Virus and Spyware Removal Guides, uninstall instructions

What is myweb.house?

Identical to searchthisonline.com, atozsearch-usa.com, and gosearchitnow.com, myweb.house is a fake Internet search engine falsely claiming to enhance the web browsing experience by generating improved search results.

These claims often trick users into believing that myweb.house is legitimate and useful, however, developers promote this rogue site using deceptive software download/installation set-ups that hijack web browsers and stealthily modify various options. In addition, myweb.house continually gathers information relating to Internet browsing activity.

What is recoverhelp@protonmail.ch?

Recoverhelp@protonmail.ch (first discovered by security researcher @kafeine) is a new variant of Fantom - a high-risk ransomware-type virus designed to stealthily infiltrate systems and encrypt files using an asymmetric encryption algorithm. During encryption, recoverhelp@protonmail.ch displays a fake Windows Update screen.

In addition, recoverhelp@protonmail.ch renames encrypted files with a series of random characters and appends the ".locked4" extension. For example, "sample.jpg" might be renamed to "L90g33Agk1fdgoi4gs=214.locked4". Following successful encryption, recoverhelp@protonmail.ch opens a pop-up window containing a ransom-demand message.

What is search4tops.com?

search4tops.com is a deceptive website claiming to be an improved Internet search engine that supposedly generates the most relevant search results. The appearance of this site barely differs from Google, Bing, Yahoo, and other legitimate search engines.

Therefore, users are often tricked into believing that search4tops.com is also legitimate. Be aware, however, that developers promote this site using deceptive software download/installation set-ups that hijack web browsers and modify various options without users' consent. Furthermore, search4tops.com continually monitors Internet browsing activity.

What is Crypton?

Crypton is a ransomware-type virus which encrypts files and appends filenames with the "_crypt" extension. For example, "sample.jpg" is renamed to "sample_crypt.jpg". Once the files are encrypted, Crypton opens a pop-up window and creates a text file ("readme_encrypted.txt"), placing it on the desktop. Both contain an identical ransom-demand messages.

What is "Notice of Imposition of Fine"?

"Notice of Imposition of Fine" is ransomware that locks computer screens and accuses victims of violating cyber laws. To avoid punishment, victims must supposedly pay a fine. Be aware, however, this is a scam - cyber criminals merely attempt to trick victims into paying for nothing.

What kind of malware is Luck?

Luck is file-encrypting ransomware. Following infiltration, Luck employs asymmetric cryptography (RSA-2048) to encrypt various files stored on the system. During encryption, Luck appends file names with the ".[user_id]_luck" extension (for instance, "sample.jpg" might be renamed to "sample.jpg.9DFG78O1_luck").

Following successful encryption, this ransomware opens a pop-up window and creates a text file ("@WARNING_FILES_ARE_ENCRYPTED.[victim's_id].txt"), placing it on the desktop.

What is Angela Merkel?

Similar to Donald Trump ransomware, Angela Merkel is a ransomware-type virus that encrypts various files and appends file names with the ".angelamerkel" extension. For instance, "sample.jpg" is renamed to "sample.jpg.angelamerkel". Following successful encryption, this ransomware displays a pop-up window containing a ransom-demand message.

This malware is named after the Chancellor of Germany - Angela Merkel, whose photo is displayed within the ransomware pop-up screen.

Angela Merkel (the person) is not related to this virus in any way. Furthermore, the Angela Merkel's source code is virtually identical to Exotic's and, thus, there is a high probability that both of these viruses are developed by the same cyber criminals.

What is gotosearch.ru?

According to the developers, gotosearch.ru is a legitimate Internet search engine that generates improved search results and, therefore, enhances users' Internet browsing experience. Judging on appearance alone, gotosearch.ru barely differs from Google, Yahoo, Bing, and other similar search engines.

Therefore, many users believe that gotosearch.ru is also legitimate. In fact, developers promote this site by employing deceptive software downloaders/installers that hijack web browsers and stealthily modify various options. Furthermore, this rogue site continually tracks users' Internet browsing activity.

What is MyMemory?

MyMemory is a deceptive application that supposedly provides event reminders. Initially, this functionality might appear legitimate and useful, however, MyMemory often infiltrates systems without permission.

Furthermore, it records information relating to users' Internet browsing activity and displays various intrusive online advertisements. For these reasons, MyMemory is categorized as adware and a potentially unwanted program (PUP).

What is Webbora?

Webbora is a rogue application that infiltrates the system during installation of other software. Following infiltration, this app generates various intrusive online advertisements and continually records information relating to users' Internet browsing activity. For these reasons, Webbora is categorized as a potentially unwanted program (PUP) and adware.