Virus and Spyware Removal Guides, uninstall instructions

What is Igdm ransomware?

Igdm belongs to the Djvu ransomware family. It encrypts and renames victims' files and creates a ransom message that contains details such as cost of a decryption tool and key, how to contact the ransomware developers, and various other details.

Igdm renames files by appending the ".igdm" extension to filenames. For example, "1.jpg" is renamed to "1.jpg.igdm", "2.jpg" to "2.jpg.igdm", and so on. It creates the text file "_readme.txt" (containing the ransom message) in all folders that contain encrypted files.

What is an email verification phishing scam?

Commonly, email phishing scams appear as official messages and include a website link whereby recipients are asked to provide sensitive information, such as login credentials (usernames, email addresses, passwords) for various accounts, credit card details, bank account numbers, social security numbers, and other data that could be misused for malicious purposes.

Scammers behind this phishing email attempt to trick recipients into providing their login credentials for the Roundcube email client.

What is AdBlock Stream?

AdBlock Stream is advertised as an app that blocks ads, improves browser performance, and protects online privacy and security. In fact, this app does the opposite: it functions as adware and serves advertisements. It also reads data from websites that users visit. Typically, people download and install adware inadvertently and, for this reason, AdBlock Stream and other apps of this type are categorized as potentially unwanted applications (PUAs).

What is IncognitoSearchIt?

Generally, apps such as IncognitoSearchIt (browser hijackers) modify browser settings and redirect users to the address of a specific fake search engine. This particular app promotes incognitosearchit.com. It is likely that it also collects data relating to users' browsing activities.

Frequently, users download and install browser hijackers unintentionally and, for this reason, they are categorized as potentially unwanted applications (PUAs).

What is allbestsecureeu[.]com?

allbestsecureeu[.]com is a deceptive website running various scams. At the time of research, the site promoted three variants of a scam claiming that visitors must either download/install or update Virtual Private Network (VPN) software. This type of scheme is used to endorse various untrusted and possibly malicious apps.

Such scams typically promote fake anti-viruses, adware, browser hijackers and other Potentially Unwanted Applications (PUAs). Most users access allbestsecureeu[.]com and similar web pages unintentionally, through mistyped URLs, redirects caused by intrusive advertisements or by PUAs already installed onto the systems.

What is Oct ransomware?

Oct was discovered by S!Ri. Ransomware is a type of malware that encrypts files and prevents victims from accessing them unless ransoms are paid. In most cases, ransomware renames encrypted files and generates ransom messages. Oct renames encrypted files by appending the ".oct" extension to filenames.

For example, "1.jpg" is renamed to "1.jpg.oct", "2.jpg" to "2.jpg.oct", and so on. It creates a ransom message (within the "READ_ME.txt" file), placing copies in all folders that contain encrypted files.

What is SearchUp?

SearchUp is a rogue application belonging to the Pirrit adware family. Following successful infiltration, it runs intrusive advertisement campaigns. I.e., this app delivers various misleading and possibly dangerous ads. SearchUp also has data tracking capabilities that are used to collect system/personal information.

Additionally, many examples of this software have browser hijacker characteristics, and this is likely to be the case with SearchUp. Due to the dubious techniques used to proliferate this adware, it is also classified as a Potentially Unwanted Application (PUA).

What is peachlandeu[.]com?

Commonly, websites such as peachlandeu[.]com trick visitors into believing that their devices are infected with viruses and installing potentially unwanted applications (PUAs), which supposedly remove the viruses (or other threats).

In summary, these web pages use deceptive tactics to promote PUAs. This particular page suggests that the privacy of its visitors might be at risk and invites them to download a VPN client.

Note that users do not often visit pages such as peachlandeu[.]com intentionally - they are opened by PUAs that are already installed on devices, or when users click deceptive ads or visit other dubious websites.

What is TopicLookup?

TopicLookup is promoted as a legitimate tool (app), however, it is categorized as a potentially unwanted application (PUA), an adware-type app that deploys intrusive advertisements. Additionally, these apps often gather information - usually relating to users' browsing habits.

What is FRFO?

Belonging to the Matrix ransomware family, FRFO is designed to encrypt and rename victims' files and create the "FRFO_INFO.rtf" file (ransom message) in all folders that contain encrypted files. This ransomware renames files by replacing their filenames with the fridafarko@yahoo.com email address, a string of random characters, and appending the".FRFO" extension.

For example, "1.jpg" is renamed to "[FridaFarko@yahoo.com].Uu4Yp4wx-Q2AOkq7e.FRFO", "2.jpg" to "[FridaFarko@yahoo.com].Oh5Kg3sd-W4DPhv9r.FRFO", and so on.