Virus and Spyware Removal Guides, uninstall instructions

What kind of page displays the "You need to update your browser to view the content" message?

We have discovered this deceptive page while examining other pages that use questionable advertising networks. The purpose of this site is to trick visitors into downloading and executing a file that is supposed to update the Chrome browser. Our team has downloaded the file and learned that it is flagged on VirusTotal as malicious.

What is Quick Tag?

Quick Tag is a rogue browser extension, which our research team has determined to be a browser hijacker. This piece of dubious software modifies browsers to promote the quicknewtab.com fake search engine.

What kind of website is bulletspeed-updates[.]com?

Our team has examined the bulletspeed-updates[.]com page and found that its purpose is to trick visitors into agreeing to receive notifications that promote untrustworthy websites. We have discovered bulletspeed-updates[.]com while visiting pages that use rogue advertising networks.

What is ResponseIntellect?

We discovered ResponseIntellect when a Combo Cleaner user reported the presence of suspicious programs on their device. ResponseIntellect is a rogue application, which our researchers have classified as adware. We also determined that it belongs to the AdLoad malware family.

Following installation onto our test machine, this app ran intrusive advertisement campaigns (displayed various ads). While ResponseIntellect did not exhibit any browser hijacker qualities on the test system, our experience with AdLoad adware suggests that it may have such abilities.

What kind of application is Speed Dial?

We have tested the Speed Dial application and found that this app is a browser hijacker designed to promote addonsearch.net (a fake search engine) by changing the web browser's settings. We have discovered Speed Dial while inspecting shady websites (we have downloaded it from a questionable site).

What kind of malware is Makop (Phobos)?

Our malware researchers have discovered a new Phobos ransomware variant while analyzing samples on VirusTotal. While testing this variant, we found that it appends the ".makop" extension (and the victim's ID and back23@vpn.tg email address) to filenames.

There is another ransomware called Makop. It seems that the attackers behind Phobos ransomware use the ".makop" extension to confuse their victims. An example of how this ransomware renames files: it changes "1.jpg" to "1.jpg.id[9ECFA84E-3009].[back23@vpn.tg].makop", "2.jpg" to "2.jpg.id[9ECFA84E-3009].[back23@vpn.tg].makop". It generates two ransom notes: "info.txt" and "info.hta".

What kind of software is Adless Browsing?

We have discovered the Adless Browsing extension on a deceptive website, suggesting that it may be necessary to install a free extension to continue browsing the page. After installing and analyzing Adless Browsing, we have found that it generates advertisements (it functions as adware).

What kind of page is onlinevideoconverter[.]pro?

Onlinevideoconverter[.]pro is a page offering to download videos from YouTube. Our team has tested this site and found that it uses rogue advertising networks - it opens questionable/potentially malicious pages. Another issue with onlinevideoconverter[.]pro is that downloading videos from YouTube is illegal.

What is HopStrem?

While making a routine inspection of rogue websites, our researchers discovered a deceptive webpage promoting the HopStrem browser extension. It promises to improve users' browsing experience by removing pop-ups and other ads. After installing HopStrem onto our test machine, we determined that this piece of software operates as adware.

What kind of page is xervoo[.]net?

Our researchers discovered xervoo[.]net while researching sites using rogue advertising networks. This page loads questionable content, promotes browser notification spam, and redirects visitors to various unreliable and malicious websites.