Virus and Spyware Removal Guides, uninstall instructions

What is .good?

First discovered by malware researcher Jakub Kroustek and belonging to the Dharma ransomware family, .good is high-risk ransomware that stealthily infiltrates computers and encrypts most stored files. This ransomware also appends filenames with the ".good" extension (hence its name) during encryption.

For instance, .good renames "sample.jpg" to "sample.jpg.good". Encrypted data immediately becomes unusable. As well as file encryption, .good displays a pop-up window and stores the "RETURN FILES.txt" text file on the desktop.

What is up-date[.]to?

up-date[.]to is a rogue website designed to deliver dubious content and promote various applications. It shares many similarities with dozens of other rogue sites, such as rabsirolcalat.info, gatonsenropha.info, and tinhowsinutha.pro.

Users typically visit up-date[.]to inadvertently - they are redirected by potentially unwanted applications (PUAs), which usually infiltrate computers without permission, and intrusive advertisements delivered by other rogue sites. PUAs cause unwanted redirects, deliver dubious content, and gather personal data.

What is gosearchsafely.com?

gosearchsafely.com is one of many fake search engines promoted through browser hijackers that change browser settings.

In this case, gosearchsafely.com is promoted via the Private Browsing by Safely potentially unwanted application (PUA). This PUA is used to promote another fake search engine, search.privatesearch.online. Most browser hijackers gather information relating to users.

What is "SppExtComObjHook.dll"?

The SppExtComObjHook.dll file is associated with various illegal software activation tools such as KMSPico, AutoKMS, Re-Loader, and KMSAuto.

These tools active Microsoft Windows or Office products without requiring payment. Typically, anti-virus or anti-spyware suites detect the SppExtComObjHook.dll file as a threat when opening one of the aforementioned (or other) activation tools. Using these tools is illegal and they often infect computers with malware.

What is Rectot?

Discovered by Michael Gillespie, Rectot is a malicious program belonging to the Djvu ransomware family. Cyber criminals (the developers) use the program to extort money from people.

When Rectot is installed on a computer, it encrypts stored data and prevents victims from accessing their files unless a ransom is paid. It also renames all files by adding the ".rectot" extension. For example, "1.jpg" becomes "1.jpg.rectot". Instructions about how to purchase a decryption tool can be found in the "_readme.txt" text file.

What is rabsirolcalat[.]info?

rabsirolcalat[.]info is a rogue website that shares similarities with knowwoow.com, tinhowsinutha.pro, feenotifyfriends.info, and dozens of others. It causes unwanted redirects to other rogue websites and delivers dubious content.

Users often visit websites such as rabsirolcalat[.]info inadvertently - they are redirected by potentially unwanted applications (PUAs) or intrusive advertisements displayed on other untrustworthy sites. PUAs are notorious for infiltrating computers without users' consent.

Unwanted redirects are not the only problem caused by unwanted apps - they also deliver intrusive advertisements and gather information.

What is Shipment Tracker?

Shipment Tracker is a deceptive application that supposedly allows users to track their package delivery statuses.

Judging on appearance alone, this app may seem legitimate and useful, however, Shipment Tracker is categorized as a potentially unwanted application (PUA) and a browser hijacker, since it usually infiltrates systems without permission, promotes a fake search engine (search.hshipmenttracker.co), and records various information.

What is HxTsr.exe?

HxTsr.exe (Hidden Executable To Sync Remote Servers) is a legitimate file that can be found in Microsoft Windows Operating Systems. This file/process is part of Microsoft Outlook, a MS Office product, however, its name might be used by cyber criminals to disguise their malicious programs. Therefore, a file with this name could be detected as a threat by virus detection engines.

What is secoh-qad.exe?

secoh-qad.exe is a file associated with KMSPico, a tool that activates Windows Operating Systems and Microsoft Office suites, thereby illegally bypassing software activation free of charge. If this tool is used when installed anti-virus software is enabled, the security software will detect the secoh-qad.exe file as a threat.

This is not the only file that might be detected as a threat when the KMSPico tool is launched. Since this tool is illegal, we advise against using it.

What is gatonsenropha[.]info?

gatonsenropha[.]info is yet another rogue website designed to redirect visitors to other untrustworthy websites and deliver dubious content. It is virtually identical to knowwoow.com, tinhowsinutha.pro, androponhowrow.info, and dozens of other sites.

Many users visit gatonsenropha[.]info inadvertently - they are redirected by potentially unwanted applications (PUAs) or intrusive ads delivered by other rogue sites. Be aware that PUAs typically infiltrate computers without users' permission. As well as causing redirects, they deliver intrusive advertisements and gather data relating to browsing activity.