Virus and Spyware Removal Guides, uninstall instructions

What is Social Search?

Social Search operates as a browser hijacker and changes certain browser settings to socialsearch.com (the address of a search engine, which displays results generated by ask.com). Commonly, users download and install these apps unintentionally and, for this reason, they are categorized as potentially unwanted applications (PUAs).

What is Template Creator Tab?

Template Creator Tab is a rogue application endorsed as a tool for easy access to various templates and template creation services. In fact, this app operates by making modifications to browser settings to promote ttemplatecreator.co (a bogus search engine).

Therefore, Template Creator Tab is classified as a browser hijacker. Additionally, most software within this classification monitors users' browsing activity, and it is highly likely that Template Creator Tab has this function. Since most users download/install this browser hijacker inadvertently, it is also classified as a Potentially Unwanted Application (PUA).

What is the Unicorn ransomware?

Discovered by JamesWT, Unicorn is malicious software categorized as ransomware. Systems infected with this malware experience data encryption and users receive ransom demands for decryption.

During the encryption process, the filenames of all affected files are appended with an extension consisting of a curse-word (note, it is partially censored, and hence the asterisk symbols are not part of the actual extension), followed by the word "unicorn", and a string of random characters - none of the parts are separated with spaces (e.g. .fu**unicorn[random_string]).

For example, a file entitled "1.jpg" would appear as something similar to "1.jpg.fu**unicornhtrhrtjrjy" following encryption. After this process is complete, a text file ("READ_IT.txt") containing a ransom message in Italian is created. Unicorn ransomware also changes the desktop wallpaper with text presented in English.

Additionally, this malware might display a Coronavirus/COVID-19 pandemic map.

What is s3arch.page?

s3arch.page is a fake search engine promoted via the Suls APP browser hijacker (the site might be promoted by other hijackers as well).

Software within this category operates by modifying browser setting to promote fake search engines. In this case, the s3arch.page search engine. Additionally, this browser hijacker monitors users' browsing activity. Due to the dubious techniques used to proliferate s3arch.page, it is also classified as a Potentially Unwanted Application (PUA).

What is Get Online Recipes?

As its name suggests, Get Online Recipes apparently provides quick access to various recipe websites. In fact, this app promotes a fake search engine (search.getrecipesonlinetab1.com) by modifying certain browser settings. Browser hijackers also collect information relating to users' browsing habits.

People often download and install these apps type inadvertently and, therefore, they are categorized as potentially unwanted applications (PUAs).

What is payB?

Discovered by dnwls0719, payB is a malicious program belonging to the Dharma ransomware family. This ransomware operates by encrypting data and demanding payment for decryption.

During the encryption process, all affected files are renamed according to this pattern: original filename, unique ID assigned to the victim, cyber criminals' email address and the ".payB" extension. For example, a file named "1.jpg" would appear as something similar to "1.jpg.id-1E857D00.[paybit@aol.com].payB" following encryption.

After this process is complete, ransom messages are created in a pop-up window and text file ("FILES ENCRYPTED.txt").

What is "VPN Update"?

There are many deceptive websites on the internet used to trick people into downloading and installing potentially unwanted applications (PUAs). This particular website suggests that, to continue watching a video, visitors must download and install an app called Secured VPN Pro.

Typically, these web pages are opened when users click deceptive ads, visit dubious websites or already have PUAs installed on browser and/or operating systems. People do not often visit these sites intentionally and, therefore, neither the web pages nor apps promoted through them can be trusted.

What is berrigroun[.]com?

berrigroun[.]com is deceptive site designed to promote scams. In this case, the promoted scheme claims that visitors' iPhones have been infected and damaged by two viruses. Scams of this type typically promote untrusted or malicious software, which are presented as tools capable of removing the fake threats.

No web page can detect viruses or other issues present on a device - any that make such claims are scams. Few users access websites such as berrigroun[.]com intentionally - most are redirected to them by intrusive advertisements or Potentially Unwanted Applications (PUAs) already installed onto the system.

What is personal-video[.]live?

There are many pages similar to personal-video[.]live on the internet. Some examples are classicgift[.]download, turbostream[.]icu and pushwelcome[.]com. All load dubious content or promote (open) other pages of this kind. T

ypically, people do not visit pages such as personal-video[.]live intentionally - they are opened through deceptive ads, other dubious websites, or potentially unwanted applications (PUAs) installed on the system. Note that PUAs are often designed to promote websites such as personal-video[.]live and also to collect information relating to browsing activities.

They are categorized as PUAs, since users often download and install them unintentionally.

What is ImagineReview?

ImagineReview is designed to feed users with various advertisements and promote a fake search engine by modifying browser settings. Therefore, this app functions both as adware and a browser hijacker. Additionally, it promotes the Safe Finder site via akamaihd.net and can read sensitive information.

In most cases, people download and install adware-type apps and browser hijackers inadvertently. Therefore, ImagineReview and other apps of this type are categorized as potentially unwanted applications (PUAs).