Virus and Spyware Removal Guides, uninstall instructions

What is browsing-shield.xyz?

While inspecting browser-hijacking software, our research team discovered the browsing-shield.xyz fake search engine. These websites cannot generate search results, so they redirect to legitimate search engines.

Sites like browsing-shield.xyz are typically promoted (through redirects) by browser hijackers. Additionally, these websites and the software endorsing them usually have the ability to collect sensitive information.

What is Skynetwork ransomware?

Our researchers discovered the Skynetwork ransomware-type program while investigating new submissions to VirusTotal. This program is part of the MedusaLocker ransomware family, and it is designed to encrypt data and demand ransom for its decryption.

Once we launched a sample of Skynetwork on our test system, it encrypted files and appended their titles with a ".skynetwork8" extension. For example, a filename like "1.jpg" appeared as "1.jpg.skynetwork8", "2.png" as "2.png.skynetwork8", and so forth.

Afterwards, a ransom-demanding message named "How_to_back_files.html" was dropped onto the desktop. Based on the note therein, we can conclude that this ransomware targets companies rather than home users.

What is crazyresultsnow.com?

Crazyresultsnow.com is the URL of an illegitimate search engine. Websites of this kind are usually incapable of generating search results, and while crazyresultsnow.com can – they are inaccurate and may include irrelevant/deceptive content.

Fake search engines are typically promoted by browser hijackers. This software and sites tend to collect private information and, as such, are considered to be a threat to user privacy.

What kind of email is "Product Availability Confirmation"?

After inspecting the "Product Availability Confirmation" email, we learned that it is spam. The fake letter is presented as an urgent purchase request from the sender. This mail operates as a phishing scam and promotes a phishing site disguised as SharePoint. This website is designed to record and steal provided email account passwords.

What is MainAdviseSearch?

Our researchers discovered the MainAdviseSearch app while inspecting new submissions to VirusTotal. After analyzing this piece of software, we determined that it is adware belonging to the AdLoad malware group. It operates by displaying ads and may have additional harmful abilities.

What kind of malware is WannaSmile?

WannaSmile is ransomware that encrypts files, appends the ".wannasmile" extension to filenames, and displays a ransom note (a pop-up window). An example of how WannaSmile modifies filenames: it changes "1.jpg" to "1.jpg.wannasmile", "2.png" to "2.png.wannasmile", and so forth.

Files encrypted by WannaSmile can be decrypted (at least for now) using a decryption key (the last row of random characters) in the "%APPDATA%\data.wnns" file.

What kind of page is thecloudvantnow[.]com?

During our investigation of websites that utilize rogue advertising networks, we came across thecloudvantnow[.]com, a deceptive website. Visitors to the site are presented with false information (in the form of a fake CAPTCHA) to trick them into accepting notifications. Also, accessing thecloudvantnow[.]com could lead to other shady pages.

What is mysearchexperts.com?

During our examination of mysearchexperts.com, we learned that this is a shady search engine that may provide inaccurate results. It is common for questionable (or fake) search engines to be promoted through browser hijackers. Apps of this type hijack web browsers by changing their settings.

What is firstinearch.com?

While examining firstinearch.com, we found that it is a questionable search engine. Typically, search engines like firstinearch.com have poor search functionality and are associated with browser hijackers or other unwanted programs. In most cases, users download and install/add browser hijackers unintentionally.

What kind of scam is "Measures To Strengthen Server Security"?

After examining the letter, we have determined that it is a fraudulent email crafted by scammers with the aim of deceiving recipients into divulging personal information. The email is designed to appear as if it was sent by an email service provider and contains a hyperlink to a phishing website. Recipients should ignore this deceitful email.