Virus and Spyware Removal Guides, uninstall instructions

What is TechLetterSearch?

Sharing many similarities with GlobalAdviseSearch and ExploreSearchResults, TechLetterSearch is an adware-type application. This app is part of the AdLoad adware family and infiltrates systems under the guise of a Flash Player updater.

TechLetterSearch operates by running intrusive advertisement campaigns, however, it may also have browser hijacker traits such as promotion of fake search engines.

Most adware types possess data tracking abilities. Due to its deceptive proliferation methods (i.e., via fake Flash updates), TechLetterSearch is classified as a Potentially Unwanted Application (PUA). Note that rogue software updaters are used to spread not only unwanted content but also malicious software (e.g. ransomware, trojans, etc.).

What kind of malware is Cuba?

Cuba (also known as COLDDRAW) was discovered by Raby and encrypts files, changes filenames by appending the ".cuba" extension, and creates the "!!FAQ for Decryption!!.txt" text file (ransom message).

For example, "1.jpg" is renamed to "1.jpg.cuba", and so on. Typically, people who have computers infected with ransomware like Cuba cannot use or even access encrypted files unless they decrypt them with specific decryption tools/keys that can only be purchased from the cyber criminals who designed the program.

What is NEWS ransomware?

NEWS is a malicious program belonging to the Dharma ransomware family. It operates by encrypting the data of infected devices so that ransom demands can be made for decryption tools/software.

When NEWS malware encrypts, all files are renamed according to the following pattern: original filename, victim's unique ID, cyber criminals' email address and the ".NEWS" extension. For an example, a file named "1.jpg" would appear as something similar to "1.jpg.id-1E857D00.[notgoodnews@tutanota.com].NEWS" following encryption.

After this process is complete, a text file is stored on the desktop ("FILES ENCRYPTED.txt") and a pop-up window is displayed. These files contain the ransom messages.

What is balanceforsun[.]com?

balanceforsun[.]com a rogue website that, if opened, redirects to untrusted websites or loads dubious content. Browsers commonly open pages such as balanceforsun[.]com due to installed potentially unwanted apps (PUAs) - people do not generally open them intentionally.

PUAs cause redirects to dubious websites, serve intrusive ads and gather browsing data. More examples of websites similar to balanceforsun[.]com are sawhitpew[.]site, wbamedia[.]net and betanews[.]me.

What is Stream Live Radio?

Stream Live Radio is a dubious application advertised as a tool for quick access to various online radio services. This app is a browser hijacker, which operates by altering settings to promote search.streamliveradiotab.com, a fake search engine. Furthermore, it has data tracking capabilities to monitor users' browsing habits.

Since most users install Stream Live Radio unintentionally, it is also categorized as a Potentially Unwanted Application (PUA) and is often distributed together with Hide My Searchers (another PUA).

What are deceptive Calendar events?

There are numerous dubious websites that contain deceptive advertisements, demand permission to show notifications, and display deceptive pop-up windows and other intrusive content that should not be clicked.

Many people have recently noticed that unwanted events are added to the Calendar application on their mobile Apple devices. These events are usually added after clicking pop-up windows, notifications, etc., whilst trying to close them.

What is New File Converter?

New File Converter is a rogue application, endorsed as a tool for quick access to file conversion services. In fact, it operates as a browser hijacker (i.e., modifies browsers to promote search.newfileconvertertab.com, a fake search engine). Additionally, it monitors users' browsing habits.

Since many users install this application inadvertently, it is also classified as a PUA (Potentially Unwanted Application). Note that New File Converter is often distributed together with another PUA called Hide My Searches.

What is TV Streaming Plus?

The TV Streaming Plus app supposedly provides quick access to various online TV and Movie streaming websites, however, it is categorized as a potentially unwanted application (PUA), a browser hijacker. TV Streaming Plus promotes tvstreamingplus.com (the address of a fake search engine) by changing browser settings and gathering various data.

People often download and install software of this type inadvertently. Furthermore, TV Streaming Plus is not the only application installed during the process - another PUA called Search Defender Prime is also installed.

What is sawhitpew[.]site?

sawhitpew[.]site is one of many websites that redirect visitors to other rogue, potentially malicious site or load dubious content. More examples of websites similar to sawhitpew[.]site are betanews[.]me, fastnewstream[.]com and lifeimpressions[.]net.

Typically, they are opened through other dubious web pages, deceptive advertisements or potentially unwanted applications (PUAs) that are installed on browsers and/or operating systems. In any case, people do not commonly visit these sites intentionally. Note that most PUAs collect information relating to users' browsing habits and serve intrusive ads.

What is RunBooster?

RunBooster is categorized as a potentially unwanted program (PUP) and adware ('malvertising' adware) that infiltrates systems without consent and causes pop-up redirects (ads). It might also record user-system information relating to Internet browsing activity.