Virus and Spyware Removal Guides, uninstall instructions

What is Files Fixer ransomware?

Files Fixer is a malicious program, which is part of the Xorist ransomware family. Systems infected with this malware experience data encryption and users receive ransom demands for decryption.

During the encryption process, all affected files are appended with the "....FIXME-DAMAGEDFILES-NEED-TO-CONTACT-THE-EMAIL- URGENTLY-OR-YOUR-FILES-WILL-BE-PERMANENTLY-DELETED" extension.

For example, a file originally named "1.jpg" would appear as "1.jpg....FIXME-DAMAGEDFILES-NEED-TO-CONTACT-THE-EMAIL- URGENTLY-OR-YOUR-FILES-WILL-BE-PERMANENTLY-DELETED" following encryption. After this process is complete, ransom messages within "HOW TO DECRYPT FILES.txt files are dropped into compromised folders.

What is BBGT?

This ransomware belongs to the Matrix ransomware family. BBGT encrypts and renames victims' files, and creates the "BBGT_INFO.rtf" file (ransom message) in each folder that contains encrypted files. BBGT renames files by replacing filenames with the bobgant82@criptext.com email address, a string of random characters, and appending ".BBGT" as the file extension.

For example, "1.jpg" is renamed to "[BobGant82@criptext.com].S9Mhz4kS-uWkG6aV4.BBGT", "2.jpg" to "[BobGant82@criptext.com].D8Njk5l9-gEhF8bC5.BBGT", and so on.

What is HerculesLookup?

HerculesLookup is a rogue application categorized as adware, which also has browser hijacker traits. It operates by delivering intrusive advertisement campaigns and making changes to browser settings to promote fake search engines.

In addition, most adware-type apps and browser hijackers have data tracking capabilities, which are used to collect browsing-related information. Due to the dubious techniques employed to distribute HerculesLookup, it is classified as a Potentially Unwanted Application (PUA).

What is Hacker zasifroval zaplat?

Hacker zasifroval zaplat belongs to the Xorist ransomware family. It encrypts files, changes the victim's desktop wallpaper, displays a pop-up window (which looks like a system error notification) and creates the "HOW TO DECRYPT FILES.txt" text file in all folders that contain encrypted files.

The text file, desktop wallpaper and pop-up window contain instructions about how to pay the ransom and contact the ransomware developers. Hacker zasifroval zaplat renames encrypted files by appending ".Hacker zasifroval zaplat.crypt" to filenames.

For example, "1.jpg" is renamed to "1.jpg.Hacker zasifroval zaplat.crypt", "2.jpg" to "2.jpg.Hacker zasifroval zaplat.crypt", and so on.

What is NeedSearch?

NeedSearch is an adware-type application that possesses browser hijacker traits. Following successful infiltration, it runs intrusive advertisement campaigns and makes modifications to browser settings to promote fake search engines. Additionally, most adware programs and browser hijackers monitor users' browsing activity.

Due to the dubious methods used to proliferate NeedSearch, it is also classified as a Potentially Unwanted Application (PUA). One of the dubious techniques employed to proliferate this app is distribution via fake Adobe Flash Player updates.

Furthermore, as well as PUAs, bogus software updaters/installers are used to spread malware (e.g. Trojans, ransomware, etc.).

What is AnalyzerFile?

AnalyzerFile has three purposes: to serve advertisements, promote a fake search engine address, and collect sensitive information. This app functions as adware and a browser hijacker. Typically, users download and install apps like AnalyzerFile unintentionally and, for this reason, they are classified as potentially unwanted applications (PUAs).

What is WebsyncSearch?

WebsyncSearch serves advertisements and modifies browser settings to promote a fake search engine. In this way, it functions as adware and a browser hijacker. Note that WebsyncSearch is also likely to collect browsing data and other information.

People do not often download and install these apps intentionally and, for this reason, WebsyncSearch is categorized as a potentially unwanted application (PUA). This particular app is distributed via a fake installer, which is disguised as an installer for Adobe Flash Player.

What is IncognitoSearchPro?

The IncognitoSearchPro browser hijacker modifies browser settings to force people to visit incognitosearchpro.com and use this fake search engine. It also reads browsing data. Frequently, users download and install apps such as IncognitoSearchPro inadvertently and, therefore, they are categorized as potentially unwanted applications (PUAs).

What is the "Error code # MS-6F0EXFE" scam?

"Error code # MS-6F0EXFE" is a technical support scam, targeting Dutch users. It is run on various deceptive websites. This scheme is disguised as a security warning issued by Microsoft, claiming that users' computers have been blocked due to multiple system infections.

The "Error code # MS-6F0EXFE" scam is in no way associated with the genuine Microsoft Corporation. Furthermore, no web page can detect threats/issues present on visitors' devices.

The purpose of these tech support scams is to trick users into calling the provided fake helplines and then abuse users' trust for monetary gain. Most users access these deceptive sites unintentionally, typically through mistyped URLs, redirects caused by intrusive advertisements or by unwanted applications.

These apps do not require explicit permission to be installed onto systems, and hence users may be unaware of their presence.

What is "Error # WINDOWS-PORN-91?"

Like many other technical support scam websites, this one attempts to trick visitors into believing that, unless they call the provided number and solve the problem, their files will be damaged and personal information will be stolen, etc.

Usually, scammers behind these pages attempt to trick unsuspecting users into paying for unnecessary services and software, or even providing remote access to their computers. These websites should never be trusted.

Note that users do not often visit these sites intentionally - in most cases, they are opened via clicked deceptive ads, other dubious web pages, or by installed unwanted applications.