Virus and Spyware Removal Guides, uninstall instructions

What is safesearch1.ru?

safesearch1.ru/start.html is a fake Internet search engine identical to searchpause.com, seargoo.com, statliru1.ru, and many other sites. By claiming to generate improved search results, safesearch1.ru often tricks users into believing that it is a legitimate website.

Be aware, however, that developers promote safesearch1.ru via deceptive software download/installation tools that hijack web browsers. In addition, this rogue site continually gathers information relating to users' Internet browsing activity.

What is PClock?

PClock is ransomware that claims to be CryptoLocker. Different variants of this ransomware use suppteam01@india.com, suppteam03@yandex.ru, support01@t.pl, sp02@protonmail.com, buruk01@india.com, buruk02@india.com, suppcop@india.com, suppcop@yandex.ru, sysgop01@india.com and sysgop02@india.com email addresses.

Once infiltrated, this version encrypts files using asymmetric cryptography. Unlike other ransomware, suppteam01@india.com does not append any extensions, or rename, files.

Following successful encryption, this ransomware opens a pop-up window and creates a text file ("Your files are locked !!!!.txt"), placing it on the desktop wallpaper. Both contain ransom-demand messages.

What is searchpause.com?

Developers present searchpause.com as a legitimate Internet search engine that enhances the Internet browsing experience by generating improved search results.

These claims often trick users into believing that searchpause.com is legitimate, however, developers promote this site via rogue software download/installation set-ups designed to modify various options without users' consent. In addition, searchpause.com continually records various information relating to users' Internet browsing activity.

What is seargoo.com?

Identical to searchqq.com, statliru1.ru, searchgra.com, and a number of other sites, seargoo.com is a fake Internet search engine that falsely claims to enhance the Internet browsing experience by generating improved search results.

Many users believe that this site is legitimate, however, seargoo.com is promoted using rogue download/installation set-ups that hijack Internet browsers and stealthily modify various options. In addition, seargoo.com gathers various data relating to users' Internet browsing activity.

What is iyi123.com?

Iyi123.com is a rogue website claiming to be a legitimate Internet search engine. By falsely claiming to generate improved search results, iyi123.com attempts to trick users into believing that this site is legitimate.

In fact, developers promote iyi123.com via rogue software download and installation set-ups designed to stealthily modify web browser settings without users' consent. Furthermore, this site gathers various data types relating to Internet browsing activity.

What is Go?

Go is newly-discovered ransomware that infiltrates systems and encrypts files using AES cryptography. This malware is named after Go - a programming language used to design it. This is the first time a ransomware-type virus is seen in this programming language - most are written using C#, C++, and other professional object-oriented programming languages.

During encryption, Go renames all compromised files by generating a series of random characters and appending the ".enc" extension. For instance, an encrypted file might be renamed to "FBdfg8JKsdg2l11!km.enc", which makes it impossible to identify the original files.

Following successful encryption, Go creates an "Instructions.html" file and places it in each folder containing encrypted files.

What is Exotic?

Exotic is ransomware that encrypts and renames files using the "[several_random_characters].exotic" pattern. For instance, "sample.jpg" is renamed to "78!bk).exotic". Once files are encrypted, Exotic opens a pop-up message informing victims of the infection. A window is then displayed containing a ransom-demand message.

What is Windows Defender has detected Critically Corrupted File System!?

"Windows Defender has detected Critically Corrupted File System!" is a fake error message distributed using various adware-type applications.

This error locks the computer screen and claims that Windows Defender has detected corrupted files. Adware-type applications often infiltrate systems during installation of other programs. Furthermore, these apps continually gather various user/system information, cause unwanted browser redirects, and deliver intrusive online advertisements.

What is TVPlusNewtab?

TVPlusNewtab is a browser hijacker, endorsed as a tool for easy access to movie trailers, TV series and celebrity content. It is also supposedly capable of allowing users to quickly view PDF documents. TVPlusNewtab operates by making modifications to browser settings in order to promote search.tvplusnewtabsearch.com - a fake search engine.

Additionally, this browser hijacker has data tracking abilities, which are used to record information relating to users' Internet browsing activity. Since most users install TVPlusNewtab inadvertently, it is also considered to be a PUA (Potentially Unwanted Application).

What is Ncrypt?

Ncrypt is a ransomware-type malware designed to encrypt victims' files. It was first discovered by a security researcher Michael Gillespie. 

During encryption, this malware appends a ".NCRYPT" extension to the name of each file. For instance, "sample.jpg" is renamed to "sample.jpg.NCRYPT". After encryption, Ncrypt creates a "_FILE_RETRIEVAL_INFORMATION.html" file (placed on the desktop) containing a ransom-demand message.