Virus and Spyware Removal Guides, uninstall instructions

What is LeadingExplorerSearch?

While inspecting new submissions to VirusTotal, our research team discovered the LeadingExplorerSearch application. Our analysis of this app revealed that it is advertising-supported software (adware). It is pertinent to mention that LeadingExplorerSearch belongs to the AdLoad malware family.

What kind of page is getcaptcha[.]top?

Getcaptcha[.]top is among the numerous websites that utilize deceptive messages to deceive visitors into allowing them to display notifications. Also, visitors may be redirected to other untrustworthy websites while browsing getcaptcha[.]top. Our discovery of getcaptcha[.]top occurred during our inspection of websites that employ dubious advertising networks.

What kind of malware is Kmufesd?

After examining Kmufesd, we determined that it is ransomware that belongs to the Snatch family. Our malware researchers discovered Kmufesd while checking malware samples submitted to the VirusTotal page. Kmufesd is ransomware that encrypts files, appends the ".kmufesd" extension to filenames, and creates the "HOW TO RESTORE YOUR FILES.TXT" file.

The text file dropped by Kmufesd is a ransom note. An example of how Kmufesd modifies filenames: it renames "1.jpg" to "1.jpg.kmufesd", "2.png" to "2.png.kmufesd", and so forth.

What kind of application is Movie Searcher?

While testing the Movie Searcher application (browser extension), we noticed that it operates as a browser hijacker. This app hijacks a web browser by changing some of its settings to search-movie.com. The purpose of Movie Searcher is to promote a fake search engine. This extension is promoted on a deceptive page.

What kind of page is reliablepcstrength[.]com?

After examining reliablepcstrength[.]com, we have determined that this website perpetuates the "McAfee - Your PC is infected with 5 viruses!" scam and asks permission to display untrustworthy notifications. It is important to note that none of the messages on this website are genuine. Thus, we recommend ignoring reliablepcstrength[.]com and similar pages.

What is thesearchonline.com?

Thesearchonline.com is the URL of a fake search engine. While most websites of this type cannot provide search results, this site can. However, the results from thesearchonline.com are inaccurate and include irrelevant/deceptive content.

Illegitimate search engines are commonly endorsed (via redirects) by browser hijackers. It is noteworthy that these websites and the software promoting them usually collect sensitive user data.

What is searchingright.com?

Searchingright.com is the address of an illegitimate search engine. In most cases, sites of this kind cannot generate search results. However, searchingright.com is an exception – but its results may be inaccurate and include irrelevant/deceptive content.

Typically, these search engines are promoted by browser hijackers. Additionally, these fake sites and the software pushing them tend to spy on users' browsing activity.

What kind of email is "CREDIT FROM FEDERAL RESERVE BANK"?

Our inspection of the "CREDIT FROM FEDERAL RESERVE BANK" email revealed that it is spam. This phishing letter states that the recipient will receive over ten million US dollars from the World Bank. Personal information must be provided, and a processing fee must be paid – to facilitate this transfer.

It must be emphasized that this spam mail is in no way associated with the legitimate World Bank international financial institution or any other real entities.

The goal of this email is to trick recipients into disclosing sensitive information and sending the scammers money.

What kind of page is prowimoniser[.]com?

During our examination of prowimoniser[.]com, we discovered that its objective is to deceive visitors into consenting to receive notifications and redirect them to other deceptive websites. The site employs misleading content to obtain permission to send notifications. Our team encountered prowimoniser[.]com while inspecting suspicious pages.

What kind of application is TokenCollective?

During the testing phase of the TokenCollective application, our team noticed that it exhibits invasive ads. Consequently, we categorized TokenCollective as adware. Adware is typically promoted and disseminated through dubious means, often leading to unintended downloads and installations by users.