Virus and Spyware Removal Guides, uninstall instructions

What is SavingsCool?

SavingsCool is an updated version of MySafeSavings adware. By claiming to save time and money while helping online, SavingsCool attempts to give the impression of legitimacy. Be aware, however, that this app often infiltrates systems without users' consent.

Furthermore, it displays intrusive online advertisements and gathers various information relating to Internet browsing activity. For these reasons, SavingsCool is categorized as a potentially unwanted program (PUP) and adware.

What is easyopenweb.com?

easyopenweb.com is a deceptive website claiming to generate improved search results. Judging on appearance alone, this site barely differs from Google, Bing, Yahoo, and other similar legitimate search engines. Therefore, some users believe that easyopenweb.com is also legitimate.

In fact, developers promote this site by employing rogue software download/installation set-ups designed to hijack web browsers and stealthily modify various options. Furthermore, easyopenweb.com gathers various data relating to users' Internet browsing activity.

What is *.aesir?

*.aesir is a new variant of Locky. Apart from minor updates, it is also virtually identical to .odin and *.thor. Developers spread this ransomware via spam emails (malicious attachments). Following infiltration, *.aesir encrypts stored files (targeting 456 file types in total) using asymmetric cryptography.

Encrypted files are renamed using the "[8_random_characters]-[4_random_characters]-[4_random_characters]-[4_random_characters]-[12_random_characters].aesir" pattern. For instance, an encrypted file could be renamed to "F76FAA31-3A55-O591-3DDO-1A32C2HN051.aesir".

Once the files are encrypted, ransomware creates three files ("-INSTRUCTION.bmp", "_1-INSTRUCTION.html", and "-INSTRUCTION.html"), placing them on the desktop and changing the desktop wallpaper.

What is webbooks.site?

According to the developers, webbooks.site is a legitimate Internet search engine that generates improved search results and provides quick access to dozens of popular websites (Wikipedia, PayPal, YouTube, Twitter, etc.).

On initial inspection, webbooks.site may seem legitimate and useful, however, this site gathers various information relating to Internet browsing activity. Furthermore, developers promote this rogue search engine via deceptive software download/installation set-ups.

What is searchgoog.ru?

searchgoog.ru is a fake Internet search engine identical to gotosearch.ru. Developers claim that searchgoog.ru significantly enhances the Internet browsing activity by generating the most relevant search results. Judging on appearance alone, searchgoog.ru may seem similar to legitimate search engines such as Bing, Yahoo, and Google.

Therefore, users often believe that searchgoog.ru is also legitimate. Be aware, however, that developers promote searchgoog.ru via deceptive software installers designed to modify Internet browser options without consent. Furthermore, this fake search engine continually records various user/system data types.

What is secury-surf.com?

According to the developers, secury-surf.com is a legitimate Internet search engine that enhances the web browsing experience by generating improved search results.

These claims often trick users into believing that secury-surf.com is legitimate, however, developers promote this rogue website by employing deceptive software download/installation set-ups that hijack Internet browsers and stealthily modify various options. Furthermore, secury-surf.com continually monitors users' Internet browsing activity.

What is CHIP?

CHIP is ransomware-type malware distributed using Rig Exploit Kit. Following infiltration, CHIP encrypts various files and appends filenames with the ".CHIP" or ".DALE" extensions. For example, "sample.jpg" is renamed to "sample.jpg.CHIP". Following successful encryption, CHIP creates a text file ("CHIP_FILES.txt" or "DALE_FILES.TXT") and places it in each folder containing encrypted files.

What is ShellLocker?

ShellLocker is a ransomware-type virus developed using .NET framework. It was first discovered by Jakub Kroustek and is virtually identical to another ransomware virus called Exotic.

Following infiltration, this virus encrypts stored data (video, audio, etc.) and renames encrypted files using the "[random_characters].L0cked" pattern (e.g., "sample.jpg" might be renamed to "gd&=AA0fgoi.L0cked"). Following successful encryption, ShellLocker opens a pop-up window containing ransom-demand message.

What is "Microsoft Security Essentials Toll Free"?

"Microsoft Security Essentials Toll Free" is malware that locks computer screens and displays a fake error message. The screen lock imitates a fatal system error (so-called "Blue Screen of Death"). The error message states that the system has been shutdown to prevent further damage. A pop-up is then displayed claiming that a virus has been detected.

What is iwebs.site?

iwebs.site is presented as a legitimate Internet search engine that generates improved search results and provides quick access to dozens of popular websites.

Many users believe that iwebs.site is legitimate and useful, however, this site is promoted via deceptive software download/installation set-ups that hijack web browsers and modify various options without users' consent. Furthermore, iwebs.site continually gathers various information relating to users' Internet browsing activity.