Virus and Spyware Removal Guides, uninstall instructions

What is "Smart Mac Cleaner"?

The Smart Mac Cleaner app is promoted as being capable of cleaning Mac computers, fixing various issues, and improving performance.

I.e. an optimization-oriented application. In fact, this app is categorized as potentially unwanted app (PUA), since developers promote it via the "bundling" method. Therefore, there is a high probability that users install it unintentionally together with their chosen software.

What is "Super Mac Cleaner"?

Super Mac Cleaner (also knows as Super-MacCleanerX, SuperMac Cleaner, Super Mac-Cleaner, Super-Mac Cleaner and SuperMacCleaner) is promoted as a system optimization app for Mac computers. Developers claim that this software scans systems for various issues and then fixes them.

Although presented as a useful and legitimate application, Super Mac Cleaner is categorized as a potentially unwanted app (PUA). People install these apps unintentionally - they are tricked by PUA promotions that employ the "bundling" method.

What is Air?

Air is high-risk ransomware discovered by malware security researcher, Jakub Kroustek. It is a new variant of ransomware called Dharma. Air is designed to encrypt most stored files and, in doing so, adds the ".air" extension together with the user's unique ID and developers' email address.

E.g., "sample.jpg" might be renamed to something like "sample.jpg.jpg.id-1E857D00.[satco@tutanota.com].air". Furthermore, Air opens a pop-up window and creates a text file ("FILES ENCRYPTED.txt"), placing it on the desktop.

What is Crypted000007?

Crypted000007 is a ransomware-type virus which belongs to the Troldesh family. Like most viruses of this type, it is designed to encrypt files and make them unusable until a ransom is paid. This particular virus renames files so that they comprise a line of characters and digits and adds the ".crypted000007" extension to each.

For example, after encryption, the file "1.jpg" might have an appearance similar to this example: "hmv8IGQE5oYCLEd2IS3wZQ==.135DB21A6CE65DAEFE26.crypted000007".

Furthermore, Crypted000007 creates ten ransom-demand messages (with identical content) called "README1.txt", "README2.txt" ... "README10.txt" and places them on the desktop. This virus also changes the desktop wallpaper.

What is Qwex?

Qwex is high-risk ransomware discovered by Jakub Kroustek. This virus is a new variant of another ransomware called Dharma. Once infiltrated, Qwex encrypts most stored files and appends filenames with the ".qwex" extension together with the cyber criminal's email address and victim's personal ID.

For instance, "sample.jpg" might be renamed to something like "sample.jpg.id-1E857D00.[backdata@qq.com].qwex". As well as encrypting data, Qwex opens a pop-up window and creates a text file ("FILES ENCRYPTED.txt"), both containing ransom-demand messages.

What is Anatova?

Anatova was discovered by Valthek and is categorized as ransomware-type malicious program. Anatova is different from other infections of this type, since it does not add an extension to the names of encrypted files and leaves their icons unchanged.

This program simply makes files unusable (after encryption, files cannot be opened) and creates a ransom-demand message within the "ANATOVA.TXT" text file. The name of the ransom message can differ depending on the version of Anatova ransomware.

What is search.getmybestyear.com?

search.getmybestyear.com is categorized as a fake search engine, however, developers promote it as legitimate and useful. Generally, developers of these search engines offer an enhanced browsing experience (more accurate results, faster searches, and so on), however, they use rogue downloaders/installers to promote the site (in this case, search.getmybestyear.com).

The downloaders/installers usually modify browser settings. Furthermore, when used, search.getmybestyear.com collects browsing related information. Examples of other similar fake search engines include search.byomlapp.com, search.kimosachi.com, and search.getvideomonkey.com.

What is feed.easy-pdf.com?

feed.easy-pdf.com is a fake search engine that (like many) is promoted using a browser hijacker - in this case, an app called Easy PDF.

This app is categorized as a potentially unwanted application (PUA) that modifies affected browser settings. Additionally, it records browsing-related information and possibly other details. Note that most people install PUAs unintentionally.

What is mobnootiffy.com?

Virtually similar or identical to supervid.pro, news-io.com, newsforyou.pro, and many others, mobnootiffy.com is a rogue website that redirects visitors to other potentially malicious, untrustworthy sites or displays dubious content. In most cases, users arrive at this website unintentionally, since they are redirected to it by potentially unwanted applications (PUAs).

Typically, PUAs are stealthily installed and go on to cause redirects, deliver intrusive ads, and collect information.

What is lameterthenhep.info?

lameterthenhep.info is another rogue website designed to deliver dubious content and cause unwanted redirects. It is virtually identical to dozens of other rogue sites, such as news-io.com, dartsearch.net, and nsandreskethep.club.

Most visitors arrive at lameterthenhep.info inadvertently - they are redirected by potentially unwanted applications (PUAs) and intrusive ads displayed on other dubious sites. Research shows that PUAs typically infiltrate computers without users’ permission. In addition to causing redirects, they record user-system information and deliver intrusive ads.