Virus and Spyware Removal Guides, uninstall instructions

What kind of malware is ALBASA?

ALBASA is ransomware that encrypts and renames files and generates a ransom note. We have discovered it while examining the malware samples submitted to VirusTotal. ALBASA appends the ".ALBASA" extension to filenames (for example, it renames "1.jpg" to "1.jpg.ALBASA", "2.jpg" to "2.jpg.ALBASA"). Its ransom note is named "RESTORE_FILES_INFO.txt".

What is searcheq.com?

We have discovered searcheq.com while analyzing browser hijackers downloaded from shady websites. We have found at least two browser-hijacking apps that promote searcheq.com - Easy Search and EQSearch. After testing the searcheq.com site, we learned that it is a fake search engine.

What kind of page is utilityextensionnewtab[.]com?

We have discovered the utilityextensionnewtab[.]com page while visiting other shady sites (one of them is orderstartir[.]com). Typically, these pages get opened accidentally. The purpose of utilityextensionnewtab[.]com is to obtain permission to show notifications and promote an app called "Search and New Tab by Yahoo".

What kind of application is AdvancedDisplay?

AdvancedDisplay is an untrustworthy application that functions as adware - it bombards users with annoying/unwanted advertisements. We have discovered this adware while examining deceptive websites. As a rule, such apps get downloaded and installed unknowingly.

What is NavigateIndex?

NavigateIndex is an adware-type application that our research team discovered while inspecting new submissions to VirusTotal. After analyzing this piece of software, we determined that NavigateIndex belongs to the AdLoad malware family.

What kind of malware is Ztcmq?

Our malware researchers have discovered the Ztcmq ransomware while analyzing the samples submitted to VirusTotal. After the examination of Ztcmq, we found that it encrypts files, modifies their filenames (by appending a string of random characters and the ".ztcmq" extension to their names), and creates the "4w8v_HOW_TO_DECRYPT.txt" file as its ransom note.

An example of how Ztcmq renames files: it changes the filename of a file named "1.jpg" to "1.jpg.kM131xz_cARRTN4gTq9Lu8_iIh-9Uw8Kteh7kpKaUqL_k63zeDweD1E0.ztcmq", "file.txt" to "file.txt.kM131xz_cARRTN4gTq9Lu8_iIh-9Uw8Kteh7kpKaUqL_k63zeDweD1E0.ztcmq", and so on.

What is Qd45h ransomware?

During a routine inspection of new malware submissions on VirusTotal, our researcher team found the Qd45h ransomware.

Once launched onto our test system, this malicious program began encrypting files and appending their filenames with a random character string and the ".qd45h" extension. For example, a file originally titled "1.jpg" appeared as "1.jpg.JDVc79PYGA-7kvWDNumpVoPnCfAC6bkrkvwcsRHEpaj_AAAAAAAAAAA0.qd45h".

After the encryption process was completed, Qd45h created a ransom note named "wo5X_HOW_TO_DECRYPT.txt" - on the desktop.

What is Movie Reviews & Search | Movies Tab?

As its name implies, the Movie Reviews & Search | Movies Tab browser extension is endorsed as a tool for easy access to films, information about their reception, trailers, and other related content.

After analyzing this piece of software, our researchers determined that it is a browser hijacker. Movie Reviews & Search | Movies Tab modifies browsers to promote the movieztab.com fake search engine, and it spies on users' browsing activity.

What kind of page is orderstartir[.]com?

Orderstartir[.]com is a deceptive website designed to display a fake CAPTCHA to get permission to show notifications and redirect visitors to other shady websites. Our team has discovered this site while visiting illegal streaming pages, torrent sites, and other websites that use rogue advertising networks.

What is the "QUOTE YOUR BEST PRICE" email?

After inspecting the "QUOTE YOUR BEST PRICE" email, our researchers determined that it is malspam. Scam emails designed to distribute malware are sent through mass-scale spam campaigns (malspam).

The email in question is yet another example of the purchase/product scam model, whereby recipients are tricked into opening a malicious attachment disguised as a product order.