Virus and Spyware Removal Guides, uninstall instructions

What is Nobu?

Nobu is classified as ransomware because it encrypts files and creates a ransom message. It also renames all encrypted files by appending the ".nobu" extension. For example, "1.jpg" is renamed to "1.jpg.nobu", "2.jpg" to "2.jpg.nobu", and so on.

Nobu creates a ransom message (within "_readme.txt") in all folders that contain encrypted files. Note that this ransomware belongs to the Djvu ransomware family.

What is the atinterboa[.]space website?

atinterboa[.]space is an untrustworthy website designed to present visitors with dubious content and/or to redirect them to other bogus and possibly malicious web pages. There are thousands of similar sites on the web, including tutupdate29.com, rchesasider.top, tecontrad.top, and psalrausoa.com to name just a few.

Most users access these web pages via redirects caused by intrusive ads or by Potentially Unwanted Applications (PUAs) already installed on their devices. This software does not need express user permission to be infiltrated into systems. PUAs operate by causing redirects, running intrusive advertisement campaigns and gathering browsing-related data.

What is gkillegebre[.]space?

There are many websites like gkillegebre[.]space, for example, psalrausoa[.]com, odrivicdriv[.]top and hilycover[.]top. In most cases users end up on such pages unintentionally. It is common that sites like gkillegebre[.]space get opened by browsers that have some potentially unwanted application (PUA) installed on them.

It is worthwhile to mention that apps of this can be designed to serve ads and/or collect details related to user's web browsing habits as well.

What is the esholipsex[.]space site?

Sharing many similarities with tutupdate29.com, tecontrad.top, psalrausoa.com and countless others, esholipsex[.]space is a rogue website. Visitors to this page are presented with dubious content and/or redirected to other bogus or even malicious sites.

Intentional access to rogue web pages is rare - typically, users enter them via redirects caused by intrusive ads or by Potentially Unwanted Applications (PUAs). These apps do not require explicit permission to infiltrate systems and hence users may be unaware of their presence.

PUAs operate by causing redirects, delivering intrusive advertisement campaigns and collecting browsing-related information.

What is Funsearch?

Funsearch is a browser hijacker that promotes a fake search engine (quicknewtab.com). These apps often hijack browsers by modifying browser settings. Most collect browsing data and other details.

Typically, users do not download or install browser hijackers intentionally and, therefore, Funsearch and similar apps are categorized as potentially unwanted applications (PUAs).

What is the SchwarzeSonne Trojan?

SchwarzeSonne is malicious software classified as a Trojan. This type of malware has a wide variety of dangerous functionality. SchwarzeSonne can steal system and user information, and potentially used to cause chain infections (i.e. download/install additional malicious programs).

This Trojan is highly dangerous and poses a threat to device and user safety.

What is muhamm[.]space?

Generally, users do not visit websites such as muhamm[.]space intentionally - they are opened by browsers automatically when they have potentially unwanted applications (PUAs) installed on them.

They are classified as PUAs because, in most cases, users download and install them unintentionally. Some examples of pages that are similar to muhamm[.]space (and are often promoted by PUAs) include tutupdate29[.]com, tecontrad[.]top and psalrausoa[.]com.

What is K2 ransomware?

K2 belongs to the VoidCrypt ransomware family. Ransomware is a type of malware that prevents victims from accessing the operating system and/or files and demands ransom payments. In most cases, this malware renames encrypted files and provides contact details and/or payment information within ransom messages.

K2 renames encrypted files by adding the helpforfiles@xmpp.es email address, victim's ID, and appending the ".k2" extension to filenames. For example, "1.jpg" is renamed to "1.jpg.[Helpforfiles@xmpp.es][3R1EO5WNJM7A6DQ].k2", "2.jpg" to "2.jpg.[Helpforfiles@xmpp.es][3R1EO5WNJM7A6DQ].k2", and os on.

It creates a ransom message within the "!INFO.HTA" file, which is stores in all folders that contain encrypted files.

What is IncognitoSearcher?

IncognitoSearcher is dubious software categorized as a browser hijacker. It operates by making changes to browser settings to promote incognitosearcher.com (a fake search engine). In addition, most browser hijackers monitor users' browsing habits, and it is likely that IncognitoSearcher is no exception to this.

Since most users download/install browser hijackers unintentionally, they are also classified as Potentially Unwanted Applications (PUAs).

What is GetSearchConverter?

GetSearchConverter modifies web browser settings and redirects users to getsearchconverter.com. I.e., it forces people to use this fake search engine. GetSearchConverter also reads the browsing history. Typically, users do not download or install browser hijackers intentionally and, for this reason, they are classified as potentially unwanted applications (PUAs).