Virus and Spyware Removal Guides, uninstall instructions

What is iRansom?

iRansom is file encryption ransomware first discovered by Michael Gillespie. Following infiltration, iRansom encrypts files and appends the ".Locked" extension to the name of each encrypted file. For example, "sample.jpg" is renamed to "sample.jpg.Locked".

Following successful encryption, iRansom opens a pop-up window containing a ransom-demand message.

What is search.smokycap.com?

search.smokycap.com is a fake Internet search engine identical to search.fleecompliment.com, search.goldraiven.com, search.joyround.com, and a number of other sites.

By offering improved search results, search.smokycap.com attempts to give the impression of legitimacy, however, developers promote this site using deceptive software download and/or installation set-ups designed to hijack web browsers and stealthily modify their settings.

Furthermore, this fake search engine continually records information relating to users' web browsing activity.

What is search.fleecompliment.com?

Developers present search.fleecompliment.com as a legitimate Internet search engine that supposedly generates improved search results and, thereby enhancing the web browsing experience.

Initially, this site may seem legitimate and useful, however, developers promote it using rogue software download/installation set-ups that modify web browser options without users' consent. In addition, search.fleecompliment.com continually gathers information relating to web browsing activity.

What is search.goldraiven.com?

search.goldraiven.com is a fake Internet search engine identical to search.wharkike.com, search.follysway.com, and search.joyround.com. 

According to the developers, search.goldraiven.com significantly enhances the web browsing experience by generating improved search results.

Initially, this site may appear legitimate and useful, however, developers promote it by employing deceptive software download/installation set-ups designed to modify browser options without users' consent. Furthermore, search.goldraiven.com continually monitors Internet browsing activity.

What is search.joyround.com?

Identical to search.wharkike.com and search.follysway.com, search.joyround.com is a deceptive website claiming to be a legitimate Internet search engine that significantly enhances the browsing experience by generating improved search results.

Judging on appearance alone, search.joyround.com may seem legitimate, since it barely differs from Google, Yahoo, Bing, and other similar legitimate search engines.

Be aware, however, that the site is promoted using rogue software downloaders/installers that hijack web browsers and stealthily modify various options. Furthermore, it continually records information relating to users' Internet browsing activity.

What is CerberTear?

CerberTear is a new variant of Cerber - a high-risk ransomware-type virus based on Hidden Tear (an open-source ransomware project). CerberTear was firstly discovered by Karsten Hahn. Following infiltration, CerberTear encrypts files using asymmetric cryptography.

Unlike its previous version, however, CerberTear does not rename encrypted files - it merely appends the ".cerber" extension to them (e.g., "sample.jpg" is renamed to "sample.jpg.cerber"). The original Cerber ransomware changed the desktop wallpaper, whilst CerberTear does not.

Furthermore, rather than creating three files (".txt", ".url", and ".html"), CerberTear creates just one ("HOW_TO_RESTORE_YOUR_DATA.html") and places it in each existing folder.

What kind of malware is DummyLocker?

DummyLocker is a ransomware-type virus discovered by Karsten Hahn. Following system infiltration, DummyLocker encrypts files using AES-256 cryptography and appends the ".dCrypt" extension to the name of each encrypted file (e.g., "sample.jpg" becomes "sample.jpg.dCrypt").

Following successful encryption, DummyLocker locks the computer screen and displays a ransom-demand message.

What is Gremit?

Gremit is a ransomware-type virus which encrypts files stored on the system. During encryption, Gremit appends file names with the ".rnsmwr" extension (e.g., "sample.jpg" is renamed to "sample.jpg.rnsmwr"). A pop-up window containing a ransom-demand message is then displayed.

What is Your Computer May Be At Risk?

"Your Computer May Be At Risk" is a fake error message displayed by a number of deceptive potentially unwanted programs (PUPs, such as "PC Clean Plus", "PC Purifier", etc.) By offering a variety of 'useful features', PUPs often trick users into believing that they are legitimate programs.

In fact, they often infiltrate systems without consent. Furthermore, these rogue programs track web browsing activity and often display intrusive online advertisements.

What is Esmeralda?

Identical to Kangaroo, Esmeralda is an updated version of Apocalypse ransomware. Following infiltration, Esmeralda encrypts various files and appends the ".encrypted" extension to the name of each encrypted file. For instance, "sample.jpg" becomes "sample.jpg.encrypted".

A pop-up window is then displayed and text files are created, the names associated with the encrypted files (for example, "sample.jpg.How_To_Decrypt.txt"). The pop-up and text files contain an identical ransom-demand message.