Virus and Spyware Removal Guides, uninstall instructions

What is Critical System Error: x679Qs5m?

"Critical System Error: x679Qs5m" is a fake error message displayed by various malicious sites. It is very similar to iPhone Has Been Locked, Your Mac Is Infected With 3 Viruses, and many others.

Research shows that most users visit these sites inadvertently - they are redirected by intrusive advertisements (delivered by other rogue websites) or potentially unwanted programs (PUPs). In most cases, potentially unwanted programs infiltrate systems without permission. As well as causing redirects, they deliver intrusive advertisements and gather sensitive information.

What is WhiteClick?

WhiteClick is a deceptive application that supposedly enhances the browsing experience by allowing users to search directly from the Task Bar, without opening the browser. This functionality may seem legitimate and useful, however, WhiteClick is categorized as a potentially unwanted program (PUP) and adware.

There are three main reasons for these negative associations: 1) stealth installation without consent; 2) tracking of users' Internet browsing activity, and; 3) display of intrusive advertisements.

What is ANIMUS?

ANIMUS is a ransomware-type virus discovered by malware security researcher, Karsten Hahn. This virus is designed to stealthily infiltrate the system and encrypt most stored files using the RSA-2048 encryption algorithm. During encryption, ANIMUS appends filenames with the ".animus" extension (for example, "sample.jpg" is renamed to "sample.jpg.animus").

Compromised data immediately becomes unusable. Once encryption is over, ANIMUS creates three identical text files ("ANIMUS_RESTORE.txt", "ANIMUS_RESTORE2.txt", and "ANIMUS_RESTORE3.txt") and places a copy of each in all existing folders.

What is Nozelesn?

Discovered by MalwareHunterTeam, Nozelesn is a ransomware-type virus that stealthily infiltrates the system and encrypts most stored files.

Once encrypted, data immediately becomes unusable. In addition, names of encrypted files are appended with the ".nozelesn" extension (for example, "sample.jpg" is renamed to "sample.jpg.nozelesn"). Following successful encryption, Nozelesn creates an HTML file ("HOW_FIX_NOZELESN_FILES.htm") and places a copy in every existing folder.

What is KRAB?

KRAB is a new variant of high-risk ransomware called GANDCRAB 3. Immediately after infiltration, KRAB encrypts most stored files (thereby making them impossible to use) and appends filenames with the ".KRAB" extension. For example, "sample.jpg" is renamed to "sample.jpg.KRAB".

Once data is encrypted, KRAB generates a text file ("CRAB-DECRYPT.txt") and places a copy in every existing folder. At time of research, this malware was mostly distributed using fake software crack tools (for example, "Crack_Ghost_Mouse_Auto_Clicker.exe").

What is weknow.ac?

Similar to chumsearch.com, weknow.ac is a fake web search engine that supposedly enhances the browsing experience by generating improved results.

Judging on appearance alone, weknow.ac may seem legitimate and useful, however, this site is promoted using rogue download/installation set-ups that modify browser options without permission. Furthermore, weknow.ac continually records information relating to users' Internet browsing activity.

What is Important Documents IRS?

"Important Documents IRS" is another spam email campaign used to distribute the TrickBot trojan. It shares many similarities with Payslip, You Have A Santander Secure Email, and a number of other campaigns.

"Important Documents IRS" emails contain a long message comprising false information regarding a supposed 'transaction' and encouraging users to immediately open an attached MS Office (Word) document. Once opened, however, this file immediately downloads and installs the TrickBot trojan.

What is search.streamingworldcup.com?

search.streamingworldcup.com is another fake search engine that supposedly enhances the browsing experience by generating improved results. Judging on appearance alone, search.streamingworldcup.com barely differs from legitimate search engines, such as Google, Bing, Yahoo, and so on.

Therefore, many users believe that search.streamingworldcup.com is also legitimate and useful, however, developers promote this site using browser-hijacking download/installation set-ups that modify browser settings without consent. Furthermore, search.streamingworldcup.com continually records various information relating to browsing activity.

What is hp.myway.com?

SmartEasyMaps is presented as a legitimate application that supposedly provides GPS-related functionality. Initially, this app may seem legitimate and useful, however, it is categorized as a potentially unwanted program (PUP) and a browser hijacker.

There are two main reasons for these negative associations: 1) stealth installation without users' consent, and; 2) promotion of a fake web search engine.

What is Sage Invoice?

Discovered by My Online Security, "Sage Invoice" is an email spam campaign used to proliferate a trojan-type virus called TrickBot. Deceptive emails contain a message stating that a type of payment is pending. The email also contains an attachment, a malicious MS Office document. Once opened, this file stealthily downloads and installs the aforementioned trojan.