Virus and Spyware Removal Guides, uninstall instructions

What is 1shownews[.]com?

1shownews[.]com is an untrustworthy website, sharing common traits with enerativearea.pro, oawhaursaith.com, globallyreinvation.com and countless others. Visitors to this site are presented with dubious material and/or are redirected to other rogue and malicious pages.

These websites are rarely accessed intentionally, since most visitors enter them via redirects caused by intrusive ads or Potentially Unwanted Applications (PUAs). These apps do not need express user permission to be installed onto devices. PUAs cause redirects, deliver intrusive ad campaigns, and track browsing-related information.

What is prudensearch.com?

prudensearch.com is the address of a fake search engine supposedly designed to improve the browsing experience (generate accurate results, provide quick access to various popular pages, etc.). Generally, these search engines are promoted through potentially unwanted applications (PUAs) classified as browser hijackers.

Note that prudensearch.com is promoted through a PUA called PrudenSearch. Typically, apps of this type promote fake search engines by changing certain browser settings. They also gather various data. PrudenSearch is distributed through a deceptive Adobe Flash Player installer, which is also used to distribute other PUAs named Media Player, Easy Mac Care and Shoptimizely.

What is ZORAB?

Discovered by malware researcher S!Ri, ZORAB is a malicious program classified as ransomware. Systems infected with this program experience data encryption and users receive ransom demands for decryption tools/software. During the encryption process, files are appended with the ".ZRB" extension.

For example, a file like "1.jpg" would appear as "1.jpg.ZRB" following encryption, and so on for all affected files. After this process is complete, a ransom message ("--DECRYPT--ZORAB.txt") is dropped into every compromised folder.

What is "Orange Email Virus"?

Orange is a legitimate French multinational telecommunications corporation. In this case, cyber criminals exploit its name for malicious purposes. I.e., they send an email disguised as an invoice from Orange.

Their main goal is to trick recipients into opening the attached malicious MS Excel file and allowing it to enable content. If allowed, it then installs ZLoader, a malicious program.

What is Searchaize?

Searchaize is a browser hijacker which promotes searchaize.com, a fake search engine by modifying certain browser settings. As well as hijacking browsers, this app might collect various user-system information. Commonly, people download and install browser hijackers inadvertently and, therefore, they are categorized as potentially unwanted applications (PUAs).

What is RocketFixio?

RocketFixio is a Potentially Unwanted Application (PUA) endorsed as a tool to clean and optimize operating systems. The advertised functionalities include removal of junk files, optimization of the Windows Registry and improvement of system startup speed.

This type of software is classified as a PUA due the dubious methods used to proliferate it, such as "bundling". I.e., many users download/install PUAs inadvertently, or they are tricked into doing so. Furthermore, these unwanted apps can have dangerous capabilities, which endanger device and user safety.

What is "Spring Company invoice"?

There are many cases whereby cyber criminals trick people into installing malware onto their computers through spam campaigns. They attempt to deceive them by sending emails that contain a malicious attachment or website link. Their main goal is to trick recipients into executing the malicious file, which then installs rogue software.

In this case, they send emails that contain an attachment designed to install IceID, a Trojan which is used to steal sensitive information.

What is SocratesResults?

SocratesResults is a rogue application classified as adware. It also has certain browser hijacker characteristics. It operates by delivering intrusive advertisement campaigns, modifying browser settings and promoting fake search engines. Most adware and browser hijackers monitor users' browsing activity, and it is highly likely that SocratesResults does so as well.

Due to the dubious proliferation methods used to proliferate this app, it is classified as a Potentially Unwanted Application (PUA). One of these methods is via fake Adobe Flash Player updates. Note that bogus software installers/updaters are often used to proliferate Trojans, ransomware and other malware as well.

What is Shoptimizely?

Shoptimizely is advertised supposedly improving the online shopping experience. In fact, this app is classified as adware - it serves various advertisements. Commonly, Shoptimizely and similar apps collect data. People often download and install adware inadvertently and, therefore, apps of this type are categorized as potentially unwanted applications (PUAs).

Research shows that Shoptimizely is distributed through a fake Adobe Flash Player installer.

What are the "Tokyo Olympics 2020" emails?

"Tokyo Olympics 2020" is a phishing email spam campaign. These deceptive messages supposedly contain information provided by the International Olympic Committee (IOC) concerning the 2020 Tokyo Olympics and potential changes due to the ongoing pandemic.

This spam campaign is yet another example of scammers incorporating Coronavirus/COVID-19 into their schemes. The "Tokyo Olympics 2020" emails are designed to trick recipients into providing their personal information. For example, email account log-in credentials.