Virus and Spyware Removal Guides, uninstall instructions

What is elastisearch.com?

elastisearch.com is a fake web search engine that, according to the developers, enhances web browsing experience by generating improved results. Judging on the appearance alone, elastisearch.com may seem appropriate and handy. However, this is false.

Developers promote this website by using a browser-hijacking app called ElastiSearch. Moreover, both elastisearch.com and ElastiSearch are designed to record information about user's web browsing activity.

What is search.searchyrs.com?

Your Radio is a rogue application that supposedly allows users listen to various radio stations via the Internet. Many believe that this app is completely legitimate and handy.

However, this is false - Your Radio is categorized as a potentially unwanted program (PUP) and a browser hijacker. The main reasons for these negative associations are stealth installation without user's consent, modification of web browsers' options and tracking of user's web browsing activity.

What is search.hwatchallsports.co?

According to the developers, the Watch All Sports app allows users to watch various sports events live via the Internet. This functionality may seem legitimate and useful, however, Watch All Sports is categorized as a potentially unwanted program (PUP) and a browser hijacker.

The main reasons for these negative associations are installation without permission, modification of browser settings, and monitoring of browsing activity.

What is Mr.Dec?

Mr.Dec is a ransomware-type virus discovered by Michael Gillespie. This malware is designed to encrypt most stored files and add the "[ID]victim's_ID[ID]" appendix to each filename. For example, "sample.jpg" might be renamed to a filename such as "sample.jpg[ID]gh839ag14hiol4ag[ID]".

Compromised data immediately becomes unusable. Furthermore, after successful encryption, Mr.Dec generates an HTML application ("Decoding help.hta") and places copy in every existing folder.

What is search.hmytemplates.co?

My Templates is a rogue application that supposedly provides access to design templates. Judging on appearance alone, My Templates may appear legitimate and useful, however, this app is categorized as a potentially unwanted program (PUP) and a browser hijacker.

There are three main reasons for these negative associations: 1) installation without consent; 2) modification of browser options, and; 3) tracking of personal information.

What is RAPID RANSOMWARE V3?

Discovered by MalwareHunterTeam, RAPID RANSOMWARE V3 is an updated variant of the Rapid and Rapid 2.0 viruses. Immediately after infiltration, RAPID RANSOMWARE V3 encrypts most stored files and renames them using the "[random_number].EZYMN" pattern.

For instance, "sample.jpg" might be renamed to a filename such as "78431.EZYMN". Encrypted files becomes unusable and indistinguishable. Following successful encryption, RAPID RANSOMWARE V3 creates a text file ("DECRYPT.EZYMN.txt") and places a copy in every existing folder.

What kind of malware is Sigrun?

Discovered by Michael Gillespie, Sigrun is a ransomware-type virus that stealthily infiltrates the system and encrypts most stored files.

During the process, Sigrun appends filenames with the ".sigrun" extension. For example, "sample.jpg" is renamed to "sample.jpg.sigrun". Once encryption is complete, this virus creates a text file ("RESTORE-SIGRUN.txt") and an HTML file ("RESTORE-SIGRUN.html"), placing copies of both in every existing folder.

What is search.tb.ask.com?

Developers present search.tb.ask.com (also known as int.search.tb.ask.com) as a web search engine that generates improved results and, therefore, enhances, the browsing experience.

In fact, ask.com is legitimate, but developers promote search.tb.ask.com in a deceptive way - they employ browser-hijacking applications (toolbars) designed by Mindspark Interactive Network (also known as IAC Applications).

What is search.searchswift.co?

Similar to searchencrypt.com, search.searchswift.co is a fake web search engine that, according to the developers, enhances the browsing experience by generating improved results.

Judging on appearance alone, this site may seem legitimate and useful, however, developers promote it using various browser-hijacking set-ups/apps. Furthermore, search.searchswift.co gathers data relating to web browsing activity.

What is Everbe?

Everbe is another ransomware-type virus discovered by Jakub Kroustek. It is designed to stealthily infiltrate the system and encrypt most stored files. During the process, Everbe adds the ".[everbe@airmail.cc].everbe" appendix to all filenames (e.g., "sample.jpg" is renamed to "sample.jpg.[everbe@airmail.cc].everbe").

Other variants of this ransomware use: ".[everest@airmail.cc].EVEREST", ".[notopen@cock.li].NOT_OPEN", ".[divine@cock.lu].divine", ".[pain@cock.lu].pain", ".[thunderhelp@airmail.cc].thunder", ".Curator" and ".[eV3rbe@rape.lol].eV3rbe" extensions for encrypted files.

Compromised data immediately becomes unusable. Following successful encryption, Everbe generates a text file called "!=How_recovery_files=!.txt" and places a copy in every existing folder.