Virus and Spyware Removal Guides, uninstall instructions

What kind of page is se29[.]biz?

While inspecting shady websites, we discovered the se29[.]biz rogue page. It operates by promoting browser notification spam and redirecting visitors to other (likely unreliable/malicious) sites. Most visitors to webpages of this kind enter them through websites that use rogue advertising networks.

What kind of page is news-tulode[.]com?

We discovered news-tulode[.]com while inspecting untrustworthy sites. It is designed to push browser notification spam and redirect visitors to other (likely dubious/malicious) webpages. Most users enter such websites via redirects caused by pages using rogue advertising networks.

What is QuickPDFConverterSearch?

While inspecting dubious download sources, our research team discovered the QuickPDFConverterSearch browser extension. After analyzing it, we learned that it operates as a browser hijacker promoting the quickpdfconvertersearch.com fake search engine.

What kind of page is notadszones[.]com?

Notadszones[.]com is a rogue page designed to push browser notification spam and redirect visitors to different (likely untrustworthy/malicious) sites.

Our research team discovered notadszones[.]com while inspecting shady webpages. Users typically enter such websites inadvertently; most enter them via pages using rogue advertising networks, mistyped URLs, spam notifications, intrusive ads, or installed adware.

What kind of malware is Pipikaki?

While checking various forums, we found a new ransomware called Pipikaki. It encrypts files, modifies filenames, and creates a ransom note. Pipikaki appends the victim's ID and ".@PIPIKAKI" extension to filenames. Its ransom note is a file named "WE CAN RECOVER YOUR DATA.txt".

An example of how Pipikaki renames files: it replaces "1.jpg" with "1.jpg.[8A56562E].@PIPIKAKI", "2.png" with "2.png.[8A56562E].@PIPIKAKI", and so forth.

What is Lucifer Kobs ransomware?

Lucifer Kobs is a piece of malicious software classified as ransomware. We discovered this program while inspecting new malware submissions to VirusTotal, and learned that it is a new variant of the Spora ransomware.

After we executed a sample of this ransomware onto our test machine, it encrypted files and changed their filenames. The titles were appended with a unique ID assigned to the victim, the attackers' email address, and an extension consisting of four random characters. For example, a file originally named "1.jpg" appeared as "1.jpg[ID=4FqqPI-Mail=Lucifer.kobs@mailfence.com].ikwh".

Once the encryption process was completed, ransom notes were created/displayed in a pop-up window ("ReadMe_Now!.hta") and text file ("Read_Me!_.txt"). Based on the message in the document file, it is apparent that the Lucifer Kobs ransomware targets companies/ large entities instead of home users.

What kind of application is BestSportSearches?

After downloading and installing the BestSportSearches application, we learned that it is a browser-hijacking application that makes certain changes in the settings of a web browser. The purpose of this app is to promote the bestsportsearches.com address - a fake search engine. A big part of browser hijackers is promoted and distributed using deceptive methods.

What kind of page is freeadvfit[.]com?

While inspecting untrustworthy websites, we found the freeadvfit[.]com webpage. It is designed to promote browser notification spam and redirect visitors to other (untrustworthy/malicious) sites. Users typically access such webpages through redirects caused by sites using rogue advertising networks.

What kind of website is exotikcontent[.]ru?

Exotikcontent[.]ru is one of the many deceptive websites designed to trick visitors into agreeing to receive notifications. They are rarely visited on purpose. We have discovered exotikcontent[.]ru while examining pages that use rogue advertising networks (pages that redirect to shady websites and display untrustworthy ads).

What is NewVideosSearch?

NewVideosSearch is the name of a browser extension. After analyzing it, we determined that this piece of software works as a browser hijacker. NewVideosSearch makes changes to browser settings in order to promote the newvideosearch.com fake search engine.