Virus and Spyware Removal Guides, uninstall instructions

What is qikc.xyz?

qikc.xyz is the address of a fake search engine that is opened through another dubious address (searchgg.xyz). Like most fake search engines, qikc.xyz is promoted through a browser hijacker. Two known apps that promote this address are called APP and CERX, which are related to another potentially unwanted application (PUA) called QIP.

These apps are classified as PUAs, since people do not generally download or install them intentionally. Once installed, however, browser hijackers change browser settings and record browsing data.

What is Fast Flight Tracker?

As its name suggests, the Fast Flight Tracker app allows flight tracking of aircraft, however, this software modifies browser settings and records browsing data.

Applications that operate in this manner are called browser hijackers. Since people usually do not download or install apps such as Fast Flight Tracker intentionally, they are also known as potentially unwanted applications (PUAs). Additionally, Fast Flight Tracker is installed with another PUA called Hide My Searches.

What is CStealer?

Discovered by MalwareHunterTeam and further researched by James, CStealer is malicious software classified as a trojan. This malware is designed to steal passwords stored in Google Chrome browsers. Trojan infections are high-risk and can lead to a number of significant issues.

What kind of malware is Dexphot?

Dexphot is the name of a malicious program that infects systems with a cryptocurrency miner. It is capable of reinstalling a miner if an installed antivirus suite attempts to remove it. In summary, cyber criminals use resources of infected systems to mine cryptocurrency, which helps them to generate revenue.

If there is any reason to believe that your computer is infected with Dexphot (or another cryptominer), remove it from the system immediately.

What is My Login Helper?

My Login Helper is yet another rogue application that claims to allow users to access their emails. Its appearance suggests that My Login Helper is a legitimate and useful application, however, it is categorized as a potentially unwanted application (PUA) and a browser hijacker.

The main reasons for these negative associations are installation without users' consent, promotion of a fake search engine, and tracking of browsing activity.

What is CILLA?

CILLA is malicious software belonging to the GlobeImposter ransomware family. It operates by encrypting data and demanding ransom payments for decryption. During this process, all compromised files are renamed with the ".CILLA" extension. For example, a filename such as "1.jpg" becomes "1.jpg.CILLA".

After this process is finished, CILLA creates an HTML file named "how_to_back_files.html" and stores it in each affected folder.

What is WinRARER?

Discovered by GrujaRS, WinRARER is malicious software that is classified as ransomware. This ransomware stores files in an .ace archive file named "YourFilesHere-0penWithWinrar.ace" and places it in the "C:\YOUR-locked-FILES\" directory. This file is password protected.

To obtain the password, victims are encouraged to pay a ransom to the cyber criminals who designed WinRARER. Note that WinRARER also creates "RecoverYourFiles.htm", "RecoverYourFiles.rtf" and "RecoverYourFiles.bmp" files (ransom messages). It uses the last one to change the victim's desktop wallpaper.

What is KesLan?

Discovered by GrujaRS, KesLan is a malicious program categorized as ransomware. It is designed to encrypt data and demand a ransom payment for decryption (i.e., payment for decryption tools/software). There are several variants of this ransomware. During encryption, KesLan appends files with the ".TR" extension, and so a file like "1.jpg" appears as "1.jpg.TR".

A different variant of this malware renames files with the ".TMTEAM" extension (e.g. "1.jpg.TMTEAM"). There are several other possible extensions: ".MMTeam", ".Sifrelendi" and ".TRSomware". Actions the ransomware takes following encryption depends on its version.

One creates a text file called "Dosyalarını Kurtarmak İstiyorsan Oku!!!.txt" (".TR" variant), whilst another creates "@Lütfen Beni Oku!@.txt" and changes the desktop wallpaper to "@TMTeam@.png" (".TMTEAM" variant). These text files (and the wallpaper) are ransom messages in Turkish.

What is vnse52.xyz?

vnse52.xyz is a fake search engine and promoted through a number of browser hijackers. One example is called APP. Browser hijackers are potentially unwanted applications (PUAs) that most people download and install inadvertently.

In most cases, PUAs change browser settings and record browsing data, however, research shows that APP does not make these changes. Regardless, apps of this type should never be used. Furthermore, APP is related to another PUA called QIP.

What is NEMTY 2.2 REVENGE?

Discovered by GrujaRS, NEMTY 2.2 REVENGE is an updated variant of NEMTY REVENGE 2.0 ransomware. This malware encrypts data and demands ransom payments for decryption. During this process, all files are appended with an extension consisting of ".NEMTY_" and a unique ID, generated individually for each victim (".NEMTY_victim's ID").

For example, a filename such as "1.jpg" might appear as something similar to "1.jpg.NEMTY_JFZ9S5C", and so on for all of compromised files. Once this process is finished, NEMTY 2.2 REVENGE stores a text file on the desktop called "NEMTY_JFZ9S5C-DECRYPT.txt" (the character string is the unique ID, and therefore differs from victim to victim).