Virus and Spyware Removal Guides, uninstall instructions

What is spicystart.com?

spicystart.com is a fake Internet search engine that falsely claims to enhance users' Internet browsing experience by generating improved results. Initially, this site may seem legitimate and useful, however, spicystart.com is promoted using a rogue browser-hijacking extension called SpicySEARCH.

Furthermore, spicystart.com (and SpicySEARCH) continually tracks browsing activity by recording various sensitive data.

What is hp.myway.com?

Developed by Mindspark Interactive Network (a.k.a. IAC Applications), CouponXplorer is a deceptive application that supposedly grants access to various printable shopping coupons.

Initially, CouponXplorer may seem legitimate and useful, however, this potentially unwanted program (PUP) typically infiltrates systems without permission. Furthermore, it is classed as a browser hijacker - a form of software that modifies web browser options without users’ permission.

What is chromesearch.net?

Identical to chromesearch.today and chromesearch.club, chromesearch.net is a fake Internet search engine that falsely claims to enhance the web browsing experience by generating improved results.

Judging on appearance alone, chromesearch.net may seem legitimate and useful, however, criminals promote chromesearch.net by employing rogue downloaders/installers designed to modify browser settings without users' consent. Furthermore, this deceptive website continually records sensitive data.

What is STOP?

Discovered by malware security researcher, Michael Gillespie, STOP is a ransomware-type virus that stealthily infiltrates the system and encrypts stored data using RSA-1024 cryptography. In doing so, this malware appends filenames with the ".STOP" extension (e.g., "sample.jpg" is renamed to "sample.jpg.STOP").

Once files are encrypted, STOP creates a "!!!YourDataRestore!!!.txt" file, placing it on the desktop. Other variants of this ransomware use ".promorad", ".promock", ".promok", ".promoz", ".promos", ".PAUSA" and ".CONTACTUS" extensions for encrypted files.

What is catstart.com?

Cat Start is a rogue program that falsely claims to allow users to customize their homepage designs. On initial inspection, Cat Start may seem legitimate and useful, however, this program is categorized as a browser hijacker and a potentially unwanted program (PUP).

There are three main reasons for these negative associations: 1) stealth installation without users' consent; 2) modification of web browser options, and; 3) information tracking.

What is Tastylock?

First discovered by malware security researcher, Michael Gillespie, Tastylock is a new variant of high-risk ransomware called CryptoMix. Once infiltrated, Tastylock encrypts most stored data and renames encrypted files using the "[32_random_letters_and_digits].tastylock" pattern.

For example, "sample.jpg" might be renamed to a filename such as "0B53467149CA2EA59789CA9F4CE70D65.tastylock". From this point, files become unusable and indistinguishable. Following successful encryption, Tastylock generates a text file ("_HELP_INSTRUCTION.TXT") and places a copy in every existing folder.

What is newtab.review?

Identical to newtab.today, newtab.review is a fake Internet search engine that falsely claims to enhance users' browsing experience by generating improved results and providing quick access to various popular websites.

On initial inspection, newtab.review may appear legitimate and useful, however, criminals promote this site using rogue downloaders/installers that modify web browser options without permission. Furthermore, newtab.review continually records various information (mostly relating to Internet browsing habits).

What is Dangerous?

Discovered by Michael Gillespie, Dangerous is a ransomware-type virus that stealthily infiltrates the system and encrypts most stored data.

During encryption, Dangerous appends filenames with the ".wtf" extension. For example, "sample.jpg" is renamed to "sample.jpg.wtf". From this point, files become unusable. Following successful encryption, Dangerous places a copy of the "HOWTODECRYPTFILES.html" file in all existing folders.

What is GenoCheats?

First discovered by MalwareHunterTeam, GenoCheats is a ransomware-type virus based on Hidden Tear. 

At time of research, GenoCheats was distributed as a 'crack' for Adobe Photoshop and Minecraft. Immediately after infiltration, GenoCheats encrypts most stored data using AES cryptography and appends filenames with the ".encrypted" extension (e.g., "sample.jpg" is renamed to "sample.jpg.encrypted").

From this point, files become unusable. Once files are encrypted, GenoCheats changes the desktop wallpaper and creates a "READ_IT.txt" file, placing it on the desktop.

What is 3dshape-tab.com?

3D Shape is a deceptive application that falsely claims to provide unique homepage designs. Judging on appearance alone, 3D Shape may seem legitimate and useful, however, this app typically infiltrates systems without permission.

Furthermore, it modifies web browser options and records various sensitive data. For these reasons, 3D Shape is categorized as a potentially unwanted program (PUP) and a browser hijacker.