Virus and Spyware Removal Guides, uninstall instructions

What is promodayz[.]com?

promodayz[.]com is a rogue website similar to checkandgo.info, overiesarticu.info, pushpush.net and thousands of others. It operates by promoting dubious content and/or by redirecting visitors to other untrusted or malicious web pages. Most users enter promodayz[.]com inadvertently - they are redirected to it by intrusive ads or by Potentially Unwanted Applications (PUAs).

Note that these apps do not require express permission to be installed onto devices. PUAs cause redirects, deliver intrusive advertisement campaigns, and record browsing-related data.

What is SentinelOne Labs?

Discovered by Ghost of Kevin Beaumont Esq, SentinelOne Labs is a new variant of MBR Locker ransomware. Note that SentinelOne is the name of a legitimate cyber security company, which is not associated with this ransomware in any way.

SentinelOne Labs compromises the computer's Master Boot Record (MBR) and launches a malicious BIOS demanding a ransom payment in return for restored access to the operating system.

What is Quick Radio Search?

Quick Radio Search is a browser hijacker which promotes search.quickradiosearch.com, a fake search engine. Like most apps of this type, it promotes this address by changing certain browser settings and preventing users from undoing the modifications.

People often download and install browser hijackers inadvertently and, for this reason, they are categorized as potentially unwanted applications (PUAs).

What is Michael (Balaclava)?

Michael (Balaclava) is malicious software and a new variant of Balaclava ransomware. This malware operates by encrypting the data of infected systems and demands payment for decryption. During the encryption process, files are appended with the ".michael" extension.

For example, a file originally named something like "1.jpg" would appear as "1.jpg.michael" following encryption. After this process is complete, a ransom message ("HOW_TO_RECOVERY_FILES.txt") is dropped into every affected folder.

What is Sfile2?

Discovered by Amigo-A, Sfile2 is malicious software categorized as ransomware. After successful infiltration, this malware encrypts data and demands payment for decryption. During the encryption process, the names of all compromised files are appended with the ".sfile2" extension.

For example, a file named something like "1.jpg" would appear as "1.jpg.sfile2" after encryption. After this process, a ransom message ("!!_FILES_ENCRYPTED_.txt") is dropped into every affected folder.

What is pushsix[.]xyz?

pushsix[.]xyz is a scam website targeting iPhone users. This scheme claims that visitors' mobile devices are infected with fake viruses. These deceptive claims are used to trick people into downloading/installing the promoted software, however, content promoted using such highly dubious methods is often untrusted and can even be malicious.

For example, Potentially Unwanted Applications (PUAs) including adware, browser hijackers, fake anti-virus tools and even malware (Trojans, ransomware, etc.). Few users access pushsix[.]xyz or similar sites intentionally - most are redirected to them by intrusive ads or PUAs.

What is CyberThanos?

Discovered by MalwareHunterTeam, CyberThanos is a malicious program classified as ransomware. Systems infected with this malware suffer data encryption. Typically, malicious programs of this type encrypt files and demand payment for decryption tools/software.

During the encryption process, files are appended with the ".encrypted" extension. For example, a file originally named something like "1.jpg" would appear as "1.jpg.encrypted" following encryption, and so on for all affected files. After this process is complete, a text file named "README.txt" is created on the desktop.

This ransomware has been observed being spread under the guise of activators (activation tools) of various Microsoft software products (e.g. Windows, Microsoft Office, etc.).

What is MessengerSpot?

Virtually identical to MessengerHub, MessengerDeck, MessengerNow, and many others, MessengerSpot is an adware-type application supposedly capable of providing desktop access to Facebook Messenger. In fact, this app significantly diminishes the browsing experience by running intrusive advertisement campaigns.

Since most users download/install MessengerSpot unintentionally, it is also classified as a Potentially Unwanted Application (PUA).

What is goingapp[.]xyz?

goingapp[.]xyz is a scam website designed to trick visitors into installing a potentially unwanted application (PUA), which supposedly removes dozens of viruses that were detected by this web page. There are many websites similar to this, and none can be trusted.

Commonly, rogue addresses such as goingapp[.]xyz are opened through dubious ads (when clicked), rogue websites, or installed PUAs. In any case, people do not generally visit these web pages intentionally.

What is checkandgo[.]info?

There are many rogue websites similar to checkandgo[.]info including, for example, overiesarticu[.]info, alisalis[.]com and speakwithjohns[.]com.

All redirect visitors to other dubious web pages or load dubious content. People do not generally visit these sites intentionally - typically, they are opened via dubious ads/websites or by potentially unwanted applications (PUAs) installed on the system.