Virus and Spyware Removal Guides, uninstall instructions

What is Keep It Dark?

During a routine inspection of questionable software-promoting webpages, our researchers discovered the Keep It Dark browser extension. It promises to enable dark mode for browsers. We analyzed this extension and determined that it operates as advertising-supported software (adware) instead.

What kind of page is shieldforbrowsers[.]com?

While inspecting dubious pages, our researchers discovered the shieldforbrowsers[.]com rogue website. It is designed to run scams, promote spam browser notifications, and redirect visits to different (likely untrustworthy and malicious) sites.

Users typically access webpages like shieldforbrowsers[.]com via redirects caused by others that use rogue advertising networks.

What kind of application is Dark Display?

We have discovered the Dark Display application while examining shady websites and inspecting deceptive advertisements. We learned that Dark Display is supposed to provide a dark mode for web browsers but functions as adware (it shows unwanted advertisements).

What kind of application is Simple Search?

Our team discovered the Simple Search application while analyzing deceptive web pages. We found that the purpose of Simple Search is to promote search.simple-searchs.com (force users to browse the Internet with a fake search engine). Simple Search promotes this address by hijacking a web browser (by modifying its settings).

What is RozbehOfSatan ransomware?

RozbehOfSatan is the name of a ransomware-type program. It is a new variant of the Rozbeh ransomware. After executing a sample of RozbehOfSatan on our test system, it encrypted files and created a ransom note.

Typically, ransomware renames the affected files, but that is not to case with RozbehOfSatan. Once the encryption was completed, a pop-up window was displayed.

What kind of application is TextBoard?

Our team has spotted the TextBoard application while inspecting samples submitted to the VirusTotal website. After examination, we learned that the purpose of TextBoard is to display various advertisements. Thus, we classified this application as adware. Typically, users install software of this type inadvertently.

What is Togo tab?

Togo Tab is a rogue browser extension that we found while inspecting dubious download webpages. We determined that this piece of software operates as a browser hijacker. It modifies browsers and promotes the togosearching.com illegitimate search engine.

What is Top Search?

While inspecting untrustworthy download webpages, our research team discovered the Top Search browser extension. Our analysis of this extension revealed that it operates as browser-hijacking software and promotes the search.tops-searchs.com fake search engine.

What kind of malware is LockBit 3.0?

LockBit 3.0 (also known as LockBit Black) is a new variant of the LockBit ransomware. It encrypts files, modifies their filenames, changes the desktop wallpaper, and drops a text file (named "[random_string].README.txt") on the desktop. LockBit 3.0 replaces the name of the file and its extension with random dynamic and static strings.

An example of how LockBit 3.0 renames files: it replaces "1.jpg" with "CDtU3Eq.HLJkNskOq", "2.png" with "PLikeDC.HLJkNskOq", "3.exe" with "qwYkH3L.HLJkNskOq", and so forth.

What kind of malware is Ghsd?

Ghsd is ransomware, a form of malware designed to encrypt files. We discovered it while examining the samples submitted to VirusTotal. Ghsd is part of the Djvu ransomware family. It not only encrypts but also renames files (by appending the ".ghsd" extension to filenames) and drops the "_readme.txt" file containing a ransom note.

An example of how Ghsd renames files: it renames "1.jpg" to "1.jpg.ghsd", "2.png" to "2.png.ghsd", and so forth.