Virus and Spyware Removal Guides, uninstall instructions

What is search.us.com?

The search.us.com website presents users with a search bar and is promoted using the search.us.com toolbar. This website alone is not related to malware or virus infections, however, it is promoted using deceptive methods and Internet users commonly visit this site when being redirected to it.

This redirect issue is a direct consequence of search.us.com toolbar installation - it changes users' Internet browser (Internet Explorer, Mozilla FireFox) homepage and default search engine settings to search.us.com If you feel that you have not willingly installed this toolbar and it appeared on your Internet browser without your consent, it is likely to have been bundled with freeware downloaded from the Internet.

What is Cursor Mania?

The Cursor Mania browser add-on enhances users' Internet browsing experience by allowing modifications to the mouse cursor style. This browser extension is developed by Mindspark and similar to Zwinky toolbar and MyWebFace Toolbar. Note that users wishing to access Mindspark's website features have to install an associated toolbar.

While these browser plug-ins are not related to virus or malware infections, they do change browser settings and cause redirects to home.mywebsearch.com The Cursor Mania Toolbar is advertised by various online banner ads and it may also be bundled with free software downloaded from the Internet.

If you feel that you have not willingly installed this browser add-on, it is likely that it was bundled with freeware that you have downloaded.

What is Computer Locked - MoneyPak?

Messages that lock computer users' screens, demanding payment of a fine using MoneyPak for supposed law violations, are a scam. These messages are classed as  ransomware infections and created by cyber criminals to trick unsuspecting PC users into paying bogus fines.

To make their screen lockers appear authentic, these criminals exploit the names of authorities such as the FBI, the Department of Justice, the Internet Crime Complaint Center, etc.  

Ransomware infections are often localised and able to present computer users with deceptive messages as if sent from their local authorities. This localisation is possible, since ransomware infections are capable of detecting the IP addresses of PCs targeted for infiltration.

What is MyWebFace?

MyWebFace Toolbar is a browser add-on that allows users to access an online tool called MyWebFace. This web tool enables users to transform their face photos into cartoon images, share their creations, etc.

Whilst such functionality is seen by many as useful and fun, in order to access this tool, users are asked to install the MyWebFace toolbar - adware that modifies users' Internet browser settings and causes redirects to mywebsearch.com When installed on your PC, the toolbar will change your default search engine and homepage to home.mywebsearch.com Moreover, each newly-opened browser tab will also redirect to the this website.

What is Zwinky?

Zwinky is an online service enabling users to create individual cartoon avatars. Whilst some find this service useful, its developers have chosen a deceptive monetization strategy by asking their users to download the Zwinky toolbar in order to use their free services. When installed, this toolbar modifies the user's homepage and default search engine browser settings.

Moreover, each newly-opened tab is redirected to the home.mywebsearch.com website. Note that using this website for your daily Internet searches adds no real value - this redirect is applied for monetization purposes, since each time a computer user clicks on sponsored search results, the developers of Zwinky Toolbar gain revenue.

What is Computer Locked - Ukash?

Deceptive messages demanding payment of fines for supposed law violations are scams. Such security infections are classed as ransomware. Screen lockers of this nature are created by cyber criminals in the hope that PC users will fall for their trickery and send them the money.

There are several ransomware families targeting PC users from different countries using localized variants of their fake messages.

In order to make these false messages appear authentic, cyber criminals exploit the names and graphics of local authorities. To determine the location of the target computer, ransomware infections detect IP addresses and are capable of presenting PC users with a deceptive message adapted with graphics and names of local authorities.

What kind of application is SweetPacks?

Sweetpacks is a developer of browser add-ons. This company has created many popular browser extensions, which enhance users' Internet browsing experience, such as adding emoticons, enabling users to play premium games without charge, correcting spelling mistakes, video conversions, etc.

The following are some of the names of Sweetpacks' browser plug-ins: Ginger, GamePacks, SweetIM, VideoConverter, and SweetIM for FaceBook. Alone, these browser extensions are not related to malware of virus infections, however, these add-ons cause browser redirects and unwanted ads issues.

To monetize incoming web traffic, Sweetpacks add-ons modify the homepage and default search engine settings of users' Internet browsers to home.sweetim.com and search.sweetpacks.com respectively. Furthermore, their plug-ins are bundled with DealPly and PriceGong adware.

What is DealPly?

The DealPly browser extension displays coupon deals when computer users visit online shopping websites such as eBay, Amazon, etc. Developers of this browser extension claim that this app helps Internet users to save time and money whilst shopping online.

Note that DealPly is not a virus or malware, it is a legitimate browser add-on, however, its deceptive distribution strategy categorizes it as an unwanted browser extension. There are several different methods by which DealPly can be installed on users' systems:

1) the extension is downloaded from its homepage, and the user is aware of its installation, or; 2) the browser plug-in is installed together with some free software or other browser add-ons - commonly, this form of installation takes place without the user's consent.

What is Master Penalty Document?

The Master Penalty Document message (purporting to be delivered from SOPA and PIPA), blocks computer users' desktops and is a scam. This is a ransomware infection which orders computer users to pay a 100 Euro fine for supposed law violations (for example, using a pirated version of an operating system or other software).

PC users should not trust this message, since it has no connection with legitimate authorities. It is a scam created by cyber criminals who make money from computer users who fall for such trickery and pay the bogus fine. Paying this fine is equivalent to sending your money to cyber criminals, and there is no guarantee that your computer will be unblocked as a result.

What is Win Server Defender?

Win Server Defender is a rogue antivirus program that infects the Windows Server operating system. The program imitates a security scan, and after generating a list of fake security infections, advises computer users to purchase the full version. This scam originates from a family of name-changing rogue programs called Braviax.

This particular bogus program is the only known fake antivirus software to specifically target the Windows Server operating system. That is not to say that it does not attack others; note that this rogue is capable of adapting its name according to the operating system it infiltrates.

For example, for a system running Windows 7, the name is modified to appear as Win7 Defender and for Windows XP, it appears as XP Defender. To give the appearance that your system is infected with viruses and malware, Win Server Defender disables the Task Manager, disallows execution of installed software, and generates fake security warning pop-ups.