Virus and Spyware Removal Guides, uninstall instructions

What is MR.ROBOT?

Discovered by GrujaRS, MR.ROBOT is a malicious program classified as ransomware. Systems infected with this malware have their files encrypted and users receive ransom demands for decryption tools.

During the encryption process, MR.ROBOT ransomware renames files by appending them with an extension consisting of five random characters. For example, a file such as "1.jpg" would appear as something similar to "1.jpg.4b506" following encryption, and so on for all affected files.

After the encryption process is complete, identical ransom messages are created in a pop-up window and a text file titled "info.txt".

What is Free Driver Maps?

Free Driver Maps browser hijacker promotes freedrivermapstab.com and searchnewfdm.com (addresses of fake search engines) by modifying certain browser settings. This app supposedly provides access to interactive maps, directions, news, weather and email provider websites.

Commonly, apps of this type promote fake search engines and collect browsing-related information. Free Driver Maps and other similar apps are categorized as potentially unwanted applications (PUAs), since people often download and install them inadvertently.

What is Koti?

Koti is malicious software, which is part of the Djvu ransomware family. It is designed to encrypt the files of infected systems in order to make ransom demands. When this ransomware encrypts, all affected files are appended with the ".koti" extension. For example, a file originally named something like "1.jpg" would appear as "1.jpg.koti" after encryption.

Following this process, a text file ("_readme.txt") is created in every compromised folder.

What is ZoNiSoNaL?

ZoNiSoNaL is a part of the Xorist ransomware family. It encrypts files and renames them by appending the ".ZoNiSoNaL" extension.

For example, "1.jpg" becomes "1.jpg.ZoNiSoNaL", "2.jpg" becomes "2.jpg.ZoNiSoNaL", and so on. ZoNiSoNaL drops the "HOW TO DECRYPT FILES.txt" file containing a ransom message in every folder that contains encrypted files, and displays another ransom message in a pop-up window.

What is theappsparty.net?

theappsparty.net is a fake and useless search engine, which is promoted through a potentially unwanted application (PUA), a browser hijacker. Typically, apps of this type promote fake search engine addresses by changing browser settings. Furthermore, browser hijackers gather details relating to users' browsing habits.

They are categorized as PUAs, since people often download and install them inadvertently.

What is Tiger PDF?

Tiger PDF is a browser hijacker designed to promote tigerpdf-search.com (the address of a fake search engine), which displays results generated by another (legitimate) search engine. Browser hijackers promote fake search engines by modifying browser settings. They often collect browsing data as well.

Apps of this type are categorized as potentially unwanted applications (PUAs), since users tend to download and install them inadvertently.

What is My Search Finder?

My Search Finder is a browser hijacker. Following successful infiltration, it makes alterations to browser settings to promote search.mysearchfinder.co (a bogus search engine). My Search Finder also has data tracking capabilities, which are employed to monitor users' browsing activity.

Additionally, due to its dubious proliferation methods, My Search Finder is classified as a Potentially Unwanted Application (PUA).

What is HistorySee?

HistorySee is a browser hijacker supposedly capable of providing daily historical facts. This piece of software modifies browsers to promote history-see.com (a fake search engine). Additionally, HistorySee monitors users' browsing habits. Due to the dubious methods used to proliferate this browser hijacker, it is also classified as a Potentially Unwanted Application (PUA).

What is AnonymoSearch?

AnonymoSearch is a potentially unwanted application (PUA), a browser hijacker which promotes a fake search engine (feed.anonymosearch.com) and the portal.anonymosearch.com address. Like most apps of this type, it promotes the fake search engine by changing browser settings. It also tracks and records various information.

Browser hijackers are classified as PUAs, since people often download them inadvertently.

What is QolkuzNbVcG?

QolkuzNbVcG is a malicious program belonging to the Xorist ransomware family. This malware operates by encrypting data in order to demand payment for decryption. During the encryption process, all affected files are appended with the ".QolkuzNbVcG" extension.

For example, a file originally named something like "1.jpg" would appear as "1.jpg.QolkuzNbVcG" following encryption. After this process is complete, a ransom message is presented in a pop-up window and in a text file ("HOW TO DECRYPT FILES.txt"), which is created in every compromised folder.

The ransom-demand message is incomplete, and therefore it is likely that QolkuzNbVcG is still in development.