Virus and Spyware Removal Guides, uninstall instructions

What is Deuce?

Deuce is a ransomware-type program, designed to encrypt data and demand ransom payments for decryption. The program belongs to the Phobos ransomware family. During the encryption process, all files are renamed with the victim's ID number, developer's email address, and ".deuce" (".id[victim's_ID].[prndssdnrp@mail.fr].deuce").

For example, "1.jpg" might appear as "1.jpg.id[1E857D00-2503].[prndssdnrp@mail.fr].deuce", and so on for all compromised files. Two files ("info.hta" and "info.txt") are then stored in each affected folder. Updated variants of this ransomware use the ".[topot@cock.li].deuce" extension for encrypted files.

What is private-show[.]live?

private-show[.]live is the address of a website that can load dubious content or open other rogue web pages. Many other websites operate in this way. For example, sonagerthrou[.]com, bestgamesvault[.]com, and bestflowingstuff[.]co.

Generally, people do not visit these sites intentionally - they are opened automatically by browsers with potentially unwanted applications (PUA) installed. As well as forcing users to visit untrustworthy web pages, PUAs collect browsing data and display intrusive advertisements.

What is Total Mac Care?

Total Mac Care software is promoted as a MacOS (Mac Operating System) cleaning tool. It is supposedly capable of improving startup times and enhancing system performance by removing unnecessary and potentially harmful content. Total Mac Care is categorized as a Potentially Unwanted Application (PUA), since many users install it inadvertently.

The program is typically distributed within the download/install setups of other products ("bundling").

What is Search Defender Live?

Identical to Search Defender Prime, Search Defender Live is an app which supposedly makes web browsing more secure. It is virtually identical to Search Defender Prime: it change browser settings and gathers various browsing data. Note, however, that they both promote a different fake search engine.

Apps of this type are categorized as browser hijackers and potentially unwanted applications (PUAs). In most cases, people download and install PUAs unintentionally.

What is Recall Alerts?

Recall Alerts is a rogue application endorsed as a multi-purpose tool. It can allegedly provide quick and easy access to product recalls (purchase returns due to safety issues and/or defects), safety services, weather forecasts, news, and email provider websites.

This app is classified as a browser hijacker, since it modifies browsers to promote search.recallalertstab.com, a fake search engine.

Additionally, it monitors users' browsing activity. Most downloads/installations of Recall Alerts are not intentional, as it has dubious proliferation methods. Therefore, it is also classed as a PUA (Potentially Unwanted Application). Note that Recall Alerts is often distributed together with another PUA called Hide My Searches.

What is 2048?

2048 is a malicious program which belongs to the Dharma ransomware family. Software of this type is designed to encrypt data so that victims are unable to regain access to their files without paying ransoms to cyber criminals. 2048 changes each encrypted file by adding an ID, an email address, and ".2048" to the filename.

For example, "1.jpg" becomes "1.jpg.id-1E857D00.[rsa2048@cock.li].2048". Furthermore, 2048 displays ransom message in a pop-up window and creates the "FILES ENCRYPTED.txt" file with another ransom message.

What is Inmate Search?

Inmate Search app is advertised as a tool that allows users to access inmate records directly from a new browser tab. Once installed, however, it changes certain browsers settings to search.inmatesearchtab.com, the address of a fake search engine. Furthermore, it records various browsing data.

Applications of this type are classified as potentially unwanted apps (PUAs), browser hijackers. Typically, people download and install PUAs inadvertently. Note that Inmate Search is distributed with another PUA called Hide My Searches.

What is sonagerthrou[.]com?

sonagerthrou[.]com is similar to other web pages such as bestflowingstuff[.]co, aleailarm[.]com, becausenightisbetter[.]com, and many more. When visited, it loads dubious content or opens other dubious websites. People do not generally visit sonagerthrou[.]com (or other pages of this type) intentionally.

In most cases, they are opened by potentially unwanted applications (PUAs) installed on browsers. Furthermore, software of this type is often designed to record browsing data and serve ads.

What is bestgamesvault[.]com?

bestgamesvault[.]com is a rogue website designed to present visitors with dubious content and redirect them to other untrustworthy and even malicious web pages. Most visitors do not access this site intentionally - they are redirected by intrusive advertisements or Potentially Unwanted Applications (PUAs) already infiltrated into devices.

After successful installation, PUAs cause redirects, deliver ads, hijack browsers, and collect browsing-related information. The bestgamesvault[.]com site shares many similarities with bestflowingstuff.co, aleailarm.com, rednews7.com, and countless others.

What is ProDocToPdf?

The ProDocToPdf app supposedly converts various documents to PDF format, however, it is categorized as a potentially unwanted application (PUA), and a browser hijacker. Typically, people download and install PUAs unintentionally. When installed, browser hijackers promote fake search engines by changing browser settings. They also record browsing data.