Virus and Spyware Removal Guides, uninstall instructions

What is games.searchalgo.com?

games.searchalgo.com is a fake search engine that, according to its developers, allows users to search for an unlimited number of free games. This search engine may seem legitimate and useful, but developers promote it via a potentially unwanted application (PUA), a browser hijacker called iGames Search.

Most users install browser-hijacking apps unintentionally. When installed, iGames Search modifies browser settings and collects browsing-related data (as does games.searchalgo.com).

What is Gdb?

First discovered by Jakub Kroustek, Gdb is a high-risk virus categorized as ransomware belonging to the Dharma family.  Once a computer is infected with this virus, users' files are locked and encrypted. The ".gdb" extension (that includes an ID number and an email address) is added to every infected file.

For example, "sample.jpg" might be renamed to a filename such as "sample.jpg.id-1E857D00.[GetDataBack@fros.cc].gdb". It also displays a pop-up window with a ransom-demand message and places a text file on the desktop named "FILES ENCRYPTED.txt".

What is "My virus captured all your personal data Email Scam"?

"My virus captured all your personal data Email Scam" is an email that is categorized as being part of a spam campaign. Cyber criminals who send these emails attempt to trick people into believing that they have recorded compromising material (embarrassing photos or videos of users), and then make ransom demands.

Generally, they send these emails to many people and hope that a certain percentage will fall for their scam. If you have received this message, we can assure you that there is nothing to worry about.

What is "Similar Photo Cleaner"?

Similar to Mac Cleanup Pro, the Similar Photo Cleaner app allows users to find duplicate photos (multiple copies) and remove them (this is according to its developers).

This may seem a legitimate and useful tool to save disk space, however, it is categorized as potentially unwanted application (PUA), since it is often installed inadvertently and promoted and distributed using the "bundling" method.

What is searchp.icu?

Similar to homesweeklies.com and playsearchnow.com, searchp.icu (which is also known as searchp.club) is a fake search engine that falsely claims to enhance the browsing experience by generating improved results and providing quick access to a number of popular websites (such as Facebook, Twitter, YouTube, and so on).

Judging on appearance alone, searchp.icu may seem legitimate, however, developers promote this site via rogue downloaders/installers that modify browser options without permission. In addition, searchp.icu records data relating to browsing activity.

What is GandCrab 5.0.5?

GandCrab 5.0.5 is a new variant of high-risk ransomware called GandCrab 5.0.4. Version 5.0.5 was released immediately after BitDefender developed a decryption tool for the previous version. After successful infiltration, GandCrab 5.0.5 encrypts most stored data and appends filenames with a random string.

For instance, "sample.jpg" might be renamed to a filename such as "sample.jpg.obkbtxtn". Once encryption is complete, data immediately becomes unusable. As well as encrypting files, GandCrab 5.0.5 changes the desktop wallpaper and creates a text file (named "[aforementioned_random_strong]-DECRYPT.txt"), placing a copy in each existing folder.

What is Docx?

Docx is another high-risk virus discovered by malware security researcher, S!Ri. After infiltrating the system, Docx encrypts most stored data, thereby making it unusable. As well as encryption, Docx renames files by adding the ".docx" appendix (e.g., "sample.jpg" is renamed to "sample.jpg.docx").

Once encryption is complete, Docx generates a text file ("YOU_FILES_HERE.txt") and places a copy in every existing folder. Note that another ransomware virus has a very similar name (..docx), however, they are not related.

What is Flash Chrome Proxy?

Flash Chrome Proxy is a high-risk virus designed to record user account credentials. The virus disguises itself as a legitimate application called Adobe Flash Player. At time of writing, Flash Chrome Proxy targeted the Google Chrome browser only, however, this situation may change.

Cyber criminals proliferate this malware using deceptive websites that falsely claim that Adobe Flash Player is outdated/missing, and encourages users to update/install the app. Note that this malicious extension can also be downloaded from Google Chrome's web store, but this will lead to system infection with the Flash Chrome Proxy virus.

What is "Walmart Email Virus"?

"Walmart Email Virus" is a spam email campaign used by cyber criminals to distribute Hawkeye keylogger. Like most emails of this type, they are sent to many people (hundreds or even thousands) and presented as "official" and legitimate messages. Generally, they encourage people to open malicious attachments that proliferate malware infections.

What is Nymaim?

Nymaim is high-risk trojan designed to infiltrate other viruses into the system. It essentially works as a malware dropper.

Cyber criminals proliferate this virus by disguising it a regular file or app (e.g., a legitimate app, document, etc.) For example, Nymaim is distributed using the "Job Application" spam email campaign and The Roboto Condensed Font Was Not Found Scam" web scam.