relating to users' browsing habits. Generally, people download PUAs inadvertently.

What is installflash-upgrade[.]com?

InstallFlash-upgrade[.]com is a deceptive website running a fake Flash Player updater scam. Once accessed, the web page claims that visitors' Flash software might be outdated and recommends bogus updates.

Note that fake software updaters are typically used to infiltrate untrusted (e.g. Potentially Unwanted Applications - PUAs) and even malicious content (e.g. trojans, ransomware, etc.) into devices.

Sites such as installFlash-upgrade[.]com are rarely accessed intentionally - most users are redirected to them by intrusive advertisements and/or PUAs already installed on the system.

What is "Latest version of Adobe Flash Player"?

Displayed by various scam websites, "Latest version of Adobe Flash Player" is a deceptive message employed to trick visitors into using a fake Adobe Flash Player installer, which actually installs a potentially unwanted application (PUA) such as, for example, a browser hijacker or adware-type app.

These fake installers are commonly designed to install multiple PUAs. In some cases, they install malicious software including ransomware, Trojans, or other high-risk malware. In any case, never download or install software or files from these websites. Browsers usually open websites of this type due to PUAs that are already installed.

What is Kristina (OnyxLocker)?

Kristina (OnyxLocker) is a new variant of OnyxLocker ransomware discovered by S!Ri. It renames all encrypted files by appending the ".кристина" extension to filenames.

For example, "1.jpg" would become "1.кристина". Furthermore, Kristina (OnyxLocker) creates multiple ransom messages within text files named "Read-me!!! 0 .txt", "Read-me!!! 1 .txt"..., "Read-me!!! 19 .txt", and so on. All of the ransom messages are identical.