Virus and Spyware Removal Guides, uninstall instructions

What is page-ups.com?

page-ups.com is a common fake search engine that is promoted as supposedly useful and of value. It operates in the same way as other engines of this type. Some examples are internet-start.net, blpsearch.com, and funkystreams.com. Developers promote page-ups.com via rogue download/installation setups designed to modify browser settings.

What is search.heasyspeedtestapp.com?

Developers promote the Easy Speed Test App application as an internet performance testing tool that supposedly allows users to check internet connection speeds directly from their browsers. Unfortunately, it is also a potentially unwanted application (PUA), a browser hijacker.

Like most apps of this type, Easy Speed Test App promotes a fake search engine, search.heasyperformancetestapp.com, modifies browser settings, and gathers user-information.

What kind of malware is Win32/Malagent?

Win32/Malagent is a malicious program that is classified as a Trojan. Trojans are programs that steal personal details and confidential information, control computers remotely, proliferate other computer infections, and so on. Since Win32/Malagent is one of these rogue programs, it might cause serious problems and should, therefore, be uninstalled/removed immediately.

What is Recry1?

Discovered by Michael Gillespie, Recry1 is high-risk ransomware designed to stealthily infiltrate computers and compromise (encrypt) stored files. Additionally, Recry1 appends filenames with the ".recry1" extension (e.g., "sample.jpg" is renamed to "sample.jpg.recry1").

Encrypted data immediately becomes unusable. After successful encryption, Recry1 creates a text file called "decryption_help.txt" and places a copy in every existing folder.

What is Berost?

Berost's developers use this ransomware to encrypt victims' data and block access to it until ransoms are paid. This malicious program belongs to the Djvu ransomware family. It places a ransom message (within the "_readme.txt" text file) in all folders that contain encrypted files. Encrypted files are also renamed.

Berost adds the ".berost" extension to each filename. For example, "1.jpg" becomes "1.jpg.berost".

What is searchnewworld.com?

searchnewworld.com is a dubious website, a fake search engine that opens bing.com. Note that searchnewworld.com is opened by goto-searchitnow.global.ssl.fastly.net, which in turn, is opened by a number of unwanted applications/malware, such as Fake Calculator.

Unlike browser hijackers, Fake Calculator does not change browser settings, however, people who have this app installed on their systems are forced to visit searchnewworld.com (by opening goto-searchitnow.global.ssl.fastly.net) each time they attempt to search the web. This app is related to another unwanted app called MacSecurityPlus.

What is "apple.com-mac-booster[.]live"?

apple.com-mac-booster[.]live is a deceptive website that is designed to promote the CleanupMy-Mac application. It is deceptive, since it displays a fake virus alert message stating that the visitor's computer is infected (this is false). It encourages visitors to remove viruses using the aforementioned application.

Typically, websites of this type are opened by potentially unwanted apps (PUAs) installed on browsers. As well as redirects to deceptive web pages, most PUAs deliver ads and gather data.

What is "Fake Calculator"?

Related to MacSecurityPlus, Fake Calculator is malicious application that claims to be the genuine MacOS calculator.

This app does not change browser settings, however, as long as it is installed, it redirects people who attempt to surf the web using their browsers to bing[.]com, goto-searchitnow, and under-cover[.]info. It is impossible to avoid being redirected to these search engines unless this fake calculator is uninstalled.

What is Win32/Zpevdo?

Win32/Zpevdo is high-risk trojan designed to modify Windows Firewall settings. This malware typically infiltrates systems when another trojan is installed (a result of "chain infections") or when users visit malicious websites. The presence of Win32/Zpevdo trojan makes the system more vulnerable to other infections.

What is "Xerox Color Workstation Email Virus"?

"Xerox Color Workstation Email Virus" is the name of a spam campaign, designed by cyber criminals to proliferate a malicious program, a keystroke logger called Hawkeye. 

The main purpose of the email issued by this campaign is to trick people into opening the attached file, which infects computers with the aforementioned malware. We strongly recommend that you ignore this email and leave the attachment unopened.