Virus and Spyware Removal Guides, uninstall instructions

What is Hao123.com?

The Hao123.com website was created by Baidu (one of the largest web services companies in China). This is a legitimate website, which enhances Internet users' browsing experience by providing easy access to trending sites, quick Internet search access, etc.

While this site is not malicious, many computer users refer to it as the Hao123.com virus. These associations are made since the site is promoted using 'Hao123 client', a program provided as free software. This software modifies Internet browser settings and sets Hao123.com as the user's default search engine and homepage.

What is Jollywallet?

Jollywallet is a browser plug-in created by Radyoos Media Ltd. It promises to save users money whilst shopping online (by recouping a percentage of any money spent).

This browser add-on is not technically a computer virus or related to malware infections, however, computer users have recently reported that Jollywallet was installed on their computers without their consent. Many also complain that they feel annoyed by pop-ups ads generated by this browser add-on and prefer to shop online without the imposition of these offers.

Unwilling or inadvertent installations such as these may occur as a result of Jollywallet's use of a deceptive marketing method called bundling. Commonly, Internet users inadvertently install browser extensions such as these together with free software downloaded from the Internet.

What is SwytShop?

According to the developers, SwytShop saves time and money by finding the best deals available within online stores - "With Swytshop, you’ll always find the lowest price for any product you’re looking for online – all automatically, all while you’re shopping.

Gone are the days of wasting time comparing prices manually, leave it to Swytshop to save you expenses and trouble!" These fake promises often tempt users to install. Be aware, however, that SwytShop is categorized as adware and a potentially unwanted program (PUP).

Following successful installation, SwytShop generates intrusive advertisements and collects information relating to users' Internet browsing activity.

What is DigiSaver?

The DigiSaver application claims to enhance Internet browsing by enabling comparison shopping, displaying coupons, and providing other similar features. On initial inspection, this functionality may seem legitimate and useful, however, DigiSaver is considered to be adware and a potentially unwanted program (PUP).

After stealthily infiltrating Internet browsers (Internet Explorer, Google Chrome, and Mozilla Firefox), DigiSaver tracks Internet browsing activity and displays intrusive online advertisements.

What is searchinme.com?

Developers present searchinme.com as a legitimate Internet search engine that generates most relevant search results and provides quick access to a variety of popular websites. Initially, this site may seem legitimate, however, searchinme.com continually monitors browsing activity by recording various data types.

Furthermore, developers promote this site using deceptive software download/installation set-ups that hijack Internet browsers.

What is "Microsoft Help Desk"?

"Microsoft Help Desk" is a trojan that locks the computer screen and displays a fake error message. Trojans are often distributed along with various potentially unwanted programs (PUPs). Following infiltration, PUPs cause unwanted redirects, deliver various intrusive online advertisements, and continually record various user-system information.

What is guruofsearch.com?

Developers present guruofsearch.com as an Internet search engine that significantly enhances the Internet browsing experience by generating improved search results and by providing quick access to various popular websites (for example, YouTube, eBay, Facebook, etc.).

Judging on appearance alone, guruofsearch.com may appear legitimate and useful, however, developers promote this site by employing rogue download/installation set-ups designed to modify web browser settings without consent. In addition, guruofsearch.com continually records information relating to users' Internet browsing activity.

What is Pr0tector?

Pr0tector is a ransomware-type virus discovered by malware researcher, Michael Gillespie. Following successful infiltration, Pr0tector encrypts various files and appends their names with the ".pr0tector" extension (for example, "sample.jpg" is renamed to "sample.jpg.pr0tector").

Once files are encrypted, this virus creates a text file ("READ ME ABOUT DECRYPTION.txt"), placing it on the desktop.

What is DoNotChange?

DoNotChange is a ransomware-type virus discovered by security researcher, Michael Gillespie. Once infiltrated, DoNotChange encrypts various information and appends filenames with the ".Do_not_change_the_file_name.cryp" extension. For instance, "sample.jpg" is renamed to "sample.jpg.Do_not_change_the_file_name.cryp".

Updated variants of this ransomware add .cry extension for encrypted files. For example .id-4R4NZ0109.cry Following successful encryption, this virus creates two text files ("HOW TO DECODE FILES!!!.txt" and "КАК РАСШИФРОВАТЬ ФАЙЛЫ!!!.txt"), placing them on the desktop.

What is "Notice From Microsoft Corporation"?

First discovered by malware researcher, Jiri Kropac, "Notice From Microsoft Corporation" is a malware virus distributed via the "CashBillPending(Autosaved)1.pdf.exe" file.

Once infiltrated, "Notice From Microsoft Corporation" locks the screen and displays a fake error message. Furthermore, it encrypts files and appends the ".Harzhuangzi" extension to the name of each compromised file (for example, "sample.jpg" is renamed to "sample.jpg.Harzhuangzi").