Virus and Spyware Removal Guides, uninstall instructions

What kind of application is Cool Search?

Cool Search is an application that hijacks a web browser to promote the cool-search.com address, a fake search engine. It does that by changing certain settings. Typically, users download and install apps of this type unknowingly. We have discovered Cool Search while inspecting deceptive websites.

What is LockData ransomware?

LockData is a malicious program based on Chaos ransomware. We found this program while inspecting new malware submissions to VirusTotal.

After being launched onto our test machine, LockData began encrypting files and appending their filenames with an extension consisting of four random characters. For example, a file originally titled "1.jpg" appeared as "1.jpg.khya", "2.png" as "2.png.lqjx", and so on.

Once the encryption process was completed, a ransom note - "read_it.txt" - was created. Additionally, this ransomware changed the desktop wallpaper.

What is the "Chrome is infected with Trojan:SLocker" pop-up?

We discovered the "Chrome is infected with Trojan:SLocker" scam while inspecting deceptive websites. This scheme claims that users' devices are infected. Typically, scams of this kind are designed to promote untrustworthy, fraudulent, and even malicious software.

What is "BSCPad $BUSD" giveaway scam?

We have discovered a new Binance USD (BUSD) giveaway scam while inspecting shady advertisements and websites. The purpose of this scam website is to trick visitors into believing that they can obtain Binance USD by connecting their cryptocurrency wallets via this page. This scam must be ignored.

What kind of page is soksicme[.]com?

While inspecting untrustworthy websites, our research team found the soksicme[.]com rogue page. It operates by promoting browser notification spam and redirecting visitors to other (likely dubious/malicious) sites. Users typically enter soksicme[.]com and similar websites via redirects caused by pages using rogue advertising networks.

What kind of page is spotofdating[.]top?

While inspecting questionable sites, our research team discovered spotofdating[.]top, and through it - they also found spot-ofdating[.]top. These rogue webpages are designed to host dubious content, promote browser notification spam, and redirect visitors to other (likely untrustworthy/malicious) websites.

Most users enter such pages via redirects caused by sites that employ rogue advertising networks.

What kind of application is HotComplete?

We have discovered the HotComplete application while examining untrustworthy websites. After downloading and installing the app, we found that it generates annoying/intrusive advertisements. For this reason, we have classified HotComplete as an advertising-supported application.

What kind of page is prizepagoda[.]com?

Prizepagoda[.]com is a rogue webpage we discovered while inspecting untrustworthy websites. It operates by hosting deceptive content, pushing browser notification spam, and redirecting visitors to other (likely unreliable/malicious) sites. Most users enter pages like prizepagoda[.]com through redirects caused by websites using rogue advertising networks.

What kind of page is sandgerl[.]com?

Sandgerl[.]com is a deceptive website running a pop-up scam. It displays a fake system notification to trick visitors into believing that their devices are compromised (hacked). Our team has discovered sandgerl[.]com while inspecting other pages that use rogue advertising networks (sites that display shady ads and redirect to dubious pages).

What is Kekware ransomware?

Kekware is a piece of malicious software classified as ransomware. It is designed to encrypt data and make ransom demands for the decryption.

We obtained a sample of Kekware from VirusTotal and launched it onto our test machine. This ransomware encrypted files and renamed them following this pattern - "[random_string].[original_extension][random_string].cyn". For example, a file initially titled "1.jpg" appeared as "7462.jpg7088.cyn". Afterward, a ransom note - "YcynNote.txt" was dropped onto the desktop.