Virus and Spyware Removal Guides, uninstall instructions

What kind of malware is Adlg?

Adlg is ransomware that prevents victims from accessing/using their files by encrypting them. Adlg is part of the Djvu family. Our team discovered this malware while examining samples submitted to VirusTotal. In addition to encrypting files, Adlg renames them (it appends the ".adlg" extension to filenames) and creates a ransom note (the "_readme.txt" file).

An example of how Adlg modifies filenames: it renames "1.jpg" to "1.jpg.adlg", "2.png" to "2.png.adlg", "3.exe" to "3.exe.adlg", and so forth.

What is searchoverus.com?

While testing searchoverus.com, we learned that it is a shady search engine. It generates questionable search results and shows advertisements. Typically, search engines of this kind are promoted via apps that hijack web browsers by changing their settings. Most users add browser hijackers to browsers inadvertently.

What kind of malware is Lol?

Lol is ransomware that blocks access to data by encrypting it. In addition to encrypting files, it appends the ".lol" extension to filenames and creates the "Message.txt" file containing a ransom note. Our team discovered Lol ransomware while inspecting malware samples submitted to VirusTotal.

An example of how Lol ransomware renames files: it renames "1.jpg" to "1.jpg.lol", "2.png" to "2.png.lol", "3.exe" to "3.exe.lol", and so forth.

What kind of page is totalwebdefence[.]com?

Totalwebdefence[.]com is a rogue page that our researchers discovered while inspecting dubious websites. This webpage runs online scams, promotes browser notification spam, and redirects visitors to different (likely untrustworthy/harmful) sites.

Most users enter pages like totalwebdefence[.]com through redirects caused by websites using rogue advertising networks.

What is Saving Files?

Our researchers discovered the Saving Files browser extension while inspecting dubious software promoting websites. This piece of software is promoted as a download management tool. However, our analysis revealed that Saving Files operates as adware instead.

What is "Ads Blocker" malware?

"Ads Blocker" (appeared as "Ads Blocker V16.1" on our testing machine) is a piece of malicious software targeting Android Operating Systems (OSes). This malware is capable of hijacking the device's calendar and overlaying browsers. "Ads Blocker" aims to promote a wide variety of rogue, scam, and malicious websites in this manner (i.e., by creating deceptive calendar events, causing redirects, and displaying fake notifications).

What kind of malware is Summer Locker?

Summer Locker is ransomware that prevents victims from using their files by encrypting them. Also, it appends the ".summer" extension to filenames. Summer Locker provides two ransom notes: one of them is displayed in a pop-up window and the second one is in the "___RECOVER__FILES__.summer.txt" file that Summer Locker drops on the desktop.

An example of how Summer Locker modifies filenames: it renames "1.jpg" to "1.jpg.summer", "2.png" to "2.png.summer", "3.exe" to "3.exe.summer", and so forth.

What kind of page is week-tale[.]xyz?

Week-tale[.]xyz is a deceptive website designed to lure visitors into granting it permission to show notifications. Also, it can redirect to a scam website (and possibly other untrustworthy pages). Our team discovered week-tale[.]xyz while examining illegal movie streaming pages, torrent sites, and similar pages that use rogue advertising networks.

What is LinkRoot?

LinkRoot is the name of a rogue application that our researchers discovered while investigating new submissions to VirusTotal. After inspecting this piece of software, we learned that it operates as adware. Additionally, LinkRoot belongs to the AdLoad malware family.

What kind of application is UnitDisplay?

While testing UnitDisplay, we found that it is an advertising-supported application that shows annoying (intrusive) advertisements. In addition to displaying ads, UnitDisplay may be capable of gathering information. We discovered this app after downloading a fake installer from a deceptive website.