Virus and Spyware Removal Guides, uninstall instructions

What is thraflabe-rs.ru?

thraflabe-rs.ru is a deceptive website that redirects users to various rogue sites (at time of research, thraflabe-rs.ru/?token=t8v90 redirected users to the traffic-media.co/mghtml/framehtml/c/1/t/603162.html website). Users are redirected to thraflabe-rs.ru by a rogue application called HPRewriter.

Following infiltration, HPRewriter hijacks Internet browsers and stealthily modifies various options. Furthermore, users' Internet browsing activity is continually monitored. Therefore, HPRewriter is classed as a browser hijacker and a potentially unwanted program (PUP).

What is Korean?

Discovered by Michael Gillespie (@demonslay335), Korean is new ransomware-type malware that encrypts files using the AES-256 encryption algorithm. This ransomware appends the names of encrypted files with ".암호화 됨" (for instance, "sample.jpg" is renamed to "sample.jpg..암호화 됨").

Therefore, it is relatively easy to determine which files are encrypted. After successfully encrypting files, this virus displays a ransom-demand message and creates a "ReadMe.txt", which is placed on the desktop.

What is Team XRat?

Team XRat is a new variant of Xorist ransomware. After infiltrating the system, Team XRat encrypts various stored files using RSA-2048 cryptography. During encryption, this ransomware appends file names with ".C0rp0r@c@0Xr@" (for example, "sample.jpg" is renamed to "sample.jpg.C0rp0r@c@0Xr@").

Some newer variants of this ransomware use ._AiraCropEncrypted, .__xratteamLucked or .___xratteamLucked extensions. Therefore, determining which files are encrypted is relatively easy. Following successful encryption, Team XRat displays a ransom-demand message.

What is funnysiting.com?

funnysiting.com is another fake Internet search engine that delivers promises to enhance the Internet browsing experience by generating the most relevant search results.

Initially, this site may seem seem legitimate and useful, however, developers promote funnysiting.com via deceptive software downloaders/installers that hijack web browsers and stealthily modify various options. In addition, funnysiting.com continually tracks users' Internet browsing activity by gathering various user/system data types.

What is mylucky123.com?

Mylucky123.com is a rogue website claiming to be a legitimate Internet search engine. Judging on appearance alone, mylucky123.com may seem very similar to Google, Bing, Yahoo, and other legitimate search engines. Therefore, many users believe that mylucky123.com is legitimate.

In fact, this rogue site is promoted using deceptive software download/installation tools that hijack web browsers and modify various options. Furthermore, mylucky123.com collects various information relating to users' Internet browsing activity.

What is search.searchtp.com?

Tracker Package is a potentially unwanted program developed by SaferBrowser. By delivering fake promises to allow users to track postal deliveries, Tracker Package attempts to give the impression legitimacy. In fact, this rogue app usually infiltrates systems without users' consent.

Furthermore, it stealthily modify Internet browser settings, tracks users' Internet browsing activity, and delivers intrusive online advertisements. Therefore, Tracker Package is categorized as a potentially unwanted program (PUP) and a browser hijacker.

What is Hard Disk Failure Error?

Similar to BSOD Driver Problem, BSOD Error, Enter A Product Key, and a number of other fake errors, "Hard Disk Failure" is a false error message displayed by a rogue website. Victims are redirected to this website by various adware-type applications that infiltrate systems without users' consent.

Research shows that adware is also likely to monitor users' Internet browsing activity and display intrusive online advertisements. Developers often distribute these potentially unwanted programs using a deceptive software marketing method called "bundling".

What is searchthatup.com?

searchthatup.com is a deceptive website claiming to be a legitimate Internet search engine. This rogue site redirects users to bing.com and, therefore, users often believe that it is legitimate. Be aware, however, that this site records various information relating to users' Internet browsing activity.

Furthermore, developers promote searchthatup.com using browser-hijacking software (download/installation tools) that stealthily modify Internet browser settings without users' consent.

What is gogletab.com?

gogletab.com is a dubious website claiming to be Google (a legitimate Internet search engine). The appearance of this website is virtually identical to the original Google and, therefore, users often believe that gogletab.com is legitimate.

In fact, this site is promoted using rogue software installation set-ups. Furthermore, gogletab.com is designed to gather various information regarding Internet browsing activity.

What is PokemonGo?

Cyber criminals have developed a ransomware-type virus called PokemonGo due to the current popularity of this reality game. The executable (.exe) of this ransomware is named "PokemonGo" and the icon contains Pickachu pokemon.

After system infiltration, PokemonGo ransomware encrypts various files (including, for example, .doc, .pdf, .jpeg, .html, .php, etc.) using AES cryptography. During encryption, PokemonGo appends a ".locked" extension to the name of each encrypted file.

Following successful encryption, PokemonGo displays a ransom-demand message (an image with a Pikachu pokemon and the text below) written in Arabic. It also creates a text file named "هام جدا.txt" (also containing a ransom-demand message), placing it on the victim's desktop.