Virus and Spyware Removal Guides, uninstall instructions

What is ettvdl[.]com?

ettvdl[.]com is a torrent website which uses rogue advertising networks to promote various websites, including dubious ones. Commonly, websites such as ettvdl[.]com contain copyrighted content (movies, music, etc.).

Torrenting is not illegal, however, the same cannot be said about downloading copyrighted content. Therefore, you are advised not to use or visit ettvdl[.]com (or other similar pages).

What is WebDefence?

WebDefence is advertised as software that improves browsing security and the overall browsing experience. In fact, it is an advertising-supported web browser based on Chromium (free and open-source software project from Google). Therefore, WebDefence is classified as adware.

Note that, in most cases, users download and install adware inadvertently and, for this reason, apps of this type are categorized as potentially unwanted applications (PUAs).

What is GillCom?

GillCom is rogue software categorized as a browser hijacker. It operates by making changes to browser settings to promote fxsmash.xyz (a bogus search engine). In addition, GillCom has data tracking capabilities that are employed to monitor users' browsing habits.

Due to the dubious methods used to proliferate browser hijackers, they are also classified as Potentially Unwanted Applications (PUAs).

What is IncognitoSearchNet?

The main purpose of the IncognitoSearchNet browser hijacker is to force users to visit incognitosearchnet.com (a fake search engine). Like most apps of this type, it promotes the bogus address by modifying certain browser settings. IncognitoSearchNet also collects details relating to users' browsing habits.

Frequently, users download and install apps such as IncognitoSearchNet (browser hijackers) inadvertently and, for this reason, they are classified as potentially unwanted applications (PUAs).

What is the global-support[.]space site?

Global-support[.]space (apple.global-support[.]space) is a deceptive website designed to promote scams. At the time of research, this site ran a scheme targeting iPhone users, yet the web page might be accessed on other Apple devices as well.

This scam claims that users' iPhones have been infected and damaged. According to the scheme, these fake viruses can be removed by installing a recommended anti-virus tool. No website can detect threats/issues present on devices, and any that make such claims are scams.

The purpose of this scheme is to endorse untrusted software products such as Potentially Unwanted Applications (PUAs). Most users enter deceptive sites inadvertently via mistyped URLs, through redirects caused by intrusive advertisements, or by PUAs. Note that global-support[.]space has been observed being promoted via deceptive Calendar events.

What is tutupdate29[.]com?

Commonly, browsers open websites such as tutupdate29[.]com when they have potentially unwanted applications (PUAs) installed on them. I.e., users do not often visit these pages intentionally. Note tutupdate29[.]com (and similar sites) are also promoted via other dubious web pages and advertisements.

What is UpgradeCommand?

UpgradeCommand is designed to serve ads (like most adware-type apps) and promote a fake search engine. Therefore, UpgradeCommand functions both as adware and a browser hijacker. It is also likely to gather information relating to users' browsing habits and other data.

Users often download and install apps like UpgradeCommand inadvertently and, therefore, they are classified as potentially unwanted applications (PUAs).

What is rarbg[.]to site?

rarbg[.]to is a P2P (Peer-to-Peer) sharing website, which allows users to share content via Torrent files. As well as infringing copyright laws, this site also employs rogue advertising networks. Therefore, visitors to this web page are redirected to various other dubious and possibly malicious websites.

Note that Torrent sites can offer Potentially Unwanted Applications (PUAs) and even malware (e.g. Trojans, ransomware, etc.) disguised as or bundled with ordinary content. Due to this, you are strongly advised against visiting and/or using rarbg[.]to.

What is Nusmash?

Nusmash is a browser hijacker that promotes nusmash.com, the address of a fake search engine. Generally, apps of this type promote fake search engines by modifying certain browser settings. Additionally, they can gather various browsing-related information.

Users often download and install browser hijackers inadvertently and, therefore, Nusmash and other apps of this type are categorized as potentially unwanted applications (PUAs).

What is LAZPARKING ransomware?

Discovered by Petrovic, LAZPARKING is malicious software categorized as ransomware. Systems infected with this malware have their data encrypted and users receive ransom demands for decryption. During the encryption process, all affected files are appended with the ".LAZPARKING-[random_string]" extension.

For example, a file originally named "1.jpg" would appear as something similar to "1.jpg.LAZPARKING-bwxwvhui-w" following encryption. After this process is complete, ransom messages within "!!LAZPARKING-MESSAGE.txt" files are dropped into compromised folders.