Virus and Spyware Removal Guides, uninstall instructions

What is PCMax?

PCMax is a deceptive application that, according to developers, helps to optimize the system and increase Internet performance. Judging on appearance alone, PCMax may seem legitimate and useful, however, this app is categorized as a potentially unwanted program (PUP). Furthermore it typically infiltrates systems without permission.

What is Pokki?

Pokki is a rogue application that supposedly enables the classic start menu in Windows 8. This functionality may seem legitimate and useful, however, research shows that this potentially unwanted program (PUP) infiltrates systems without permission and continually records various information.

Furthermore, Pokki is categorized as adware - a form of software that continually feeds users with intrusive advertisements.

What is MOLE66?

First discovered by MalwareHunterTeam, MOLE66 is an updated version of a high-risk ransomware infection called CryptoMix. Immediately after infiltration, MOLE66 encrypts most stored data using RSA-2048 cryptography. During encryption, MOLE66 renames files using the "[32_random_letters_and_digits].MOLE66" pattern.

For example, "sample.jpg" might be renamed to a filename such as "F0E341ACD5BCD456AD21ACD37856EF21.MOLE66". Once files are encrypted, they become unusable and indistinguishable. After successfully encrypting files, MOLE66 generates a text file ("_HELP_INSTRUCTIONS_.TXT") and places a copy in every existing folder.

What is search.searchws2.com?

According to search.searchws2.com, the Weather Service application provides local weather forecasts. At first, this application may seem legitimate and useful, however, Weather Service is categorized as a potentially unwanted program (PUP) and a browser hijacker.

There are three main reasons for these negative associations: 1) stealth installation without permission; 2) promotion of a fake Internet search engine [search.searchws2.com], and; 3) tracking of users' Internet browsing activity.

What is This Build Of Windows 10 Is Corrupted?

"This Build Of Windows 10 Is Corrupted" is another fake error displayed by dubious sites that users often visit inadvertently - they are redirected by intrusive advertisements (delivered by other malicious sites) or potentially unwanted programs (PUPs).

Research shows that many PUPs infiltrate systems without users' consent and, as well as causing redirects, deliver intrusive ads, gather sensitive information, and run unwanted background processes.

What is safesearchmac.com?

safesearchmac.com is a fake Internet search engine identical to macsafesearch.net and home.searchpulse.net. This website claims to enhance the web browsing experience by generating improved results and often tricks users into believing that safesearchmac.com is legitimate and useful.

In fact, developers promote safesearchmac.com using a browser-hijacking app called Safe Search Mac. Another important issue is information tracking - safesearchmac.com and Safe Search Mac record information relating to users' Internet browsing activity.

What kind of scam is "YOUR COMPUTER HAS BEEN BLOCKED"?

The "YOUR COMPUTER HAS BEEN BLOCKED" message states that the computer has been infected with various viruses/malware and that private data (Facebook Login, Credit Card Details, Email Account Login, etc.) has been stolen.

The message encourages users to contact technical support via a telephone number provided. Users are often tricked into believing that this message is legitimate, however, it is a scam. This virus is very similar to the previously-distributed scam, "Your Browser Has Been Blocked".

What is Gedantar?

Discovered by malware security researcher, Karsten Hahn, Gedantar is an updated version of a ransomware-type virus called Unlock92. Once infiltrated, Gedantar encrypts most stored files using RSA-2048 cryptography. During encryption, this malware renames files using the "[filename]_[8-random-characters].[extension]" pattern.

For instance, "sample.jpg" might be renamed to a filename such as "sample_eitn13pg.jpg". Following successful encryption, Gedantar creates a jpg file (with the "[20-random-characters].jpg" filename pattern, e.g., "tvosmnggwbwaycotdmce.jpg") and places a copy in each existing folder.

What is BansomQare Manna?

First discovered by malware security researcher, Bart, BansomQare Manna is a ransomware-type virus that stealthily infiltrates the system and encrypts most stored files. During encryption, BansomQare Manna adds the ".bitcoin" appendix to the name of each compromised file.

For example, "sample.jpg" is renamed to "sample.jpg.bitcoin". After successfully encrypting files, BansomQare Manna opens a pop-up window and creates a text file ("bitcoin2018.txt"), placing a copy in each existing folder.

What is AVCrypt?

Discovered by MalwareHunterTeam, AVCrypt is a ransomware-type virus that stealthily encrypts most stored files and prepends "+" to the name of each encrypted file.

For example, encrypted "sample.jpg" is renamed to "+sample.jpg". Following successful encryption, AVCrypt creates a text file ("+HOW_TO_UNLOCK.txt") and places a copy in each folder containing encrypted files. Note that AVCrypt is designed to corrupt the system and remove installed anti-virus suites.