Virus and Spyware Removal Guides, uninstall instructions

What are deceptive calendar events?

"Deceptive calendar events" refers to spam events created in Android device calendars by malware. The fake events are typically used to bombard victims with calendar notifications that promote various scams and malicious content.

What is ubersear[.]ch?

Ubersear[.]ch is the address of a fake search engine. Typically, websites of this kind are promoted by browser-hijacking software that modifies browser settings to cause such redirects.

However, ubersear[.]ch was observed being pushed by an Android-targeting malware called "Ads Blocker". This malicious app overlayed the browser to cause redirects. However, "Ads Blocker" is also capable of displaying deceptive calendar events and fake pop-up notifications.

What kind of application is StandardVirtue?

While testing the StandardVirtue application, our team found that it shows intrusive advertisements. For this reason, we classified StandardVirtue as adware. Typically, adware is distributed using deceptive methods. Our team discovered StandardVirtue after downloading a fake installer from an untrustworthy website.

What is Adww ransomware?

Adww is yet another ransomware-type program belonging to the Djvu malware family, which our researchers discovered while inspecting new submissions to VirusTotal.

Once we executed a sample of Adww on our test machine, it began encrypting files. The filenames of the affected files were appended with the ".adww" extension, e.g., a file initially titled "1.jpg" appeared as "1.jpg.adww", "2.png" as "2.png.adww", etc. After this process was finished, a ransom note - "_readme.txt" - was created.

What kind of website is series-protection[.]com?

While examining series-protection[.]com, our team learned that it runs the "McAfee Total Protection - Your PC Is Infected With 5 Viruses!" scam and asks for permission to deliver untrustworthy notifications. We discovered series-protection[.]com while inspecting websites that use rogue advertising networks.

What kind of malware is Adlg?

Adlg is ransomware that prevents victims from accessing/using their files by encrypting them. Adlg is part of the Djvu family. Our team discovered this malware while examining samples submitted to VirusTotal. In addition to encrypting files, Adlg renames them (it appends the ".adlg" extension to filenames) and creates a ransom note (the "_readme.txt" file).

An example of how Adlg modifies filenames: it renames "1.jpg" to "1.jpg.adlg", "2.png" to "2.png.adlg", "3.exe" to "3.exe.adlg", and so forth.

What is searchoverus.com?

While testing searchoverus.com, we learned that it is a shady search engine. It generates questionable search results and shows advertisements. Typically, search engines of this kind are promoted via apps that hijack web browsers by changing their settings. Most users add browser hijackers to browsers inadvertently.

What kind of malware is Lol?

Lol is ransomware that blocks access to data by encrypting it. In addition to encrypting files, it appends the ".lol" extension to filenames and creates the "Message.txt" file containing a ransom note. Our team discovered Lol ransomware while inspecting malware samples submitted to VirusTotal.

An example of how Lol ransomware renames files: it renames "1.jpg" to "1.jpg.lol", "2.png" to "2.png.lol", "3.exe" to "3.exe.lol", and so forth.

What kind of page is totalwebdefence[.]com?

Totalwebdefence[.]com is a rogue page that our researchers discovered while inspecting dubious websites. This webpage runs online scams, promotes browser notification spam, and redirects visitors to different (likely untrustworthy/harmful) sites.

Most users enter pages like totalwebdefence[.]com through redirects caused by websites using rogue advertising networks.

What is Saving Files?

Our researchers discovered the Saving Files browser extension while inspecting dubious software promoting websites. This piece of software is promoted as a download management tool. However, our analysis revealed that Saving Files operates as adware instead.