Virus and Spyware Removal Guides, uninstall instructions

What is UltraSearchApp?

UltraSearchApp is a rogue application belonging to the AdLoad adware family. This app has adware-type and browser hijacker traits. UltraSearchApp runs intrusive advertisement campaigns (i.e., delivers various unwanted and even dangerous ads). It can also alter browser settings to promote a fake search engine.

Most software with adware or browser hijacker characteristics can track browsing-related data. Due to UltraSearchApp's dubious proliferation methods, it is classified as a Potentially Unwanted Application (PUA). This application has been distributed using a fake Adobe Flash Player updater/installer.

As well as unwanted software, these bogus updaters/installers often spread Trojans, ransomware and other malware.

What is nlyimprese[.]fun?

Generally, users do not open pages such as nlyimprese[.]fun intentionally - they are opened when they click dubious ads, visit dubious pages, or when installed potentially unwanted applications (PUAs) open them. Note that there are many web pages similar to nlyimprese[.]fun online. Some examples are bigkick[.]biz, rchesasider[.]top and pectionexa[.]top.

What is Adrozek?

Adrozek is a malicious browser modifier, classified as adware. It operates by infiltrating browsers and injecting untrusted and malicious ads into them, however, it can do more damage than just running intrusive advertisement campaigns.

This software collects information extracted from browsers and attempts to gain a better foothold on the device through manipulation of browser settings and extensions (and installation of additional extensions).

During research, Adrozek did not successfully carry out its intended purposes, yet it nonetheless poses a significant threat to device/user safety. Due to the dubious methods used to proliferate adware, these apps are also classified as Potentially Unwanted Applications (PUAs).

What is GlobalSearchConverter?

GlobalSearchConverter is a typical browser hijacker - it promotes a fake search engine. More precisely, it modifies certain browser settings (changing them to globalsearchconverter.com.

GlobalSearchConverter also collects browsing data. Note that in most cases users download and install browser hijackers inadvertently and, for this reason, GlobalSearchConverter and other apps of this type are classified as potentially unwanted applications (PUAs).

What is GlobalPDFConverterSearch?

GlobalPDFConverterSearch is rogue software. Following successful infiltration, it makes modifications to browser settings to promote globalpdfconvertersearch.com (a fake search engine). Due to this, it is classified as a browser hijacker.

Additionally, GlobalPDFConverterSearch collects browsing-related information. Since most users download/install browser hijackers inadvertently, they are also classified as Potentially Unwanted Applications (PUAs).

What is Leitkcad?

Leitkcad ransomware encrypts victims' files, renames them by appending the ".leitkcad" extension to filenames, and creates the "help-leitkcad.txt" text file (ransom message). For example, "1.jpg" is renamed to "1.jpg.leitkcad", "2.jpg" to "2.jpg.leitkcad", and so on.

Note that Leitkcad is similar to another ransomware program called Prometey.

What is StreamSearchVault?

StreamSearchVault is rogue software, classified as a browser hijacker. It operates by making modifications to browser settings to promote streamsearchvault.com (a fake search engine). Additionally, StreamSearchVault monitors users' browsing activity and collects private, sensitive information extracted from it.

Due to the dubious techniques used to proliferate browser hijackers, they are also classified as Potentially Unwanted Applications (PUAs).

What is InitiatorValue?

InitiatorValue is untrustworthy software classified as adware and also possessing browser hijacker characteristics. It operates by delivering intrusive advertisement campaigns and making alterations to browser settings to promote fake search engines.

Additionally, most adware and browser hijackers have data tracking capabilities, which are employed to monitor users' browsing activity. Since most users download/install InitiatorValue unintentionally, it is also classified as a Potentially Unwanted Application (PUA).

What is INFECTION?

INFECTION is a part of the NEFILIM ransomware family. This malware renders files inaccessible by encryption and generates a ransom message. It also renames all encrypted files.

INFECTION encrypts files, renames them by appending the ".INFECTION" extension to filenames, and creates the "INFECTION-HELP.txt" text file (ransom message) in all folders that contain encrypted files. For example, "1.jpg" is renamed to "1.jpg.INFECTION", "2.jpg" to "2.jpg.INFECTION", and so on.

What is the Genesis ransomware?

Discovered by xiaopao, Genesis is a ransomware-type program. Systems infected with this malware experience data encryption and users receive ransom demands for decryption tools/software. During the encryption process, all affected files are appended with the ".genesis" extension.

For example, a file named something like "1.jpg" would appear as "1.jpg.genesis" following encryption. Once this process is complete, text files named "!HELP!.txt" are dropped into compromised folders. These files contain identical ransom messages.