Virus and Spyware Removal Guides, uninstall instructions

What is Hollycrypt?

First discovered by Michael Gillespie, Hollycrypt is malware based on open-source ransomware called "Hidden Tear". Following infiltration, Hollycrypt encrypts files and renames them by appending the ".Hollycrypt" extension. For example, "sample.jpg" becomes "sample.jpg.Hollycrypt". Hollycrypt then creates a text file ("read_this_shit.txt") and places it on the desktop.

What is sparpilot.com?

sparpilot.com is a rogue website claiming to be an Internet search engine that generates improved search results and provides quick access to various other popular websites. Judging on appearance alone, sparpilot.com may seem legitimate, since it barely differs from Google, Bing, Yahoo, and other similar legitimate search engines.

Be aware, however, that developers promote sparpilot.com via rogue software download and/or installation set-ups designed to stealthily modify web browser settings without users' consent. Furthermore, sparpilot.com records various information relating to web browsing activity.

What is "Microsoft.Inc Warning!"?

"Microsoft.Inc Warning!" is a fake error message displayed by a malicious website. It states that malicious data has been transferred to the victim's computer and that the system is infected with a trojan virus. It is also states that the System Registry may have been corrupted and exploited.

Rebooting or shutting down the computer will supposedly lead to an operating system crash. To solve this problem, victims are encouraged to call "Microsoft Technical Support" via a telephone number provided (1-844-507-3556).

What is gohomego.com?

gohomego.com is a fake Internet search engine similar to searchfunmoods.com. According to the developers, this site significantly enhances the Internet browsing experience by generating improved search results.

In fact, developers promote gohomego.com via rogue software installers that hijack web browsers and modify various settings. Furthermore, gohomego.com continually monitors users' Internet browsing activity.

What is myprivatesearch.com?

Myprivatesearch.com is a fake Internet search engine that supposedly enhances the Internet browsing experience by generating improved search results. Judging on appearance alone, myprivatesearch.com barely differs from Google, Yahoo, Bing, and other similar search engines.

Therefore, many users believe that myprivatesearch.com is also legitimate. In fact, it is promoted via rogue software downloaders and installers that stealthily modify web browser settings. In addition, myprivatesearch.com continually records information relating to users' Internet browsing activity.

What is Trezaa?

Trezaa is adware-type application that falsely claims to enhance the web browsing experience by providing notifications of special deals/discounts on various online stores, enabling comparison shopping, and enabling other similar functionality. These features may seem legitimate, however, this application is categorized as a potentially unwanted program (PUP).

After successful infiltration on systems without users’ consent, Trezaa collects information relating to web browsing activity and generates intrusive online advertisements.

What is search.fulltabsearch.com?

Developers present search.fulltabsearch.com as a legitimate Internet search engine that generates improved search results, provides quick access to various popular websites, selection of different themes, and provides other similar features.

Many users believe that search.fulltabsearch.com is legitimate and useful, however, developers promote it using rogue software download/installation set-ups that hijack web browsers and modify various options without consent. Furthermore, search.fullsearchtab.com continually tracks Internet browsing activity.

What is ZeroCrypt?

ZeroCrypt is a ransomware-type virus that encrypts various files using asymmetric cryptography. This malware was devised to be a task in the ZeroNight 2016 hacker competition. To complete the task, participants were challenged to crack the encryption. In fact, research shows that criminals often spread this malware only to generate revenue.

During encryption, ZeroCrypt appends the ".zn2016" extension to the name of each compromised file (for example, "sample.jpg" becomes "sample.jpg.zn2016"). After encrypting the files, ZeroCrypt generates a text file ("ZEROCRYPT_RECOVER_INFO.txt"), which contains a ransom-demand message, and places it on the desktop.

What is ISHTAR?

ISHTAR is a ransomware-type virus that encrypts files using asymmetric cryptography. This malware is designed to prepend the "ISHTAR-" string to the name of each encrypted file. For instance, "sample.jpg" becomes "ISHTAR-sample.jpg". Once files are successfully encrypted, ISHTAR creates a "README-ISHTAR.txt" file and places it on the desktop.

What is Versiegelt?

Versiegelt is a new variant of .Fun (Jigsaw) ransomware-type malware. Following infiltration, Versiegelt encrypts files using AES cryptography.

During encryption, this ransomware appends the ".versiegelt" extension to the name of each file. For example, "sample.jpg" becomes "sample.jpg.versiegelt". Following successful encryption, Versiegelt opens a pop-up window with a ransom-demand message.