Virus and Spyware Removal Guides, uninstall instructions

Napoleon Ransomware

What is Napoleon?

Similar to Blind, Napoleon is a ransomware-type virus discovered by malware security researcher, Jakub Kroustek. Once infiltrated, Napoleon encrypts most stored data.

During encryption, Napoleon appends filenames with the ".[supp01@airmail.cc].napoleon" extension (e.g., "sample.jpg" is renamed to "sample.jpg.[supp01@airmail.cc].napoleon"). Henceforth, using encrypted files becomes impossible. After successfully encrypting data, Napoleon places the "How_Decrypt_Files.hta" file on the desktop.

   
TEST Ransomware

What is TEST?

First discovered by MalwareHunterTeam, TEST is a new variant of high-risk ransomware called CryptoMix. Immediately after infiltration, TEST encrypts most stored data and renames it using a hexadecimal numeral system (32 characters) and adds the ".TEST" extension to each affected file.

For example, "sample.jpg" might be renamed to something like "123E7C332654AF453A089F8F26B69385.TEST". From this point, files become unusable and indistinguishable. Following successful encryption, TEST generates a text file ("_HELP_INSTRUCTION.TXT") and places it in every folder containing encrypted files.

   
Cyber Security Scam

What is Cyber Security?

Delivered by a malicious website, "Cyber Security" is a fake error similar to Your TCP Connection Was Blocked, You Have A Trojan!, Windows Detected ZEUS Virus, and many others. 

Research shows that users are often redirected to this website by various potentially unwanted programs (PUPs) that typically infiltrate systems without permission. As well as causing redirects, PUPs are known to misuse system resources, deliver intrusive ads, and record sensitive information.

   
WantMoney Ransomware

What is WantMoney?

WantMoney is a ransomware-type virus discovered by malware security researcher, Karsten Hahn. Immediately after infiltration, WantMoney encrypts most stored data. From this point, files become unusable.

It also changes file type extensions to "ONVUG-JUQQC-INZRP-LJBZQ.Encrypted[B32588601@163.com].WantMoney22" (e.g., "sample.jpg" is renamed to "sample.ONVUG-JUQQC-INZRP-LJBZQ.Encrypted[B32588601@163.com].WantMoney22").

Following successful encryption, WantMoney places two files ("_Want Money_.txt" and "_Want Money_.bmp" [also set as the desktop wallpaper]) on the desktop and opens a pop-up window.

   
Hdmoviesearch.com Redirect

What is hdmoviesearch.com?

According to the developers, hdmoviesearch.com is a high-end Internet search engine that enhances users' Internet browsing experience by generating improved results. The appearance of hdmoviesearch.com barely differs from Google, Bing, Yahoo, and other legitimate search engines.

Therefore, many users believe that hdmoviesearch.com is also legitimate and useful. In fact, developers promote this site using a browser-hijacking application called HD Video Search Tool. In addition, hdmoviesearch.com and HD Video Search Tool continually record various user-system information (mostly relating to Internet browsing habits).

   
ProPDFConverter Toolbar

What is hp.myway.com?

ProPDFConverter is a rogue application developed by Mindspark Interactive Network (also known as IAC Applications).

By offering conversion of PDF files to other formats, ProPDFConverter attempts to give the impression of legitimacy, however, this app typically infiltrates systems and stealthily modifies web browser options without consent. For these reasons, ProPDFConverter is categorized as a potentially unwanted program (PUP) and a browser hijacker.

   
Adplexmedia.com Redirect

What is adplexmedia.com?

Identical to smartoffer.siteprimosearch.comrestheet.com, and many others, adplexmedia.com is a rogue website designed to redirect to other dubious sites. The only differences are the target sites to which users are redirected.

Research shows that users often visit adplexmedia.com inadvertently - they are redirected by potentially unwanted programs (PUPs) that typically infiltrate systems without permission. As well as causing redirects, PUPs generate intrusive advertisements, diminish system performance, and gather various information (mostly relating to web browsing activity).

   
hyourstreamingradionow.com Redirect

What is search.hyourstreamingradionow.com?

Your Streaming Radio Now is a deceptive application that, according to the developers, allows users to listen to various radio stations via the web browser.

Judging on appearance alone, Your Streaming Radio Now may seem legitimate and useful, however, this potentially unwanted program (PUP) infiltrates systems without permission and collects various sensitive information. In addition, it is categorized as a browser hijacker - a form of unwanted software that modifies web browser options without users’ permission.

   
Buy Windows Defender Essentials Scam

What is "Buy Windows Defender Essentials"?

Discovered by Pieter Arntz, "Buy Windows Defender Essentials" is fake error/malware distributed as a 'cracked' software installer. Once the set-up is executed, it downloads a number of other malicious excecutables (full list below) and places them into various folders.

Following successful download, one of the executables is configured as Windows Service - it then starts automatically and modifies the Windows Registry settings, thereby disabling various system hotkeys.

Immediately following this, another executable locks the computer screen and displays a fake BSOD (Blue Screen of Death) stating that the system has detected problems caused by the "system32.dll" file. Simultaneously, it plays a beeping sound.

From this point, users are unable to perform virtually any actions. After a short time, "Buy Windows Defender Essentials" malware opens a fake Windows Troubleshooter that will supposedly resolve all "issues".

   
Foxsearch.me Redirect

What is foxsearch.me?

foxsearch.me is another fake search engine that falsely claims to enhance users' Internet browsing experience by generating improved results. Judging on appearance alone, foxsearch.me may seem similar to Google, Bing, Yahoo, and other legitimate search engines.

Therefore, many users believe that this site is also legitimate and useful, however, developers promote foxsearch.me by employing browser-hijacking downloaders/installers that modify web browser options without users’ permission. In addition, this site continually records various information (mostly relating to Internet browsing habits).

   

Page 1647 of 2106

<< Start < Prev 1641 1642 1643 1644 1645 1646 1647 1648 1649 1650 Next > End >>
About PCrisk

PCrisk is a cyber security portal, informing Internet users about the latest digital threats. Our content is provided by security experts and professional malware researchers. Read more about us.

Malware activity

Global malware activity level today:

Medium threat activity

Increased attack rate of infections detected within the last 24 hours.

Virus and malware removal

This page provides information on how to avoid infections by malware or viruses and is useful if your system suffers from common spyware and malware attacks.

Learn about malware removal