Virus and Spyware Removal Guides, uninstall instructions

What is blackpage3.ru?

Identical to ttczmd.com, mystartpage1.ru, wzscnet.com, and a number of other rogue sites, blackpage3.ru/i/start.html is fake Internet search engine that falsely claims to enhance the web browsing experience by generating improved search results. 

These claims often trick users into believing that blackpage3.ru is legitimate, however, this site gathers various information relating to users' web browsing activity. Furthermore, developers promote it using deceptive software download/installation set-ups that hijack web browsers and modify various options without consent.

What is Cerber3?

Cerber3 is an updated version of Cerber - high-risk ransomware-type malware. Following successful infiltration, Cerber3 encrypts files, generates random file names (10 characters), and appends the ".cerber3" extension to the name of each encrypted file. For example, "sample.jpg" might be renamed to "G0s-4kha_J.cerber3".

The desktop wallpaper is then modified and three files created: "# HELP DECRYPT #.html", "# HELP DECRYPT #.txt", and "# HELP DECRYPT #.url". Newer variants of this ransomware use "@__README__@.html", "@__README__@.txt" and "@__README__@.url".

While the ".txt" and ".html" files contain identical ransom-demand messages, the ".url" file redirects victims to the Cerber3 payment website. To restore their files, victims must pay a ransom.

What is tab4you.com?

tab4you.com is a deceptive website that claims to be a legitimate Internet search engine generating improved search results and displaying local weather forecasts, current time, and allowing creation of 'to-do' lists.

Some users believe that tab4you.com is a legitimate and useful website, however, developers promote this website via deceptive software downloaders/installers that hijack Internet browsers and modify various options. In addition, tab4you.com continually monitors users' Internet browsing activity by gathering various user/system data.

What is JohnyCryptor?

JohnyCryptor is another ransomware-type virus that stealthily infiltrates systems and encrypts stored files. During encryption, JohnyCryptor generates a "How to decrypt your files.txt" file, placing it on the desktop. It also changes the desktop background. This behavior is common to ransomware-type malware.

What is Serpico?

Serpico is a new variant of DetoxCrypto ransomware. Unlike DetoxCrypto, however, Serpico does not use PokemonGo video game images to trick users into running malicious files. Following infiltration, Serpico encrypts various data types (for example, .jpg, .docx, .ppt, .psd, etc.) stored on the computer.

Unlike many other ransomware-type viruses, Serpico does not change names of encrypted files in any way. Thus, it is often difficult to determine which files are encrypted. Following successful encryption, Serpico opens a window that contains a ransom-demand message.

What is TribalAd PPC Ad Network?

TribalAd PPC Ad Network is a legitimate advertising network, however, research shows that associated advertisements are often displayed by various potentially unwanted adware-type programs (PUPs). By falsely claiming to provide 'useful functions' PUPs often attempt to give the impression of legitimacy.

In fact, these apps often infiltrate systems without users' permission. Furthermore, adware continually monitors users' Internet browsing activity and delivers various intrusive online advertisements.

What is duba.com?

Developers present duba.com/?un_449343_4125 as a legitimate Internet search engine that generates improved search results and provides quick access to various popular websites. Initially, this site may seem legitimate and useful, however, duba.com monitor users' Internet browsing activity.

In addition, developers promote duba.com using rogue software downloaders and installers that hijack web browsers and stealthily modify various options.

What is ttczmd.com/i/igsearch.html?

ttczmd.com/i/igsearch.html is a fake Internet search engine identical to searchopa.com, mystartpage1.ru, wzscnet.com, and a number of other bogus sites. 

By falsely claiming to generate improved search results, ttczmd.com/i/igsearch.html attempts to give the impression of legitimacy, however, developers promote this site via rogue software download/installation tools that hijack Internet browsers and stealthily modify various options.

In addition, ttczmd.com/i/igsearch.html continually monitors users' Internet browsing activity by gathering various user/system information.

What is Fantom?

Fantom is a ransomware-type virus that imitates the Windows update procedure while encrypting files. This is unusual, since most ransomware encrypts files stealthily without showing any activity. During encryption, Fantom appends the names of encrypted files with the ".locked4", ".fantom" or ".locked" extension.

For example, an encrypted image file "sample.jpg" is renamed to "sample.jpg.fantom". Following successful encryption, Fantom changes the desktop wallpaper and creates a "DECRYPT_YOUR_FILES.html" file, which is placed on the desktop and in each folder containing encrypted files.

Note that RemindMe ransomware creates a very similar HTML file and, therefore, it is probable that Fantom is related to this virus.

What is Hacking Alert?

"Hacking Alert" is a fake error message similar to BSOD Error, Hard Disk Failure Error, BSOD Driver Problem, and a number of other fake errors. "Hacking Alert" is displayed by a malicious website, which users visit after encountering unwanted browser redirects caused by various unwanted programs.

These PUPs often infiltrate the system during installation of legitimate apps. As well as causing unwanted redirects, potentially unwanted programs also record various user/system information and display intrusive online advertisements.