Virus and Spyware Removal Guides, uninstall instructions

What is premiumbros[.]com?

Similar to thenicenewz.com, leasedtohe.biz, news-central.org, fastcaptcharesolve.com, and countless others, premiumbros[.]com is an untrustworthy webpage. This site is designed to deliver questionable material and/or redirect visitors to rogue/malicious websites.

Visitors rarely enter premiumbros[.]com and pages akin to it - intentionally. Most get redirected to them by intrusive advertisements or installed PUAs (Potentially Unwanted Applications).

These apps do not require explicit permission to infiltrate devices; hence, users may be unaware of their presence. PUAs operate by causing redirects, running intrusive advert campaigns, and collecting browsing-related information.

What is reminews[.]com?

Reminews[.]com is an untrustworthy website.It shares many common traits with kokotrokot.com, reatenedb.club, ryknewho.club, and countless others. This page operates by delivering dubious material and/or redirecting visitors to rogue/malicious sites.

Users typically access such websites inadvertently; most get redirected to them by intrusive ads or installed PUAs (Potentially Unwanted Applications). These apps do not need explicit permission to infiltrate systems; hence, users may be unaware of their presence.

PUAs are designed to cause redirects, deliver intrusive advert campaigns, and collect browsing-related information.

What is Werise Tweaker?

Werise Tweaker is the name of legitimate software that is designed to optimize and speed up computers. However, there is advertising-supported software that is designed to look like the Werise Tweaker (it has the same name and similar user interface). This adware has nothing to do with the actual Werise Tweaker.

Its main purpose is to generate revenue for its developer by displaying advertisements. Users who have the fake Werise Tweaker installed on the operating system should remove it as soon as possible.

What is the "THUAN HIEP THANH" scam email?

"THUAN HIEP THANH email virus" is a malware-spreading spam campaign. This term defines a mass-scale operation during which deceptive/scam emails are sent by the thousand.

The letters distributed through this campaign - request recipients to review and confirm their purchase order. It must be emphasized that these emails are fake, and when their attachment is opened - it triggers download/installation of the NanoCore RAT (Remote Access Trojan).

Malware within this classification is designed to enable remote access and control over infected devices. These trojans can have a wide variety of heinous functionalities, and they are deemed to be highly dangerous.

What is GeneralObject?

GeneralObject is an adware-type application with browser hijacker traits. It operates by delivering intrusive advertisement campaigns and promoting fake search engines through modifications to browser settings.

Adware and browser hijackers typically spy on users' browsing activity and gather vulnerable data extracted from it. Hence, GeneralObject likely has such data tracking abilities as well.

This app has been observed being distributed via fake Adobe Flash Player updates. It is noteworthy that software products spread using dubious methods are classified as PUAs (Potentially Unwanted Applications).

What is the undwouldm[.]biz site?

Undwouldm[.]biz is a rogue website, which shares common traits with thatthereis.biz, puiont.com, ywfiof.com, and many others. This page is designed to load dubious content and/or redirect visitors to untrustworthy/malicious sites.

Users typically enter webpages of this kind inadvertently. Most get redirected to them by intrusive adverts or installed PUAs (Potentially Unwanted Applications).

This software does not require explicit user permission to infiltrate systems. Following successful installation, PUAs can cause redirects, run intrusive advertisement campaigns, and collect information relating to browsing activity.

What is ZaDaRus?

Most ransomware variants are designed to prevent victims from accessing their files - they encrypt files and demand a payment (typically, in cryptocurrency) in exchange for a decryption software, key. ZaDaRus encrypts files and appends the zadarusfiles@tutanota.com email address, a string of random characters and the ".ZaDaRus" extension.

For example, it renames a file named "1.jpg" to "1.jpg.[ZadarusFiles@tutanota.com][MJ-XH0145796823].ZaDaRus", "2.jpg" to "2.jpg.[ZadarusFiles@tutanota.com][MJ-XH0145796823].ZaDaRus", and so on. ZaDaRus also creates the "Decrypt-me.txt" file (its ransom note) in folders containing affected (encrypted) files.

This ransomware variant is part of the VoidCrypt ransomware family.

What is the Poker ransomware?

Poker is the name of a malicious program designed to encrypt data and demand ransoms for the decryption tools/software. In other words, victims cannot access or use their files, and they are asked to pay - to restore their data. During the encryption process, files are renamed according to this pattern: original filename, cyber criminals' email address, victim's ID, and ".poker" extension.

For example, a file initially titled "1.jpg" would appear as something similar to "1.jpg.[poker021@mailfence.com][MJ-IR2785309416].poker" - after encryption. Following the completion of this process, ransom notes in text files named "Decrypt-me.txt" are dropped into affected folders.

The Poker malware belongs to the VoidCrypt ransomware family.

What is SmartWebSearch?

SmartWebSearch is a potentially unwanted application (PUA), an adware-type application which is a part of the AdLoad adware family. It is designed to display intrusive advertisements and promote a fake search engine.

The app is also likely to gather browsing-related (and other) data. Research shows that SmartWebSearch is distributed through a fake Adobe Flash Player installer/updater. In most cases, people download and install apps such as SmartWebSearch unintentionally.

What is ExploreAnalog?

ExploreAnalog is designed to serve advertisements and change browser's settings (promote a fake search engine). Apps that generate ads are called adware, and apps that promote fake search engines (their addresses) are called browser hijackers.

ExploreAnalog functions as both. It is likely that it is designed to collect information about its users as well. Typically, users do not download and install apps like AAA intentionally.

For this reason, they are called potentially unwanted applications (PUAs). ExploreAnalog's installer is designed to look like the installer for Adobe Flash Player - this app is distributed using a fake installer.