Virus and Spyware Removal Guides, uninstall instructions

What is pdfsearchos.com?

pdfsearchos.com is the address of a bogus search engine. These fake search tools are typically unable to provide unique results, and they also track users' browsing activity. Fake search engines are generally promoted by rogue software called browser hijackers.

Since most users download/install browser hijackers unintentionally, they are also classified as Potentially Unwanted Applications (PUAs).

What is ProgressMatch?

ProgressMatch is designed to feed users with advertisements and promote Safe Finder via akamaihd.net. It also might be designed to gather various data, since many adware-type apps have this capability. Furthermore, as people often download and install adware inadvertently, ProgressMatch is categorized as a potentially unwanted application (PUA).

What is pwz2[.]com?

pwz2[.]com is employed by MyCouponsmart adware and can also be used by other apps of this type. This site delivers ads and redirects visitors to other websites. Since it is used by an adware-type app, it might redirect to other dubious, potentially malicious websites.

At the time of research, it served an advertisement and redirected to the World Health Organization (WHO) website. Note that MyCouponsmart is categorized as a potentially unwanted application (PUA), since people often download and install it inadvertently.

What is Zeronine?

Discovered by dnwls0719, Zeronine is malicious software categorized as ransomware. This malware operates by encrypting data in order to demand payment for decryption. During the encryption process, all affected files are appended with the ".zeronine" extension.

For example, a file originally named something like "1.jpg" would appear as "1.jpg.zeronine" following encryption. Once this process is finished, a pop-up window is displayed containing a brief ransom message in Turkish and English.

What is the "To continue, you must perform a manual update" scam?

"To continue, you must perform a manual update" is a scam run on deceptive websites. It claims that users' browsers lack unspecified updates and have become vulnerable. This scheme proliferates through Potentially Unwanted Applications (PUAs) such as adware.

Few visitors to scam sites access them intentionally - most are redirected to them by intrusive advertisements or PUAs already infiltrated into the system.

What is OptimalPromo?

OptimalPromo is an adware-type app, which also has browser hijacker characteristics. OptimalPromo operates by delivering intrusive ad campaigns, changing browser settings, and promoting a fake search engine: Safe Finder (via akamaihd.net). Since most users download and install OptimalPromo unintentionally, it is classified as a Potentially Unwanted Application (PUAs).

Most PUAs track browsing-related information, and this is likely to be the case with OptimalPromo.

What is AccessSide?

AccessSide functions as adware (serves intrusive advertisements) and is also designed to promote the Safe Finder website through another dubious web address (akamaihd.net). Adware-type apps also track and record information. They are categorized as potentially unwanted applications (PUAs), since people often download and install them accidentally.

What is GlUTe?

GlUTe is malicious software, which is part of the Xorist ransomware family. It is designed to encrypt the data of infected systems in order to demand ransom payments for decryption tools. During the encryption process, all affected files are appended with the ".GlUTe" extension.

For example, a file like "1.jpg" would appear as "1.jpg.GlUTe" following encryption. Once this process is complete, a ransom message ("HOW TO DECRYPT FILES.txt") is created in all compromised folders.

What is Plenty O' Apps?

Plenty O' Apps assigns certain browser settings to hplentyoapps.com in order to promote this fake search engine. Browser hijackers often gather data relating to users' browsing activity, and this might also be the case with Plenty O' Apps.

Since users do not often download or install browser hijackers intentionally, they are categorized as potentially unwanted applications (PUAs). Note that Plenty O' Apps is distributed together with another PUA called Hide My History.

What is the "Chorus Union" email?

"Chorus Union" is the name of a malicious spam campaign designed to distribute Dridex banking malware. The scam emails sent through this spam campaign are disguised as impending invoices from "Chorus Union". These messages are intended to trick recipients into clicking the link presented within them, which will trigger download/installation of Dridex malware.

This malicious software operates by stealing online bank account details (e.g. log-ins, usernames, passwords, etc.). You are strongly advised against opening "Chorus Union" emails, as doing so can compromise system and user safety.