Virus and Spyware Removal Guides, uninstall instructions

What kind of malware is CryptBIT?

CryptBIT is ransomware that encrypts files, appends the ".cryptbit" extension to filenames, changes the desktop wallpaper, and creates the "CryptBIT-restore-files.txt" file. Our malware researchers have discovered it while analyzing the samples submitted to VirusTotal.

An example of how CryptBIT renames files: it renames "1.jpg" to "1.jpg.cryptbit", "2.png" to "2.png.cryptbit", and so forth. The text file that CryptBIT ransomware creates contains a ransom note.

What is "Geek Squad" email scam?

After examining the email, we found that it is disguised as a letter from Geek Squad, a subsidiary of Best Buy (a consumer electronics corporation). The purpose of this email is to trick recipients into calling the provided number (contacting scammers). It must be ignored. Geek Squad has nothing to do with this letter.

What is Keep It Smart?

Our research team found the Keep It Smart browser extension while inspecting dubious download sites. Our analysis of this piece of software revealed that it is a browser hijacker promoting the keepitsmart.today fake search engine.

What kind of application is Little-Light?

Little-Light is a program (a browser extension) we found while analyzing deceptive pages. It is advertised as an app that can display any page in dark mode. After downloading and installing the app, we discovered that it generates advertisements. Thus, we concluded that Little-Light is an advertising-supported application.

What is TeamBot?

TeamBot is the name of a malicious program that operates as a dropper. Malware of this type is designed to cause chain infections, i.e., download/install additional malicious programs/components. TeamBot has been observed dropping various information-stealing programs into compromised systems.

Check Point researchers have analyzed targeted attacks that involved TeamBot being used against individuals connected to several embassies and governmental financial bodies in Europe.

What kind of website is computeradshub[.]com?

Computeradshub[.]com is a website designed to trick visitors into agreeing to receive its notifications. Also, it can redirect visitors to other (similar) pages. Our team has discovered computeradshub[.]com while analyzing pages that use rogue advertising networks.

What kind of application is AdvancedControl?

Our team has discovered an application named AdvancedControl while inspecting a deceptive page offering to update the Adobe Flash Player. After installing and examining AdvancedControl, we found that this app operates as adware - it displays unwanted/intrusive advertisements.

What is Fast PDF Reader?

Fast PDF Reader is a rogue browser extension that our researchers discovered while inspecting deceptive download webpages. This piece of software is promoted as a free file reader capable of opening PDF, DOC, XLS, and PPT formats. After analyzing Fast PDF Reader, we determined that it is adware.

What is "BlockAll - block ads"?

While inspecting deceptive websites, our researchers discovered the "BlockAll - block ads" browser extension. Its promotional material endorses this extension as an ad-blocking tool (adblocker). After analyzing "BlockAll - block ads", we determined that it operates as advertising-supported software (adware) instead.

What kind of page is onlineportalsite[.]com?

Onlineportalsite[.]com is a deceptive website that runs the "McAfee - Your PC is infected with 5 viruses!" scam. Also, it asks for permission to show notifications. Typically, websites like onlineportalsite[.]com are promoted using questionable methods. Our team has discovered this page while inspecting other pages that use rogue advertising networks.