Virus and Spyware Removal Guides, uninstall instructions

What kind of page is posttrendingblog[.]com?

Posttrendingblog[.]com is one of the many websites designed to trick visitors into allowing them to show notifications. Like most pages of this type, posttrendingblog[.]com displays deceptive contents. It also can redirect visitors to other websites of this kind. We have discovered posttrendingblog[.]com while visiting other pages that use rogue advertising networks.

What is ZipSome?

ZipSome is an adware-type application that we discovered during a routine inspection of new VirusTotal detections. We learned that this app runs intrusive advertisement campaigns (i.e., display) ads. Furthermore, we determined that ZipSome belongs to the AdLoad malware family.

What kind of application is TopConverterSearch?

We have discovered the TopConverterSearch application while inspecting various shady websites. After downloading and installing it, we found that it is a browser hijacker designed to promote topconvertersearch.com (a fake search engine). TopConverterSearch hijacks a web browser by modifying its settings.

What is kind of email is "SECRETO PROFESIONAL Y CONFIDENCIAL"?

Our inspection of the "SECRETO PROFESIONAL Y CONFIDENCIAL" email revealed that it is spam used to proliferate malware. This letter is in Spanish and claims to contain highly confidential information in the attachment (although it does not specify further).

This email is designed to trick recipients into opening the attached file - thereby triggering GuLoader malicious program's download/installation.

What kind of malware is Hachiman?

Hachiman is screen-locking ransomware that locks the screen (operates as a screen locker) and displays a ransom note explaining how to unlock the screen. Hachiman was discovered by Karsten Hahn. It is worth mentioning that Hachiman does not encrypt any files.

What is ProcessorProgression?

ProcessorProgression is an application that our research team found while looking through new submissions on VirusTotal. Following our inspection of this app, we determined that it operates as advertising-supported software (adware) and belongs to the AdLoad malware family.

What kind of application is TheADSBlockSearch?

TheADSBlockSearch is a browser hijacker that promotes theadsblocksearch.com - a fake search engine. This application hijacks a web browser by changing its certain settings. Typically, apps of this type are promoted (and distributed) using shady methods. Thus, users download and install them inadvertently.

What kind of page is placebonusextra[.]com?

Placebonusextra[.]com is a rogue webpage that our researchers discovered while inspecting questionable sites. This page is designed to promote deceptive material, push browser notification spam, and redirect visitors to other (likely untrustworthy/malicious) websites.

Most users enter webpages like placebonusextra[.]com through redirects caused by sites using rogue advertising networks.

What is HDPDFConverterSearch?

After analyzing the HDPDFConverterSearch browser extension, we determined that it operates as a browser hijacker. This piece of software modifies browser settings to promote the hdpdfconvertersearch.com fake search engine.

What is Gzgzqc ransomware?

Discovered during a routine inspection of new malware submissions to VirusTotal, Gzgzqc is a ransomware-type program. It is designed to encrypt data and demand ransoms for the decryption.

We determined that Gzgzqc belongs to the Snatch ransomware family. After being launched onto our test system, this program began encrypting files and appended their filenames with a ".gzgzqc" extension. For example, a file initially named "1.jpg" appeared as "1.jpg.gzgzqc", "2.png" as "2.png.gzgzqc", and so on.

Once the encryption process was completed, a ransom-demanding message - "HOW TO RESTORE YOUR FILES.TXT" - was created. Based on the text presented in this note, it is evident that Gzgzqc targets companies rather than home users.