Virus and Spyware Removal Guides, uninstall instructions

What is fake Google Translate extension?

Potentially unwanted applications (PUAs) are commonly distributed using installers for other apps of this type. In other words, this software is often bundled with additional unwanted and/or malicious applications.

Hence, in some cases, a deceptive installer (e.g., fake Adobe Flash Player updater/installer) carrying software like the fake Google Translate extension - also installs multiple browser hijackers, adware, trojans, ransomware, etc.

This fake Google Translate extension is also promoted using deceptive installers. It can operate as adware, spy on users' browsing activity, and even steal Facebook log-in credentials. Users who have this extension installed on browsers should remove it immediately.

What is videogate1[.]com?

videogate1[.]com is an untrusted web page that users do not often visit intentionally. Usually, these pages are opened by clicking deceptive ads, while visiting other bogus web pages, or they are opened by browsers with potentially unwanted applications (PUAs) installed.

There are many websites similar to videogate1[.]com online including, for example, financeflick[.]com, aboutyoun[.]com, and datingbasedspot[.]com.

What is Namaste ransomware?

Namaste is designed to prevent victims from accessing their files - it encrypts and renames files and keeps them inaccessible unless victims use a valid decryption tool. This ransomware appends the "._enc" extension to the filenames of all encrypted files. For example, "1.jpg" is renamed to "1.jpg._enc", "2.jpg" to "2.jpg._enc", and so on.

Namaste also displays a ransom message on the screen and changes the desktop wallpaper. This ransomware is notable for repeatedly playing an audio recording announcing: "pay now to recover your files".

What is the Avaad ransomware?

Discovered by Jakub Kroustek, Avaad is a malicious program belonging to the Dharma ransomware group. It is designed to encrypt data and demand payment for decryption. During the encryption process, affected files are renamed following this pattern: original filename, unique ID, cyber criminals' email address, and the ".Avaad" extension.

For example, a file originally titled "1.jpg" would appear as something similar to "1.jpg.id-C279F237.[Avaaddams@msgsafe.io].Avaad" following encryption. After this process is complete, ransom-demand messages are created in a pop-up window and "FILES ENCRYPTED.txt" text file.

What is x2convert[.]com?

x2convert[.]com is an untrusted website, offering YouTube video and audio download services. This page allows users to convert YouTube URLs (links) into downloadable MP3/MP4 files.

Note that x2convert[.]com infringes copyright laws and uses rogue advertising networks. Sites that use these networks promote various untrusted and malicious websites, which pose a threat to device and user safety. Therefore, you are strongly advised against visiting or using x2convert[.]com.

What is d8yI+Hf7rX?

d8yI+Hf7rX is a potentially unwanted application (PUA), a browser extension that comes bundled with other apps of this type (e.g., Gdiview). Bundled apps are classified as PUAs because users often download and install them inadvertently. Note that d8yI+Hf7rX adds the "Managed by your organization" extension to Chrome browsers.

The purpose of d8yI+Hf7rX is unknown, however, it is likely that this app generates ads, changes browser settings, and gathers various information. In this way, d8yI+Hf7rX will function as adware and a browser hijacker.

What is the Go surfing browser hijacker?

Go surfing is a browser hijacker, which promotes the keysearchs.com fake search engine. Software within this category typically promotes search engines by making modifications to browser settings, however, Go surfing does not always modify browsers in this way (see below).

Go surfing is also a serious privacy concern, since it collects browsing-related information. Most users download/install browser hijackers inadvertently, and so they are also classified as Potentially Unwanted Applications (PUAs).

What is ReSearchConverter?

ReSearchConverter is dubious software that is categorized as a browser hijacker. Following successful installation, it makes alterations to browser settings to promote researchconverter.com (a bogus search engine).

ReSearchConverter also has data tracking capabilities, which are employed to monitor browsing activity and collect sensitive information extracted from it. Since most users download/install browser hijackers unintentionally, they are also classified as Potentially Unwanted Applications (PUAs).

What is Cosd?

Cosd belongs to the Djvu ransomware family. Its main purpose is to encrypt files and keep them inaccessible (unusable) unless a ransom is paid. Typically malware of this type uses strong encryption algorithms to encrypt files so that victims cannot recover files unless they pay.

Cosd ransomware also renames all encrypted files by appending its extension (".cosd") to filenames. For example, "1.jpg" is renamed to "1.jpg.cosd", "2.jpg" to "2.jpg.cosd", and so on. Additionally, it creates the "_readme.txt" files (ransom messages) in all folders that contain encrypted files.

What is the "Generate Bitcoin" scam?

"Generate Bitcoin" refers to a scam run on various deceptive websites. This scheme invites users to generate up to 0,2 BTC (Bitcoin cryptocurrency) each week for a relatively small fee.

In fact, this scam cannot generate the promised cryptocurrency - its sole purpose is to trick users into transferring Bitcoins to the scammers responsible. Therefore, you are strongly advised against using the fake "Generate Bitcoin" service.

Typically, users access deceptive/scam sites via mistyped URLs, redirects caused by intrusive ads, and by Potentially Unwanted Applications (PUAs).