Virus and Spyware Removal Guides, uninstall instructions

What is search.yourmapsnow.com?

Your Maps Now is a deceptive application identical to My Maps XP, My Coupons XP, My Weather XP, and number of other potentially unwanted programs (PUPs). This application supposedly provides functions for online maps and Internet searches - "Easily search maps and satelite images, and instantly get map driving directions." 

These false claims to deliver 'useful' functionality often trick users into believing that Your Maps Now is a legitimate app. Be aware, however, that this app infiltrates systems without users’ permission. In addition, Your Maps Now modify browser settings, displays intrusive online advertisements, and continually tracks Internet browsing activity.

What is ge0l0gic?

It is possible that ge0l0gic is targeted ransomware, since the ransom message is addressed to a company called Geo Logic Systems Ltd. Despite this, it might also be used to target other parties. This ransomware was discovered by GrujaRS and adds the ".ge0l0gic" extension to each encrypted file.

For example, ge0l0gic renames "1.jpg" to ".1jpg.ge0l0gic". Each encrypted file has an associated ransom message - so the message for a file called "1.jpg" would be "1.jpg.ge0l0gic_readme.txt". Furthermore, once a computer is infected, ge0l0gic starts running a malicious process in Task Manager that is disguised as "Free Audio Converter".

What is Your Package Tracked Now?

Your Package Tracked Now is a browser app that supposedly allows users to track their packages and access popular pages directly from their browsers.

In fact, this app is a browser hijacker, a potentially unwanted application (PUA) that changes browser settings to promote the search.hyourpackagetrackednow.com fake search engine. In addition, PUAs often gather browsing-related data.

What is tinhowsinutha[.]pro?

Similar to fortorsarrabse.info, deloplen.com, checkpost.space, and many others, tinhowsinutha[.]pro is a rogue website that feeds users with dubious content and redirects them to other rogue sites. As with the examples listed, users often visit tinhowsinutha[.]pro inadvertently.

They are redirected by potentially unwanted applications (PUAs) and intrusive ads displayed on other rogue sites. Note that PUAs typically infiltrate computers without users’ permission. In addition to causing redirects, they deliver intrusive advertisements and record data.

What is search.bunnybarny.com?

search.bunnybarny.com is one of many fake search engines that is promoted through a variety of browser hijacking applications/installers. For example, the File Compressor Pro unwanted app.

Note that search.bunnybarny.com is very similar to many other search engines of this type such as search.pogypog.com, search.yadbazelet.com, and searchv.dooryov.com. Browser hijackers that promote these sites change browser settings and collect various information relating to users' browsing activities.

What is Local Weather Radar Now?

Local Weather Radar Now is presented as a legitimate weather forecast application. Judging on appearance alone, this app may seem legitimate and useful, however, Local Weather Radar Now is categorized as a potentially unwanted application (PUA) and a browser hijacker.

This application stealthily infiltrates systems without users’ permission. In addition, Local Weather Radar Now promotes a fake search engine (search.hlocalweatherradarnow.com) and records information relating to browsing habits.

What is File Compressor Pro?

File Compressor Pro developers promote this app as an online tool for zipping (compressing) files, however, one of its distribution methods is the "bundling" method. Developers use this to trick people into downloading and installing various potentially unwanted apps (PUAs). File Compressor Pro is also used to promote bunnybarny.com, a fake search engine.

What is savefrom[.]net?

The savefrom[.]net website is designed to download videos from video-sharing pages such as YouTube. To download a video using this site, users must provide a link to the video, choose a format, and then click the "Download" button.

Note that downloading videos using savefrom[.]net is harmless (will not cause computer infections or other similar problems), however, it is illegal to download videos from YouTube (or other similar websites).

Furthermore, savefrom[.]net uses various advertising networks and thus people who access this site are often redirected to other dubious websites that might cause unwanted downloads, installations, and so on.

What is torlock[.]com?

torlock[.]com is a popular, yet dubious, torrent website. On initial appearance, torlock[.]com may seem legitimate and useful, however, this site asks each user to "enable notifications", which would allow it to display browser notifications and promote other websites.

This functionality is legitimate, and thousands of other legitimate websites (e.g., YouTube, Facebook, etc.) use it, however, dubious websites often use notifications to promote other malicious sites. Furthermore, using torrent sites can lead to various system infections.

What is india2lock?

Discovered by JAMESWT, india2lock is just one of many ransomware-type programs. It encrypts data, changes the victim's wallpaper and creates a ransom message within the "HOW TO DECRYPT FILES.txt" text file. People with computers infected by india2lock cannot access their files unless they pay a ransom (purchase a decryption tool/key).

This ransomware renames all encrypted files by adding the ".Crypted" extension. For example, "1.jpg" becomes "1.jpg.Crypted".