Virus and Spyware Removal Guides, uninstall instructions

What is the ElvisPresley ransomware?

Discovered by cyber security researcher, Jack, ElvisPresley is a malicious program belonging to the Jigsaw ransomware family. This malware operates by encrypting the data of infected systems in order to demand payment for decryption. During the encryption process, all affected files are appended with the ".ElvisPresley" extension.

For example, a file originally named something like "1.jpg" would appear as "1.jpg.ElvisPresley" following encryption. Once this process is complete, a pop-up window containing the ransom message is displayed.

What is CompeteService?

CompeteService functions both as adware and a browser hijacker: it feeds users with various advertisements, and promotes a fake search engine by changing browser settings. Research shows that this app promotes the Safe Finder web page (by opening it via akamaihd.net) and collects sensitive information.

People often download and install software such as CompeteService inadvertently and, therefore, these apps are categorized as potentially unwanted applications (PUAs).

What is "Error # 0x80092ee9"?

"Error # 0x80092ee9" is one of many scam websites. This particular one claims that it has detected some spyware/riskware, which caused the "0x80092ee9" error. To remove detected threats and fix the error, visitors are encouraged to call the telephone number displayed.

Scammers behind this website pose as Microsoft Support, however, the company has nothing to do with this scam. We strongly recommend that you ignore this web page and, more importantly, do not contact these scammers.

What kind of malware is BOMBO?

BOMBO belongs to the Dharma ransomware family and was discovered by Petrovic. BOMBO ransomware encrypts files and renames them, displays a ransom message (in a pop-up window), and drops other ransom messages (text files) into folders that contain encrypted data.

It renames encrypted files by adding the victim's ID, Bit_decrypt@protonmail.com email address, and appending the ".BOMBO" extension. For example, it would rename a file called "1.jpg" to "1.jpg.id-1E857D00.[Bit_decrypt@protonmail.com].BOMBO", "2.jpg" to "2.jpg.id-1E857D00.[Bit_decrypt@protonmail.com].BOMBO", etc.

It creates text files/ransom messages named "FILES ENCRYPTED.txt". The text files and displayed pop-up windows contain instructions about how to contact BOMBO's developers.

What is SearchToolHelper?

SearchToolHelper is a rogue app categorized as adware, which also has browser hijacker characteristics. Following successful infiltration, this application runs intrusive advertisement campaigns, modifies browser settings and promotes fake search engines.

Most adware and browser hijacking apps collect browsing-related information, and it is highly likely that SearchToolHelper does so as well. Since most users download/install this app unintentionally, it is classified as a Potentially Unwanted Application (PUA).

One of the dubious methods used to distribute SearchToolHelper is through fake Adobe Flash Player updates. Bogus software updaters and installers often proliferate Trojans, ransomware and other malware.

What is PrimaryIndexer?

PrimaryIndexer is designed to serve advertisements, promote the Safe Finder website (by opening it through akamaihd.net) and change certain browser settings to the address of a fake search engine. In this way, the app functions as adware and a browser hijacker.

Research shows that PrimaryIndexer can read sensitive information as well. Commonly, people do not download adware intentionally and, therefore, apps of this type are categorized as potentially unwanted applications (PUAs).

What is Easy Email Checker?

Easy Email Checker hijacks browsers by changing certain settings to easyemailcheck.co (the address of a fake search engine). It is likely that this app also collects information relating to users' browsing activities. Browser hijackers are categorized as potentially unwanted applications (PUAs), since people tend to download and install them unintentionally.

What is testyourlucky[.]com?

When visited, testyourlucky[.]com opens various other scam websites claiming that people have the chance to win a prize. These scam sites attempt to deceive visitors into entering personal information or even paying, for example, a shipping fee. Neither testyourlucky[.]com nor websites that are opened through it can be trusted.

Note that people do not often visit these web pages intentionally - they are usually opened through other dubious web pages, clicked deceptive advertisements or potentially unwanted applications (PUAs) installed on the system.

What is checkvd[.]com?

checkvd[.]com is an untrustworthy site sharing similarities with enerativearea.pro, oawhaursaith.com, globallyreinvation.com and countless other rogue web pages. It presents visitors with dubious content and/or redirects them to other malicious websites.

Typically, checkvd[.]com and similar pages are accessed via redirects caused by intrusive ads or Potentially Unwanted Applications (PUAs). This software does not need explicit user consent to be installed onto devices. PUAs cause redirects, run intrusive advertisement campaigns, and track browsing-related data.

What is Track Net Speed?

Track Net Speed is a browser hijacker endorsed as an internet speed tracking tool. It operates by making alterations to browser settings to promote tracknetspeed.com (a bogus search engine). Track Net Speed also possesses data tracking capabilities, which are used to monitor users' browsing activity.

Due to the dubious distribution techniques used to proliferate Track Net Speed, it is classified as a Potentially Unwanted Application (PUA).