Virus and Spyware Removal Guides, uninstall instructions

What kind of page is yourbestlandever[.]com?

Yourbestlandever[.]com is a rogue webpage that we discovered while inspecting untrustworthy websites. This page endorses deceptive content (online scams) and browser notification spam. Furthermore, it can redirect users to other (likely unreliable/dangerous) sites.

Most visitors to yourbestlandever[.]com and pages akin to it – access them through redirects caused by websites that use rogue advertising networks.

What is searchresultsfast.com?

While investigating browser-hijacking software, our research team discovered the searchresultsfast.com fake search engine. Websites of this kind are usually incapable of generating search results, and while searchresultsfast.com is an exception – the results are inaccurate and promote dubious content.

Illegitimate search engines are typically endorsed (through redirects) by browser hijackers. This software makes alterations to browser settings and tends to spy on users' browsing activity. Data tracking is typical for sites like searchresultsfast.com as well.

What kind of page is productlifesoft[.]com?

Our researchers discovered the productlifesoft[.]com rogue page during a routine investigation of suspect websites. It is designed to endorse unreliable/harmful software and spam browser notifications. Additionally, this site may redirect visitors to different (likely dubious/malicious) websites.

Users primarily access webpages like productlifesoft[.]com through redirects caused by sites that use rogue advertising networks, misspelled URLs, spam notifications, intrusive ads, or installed adware.

What kind of page is rdsurvey366[.]top?

Our team examined rdsurvey366[.]top and found that it is one of the websites that displays a deceptive message (uses a clickbait technique) to lure visitors into agreeing to receive notifications. We also learned that there are at least two versions of rdsurvey366[.]top.

What is Screenshotter?

Screenshotter is a piece of malicious software. There are multiple variants of this malware – written in AutoIT, Python, and versions combining JavaScript and IrfanView. Its primary functionality is to take screenshots.

This malware is an integral part of campaigns dubbed by Proofpoint as "Screentime". While components of these attacks have been used by various threat actors with varied goals, evidence suggests that a single well-organized group helms the Screentime campaigns. The attacks targeted a wide variety of companies/organizations in the US and Germany, with no particular sphere of interest.

What kind of malware is Garsomware?

After examining Garsomware, we determined that it is ransomware based on Chaos ransomware. It is designed to prevent victims from accessing files by encrypting them. Also, Garsomware appends its extension (four random characters) to filenames and creates the "Garsomware.txt" file containing instructions on how to pay threat actors for data decryption.

An example of how Garsomware modifies filenames: it renames "1.jpg" to "1.jpg.e9ja", "2.doc" to "2.doc.rs83", and so forth.

What is onlinesearchnow.com?

After testing onlinesearchnow.com, we found that it is an untrustworthy search engine that generates questionable results (including advertisements). Typically, search engines like onlinesearchnow.com are promoted by browser hijackers. These apps promote search engines by changing the settings of web browsers.

What is search2online.com?

Search2online.com is the URL of a fake search engine. Websites of this kind are usually promoted by software under the browser hijacker classification. This software modifies browsers in order to promote (by causing redirects to) sites like search2online.com. It is noteworthy that both illegitimate search engines and browser hijackers usually collect sensitive user data.

What kind of malware is Enigma?

Enigma is an information stealer written in the C# programming language. It is a variation of another stealer known as Stealerium. It is important to note that Enigma is also the name of a legitimate company that offers business intelligence and data services, which has no association with the information stealer.

What is searchthatonline.com?

Our team has found that searchthatonline.com is a search engine that may generate questionable results and display ads. It is common for search engines of this nature to be promoted by browser hijackers, which alter the browser's settings. Users often add such apps to browsers unintentionally.