Virus and Spyware Removal Guides, uninstall instructions

What is Helper?

Helper is yet another ransomware-type infection discovered by Jakub Kroustek. As with most ransomware infections, Helper stealthily infiltrates computers and encrypts stored files, thereby rendering them unusable. During encryption, Helper renames each file by appending a random string as the extension.

For example, Helper might rename "sample.jpg" to a filename such as "sample.jpg.OOOKJYHCTVDF". After successful encryption, Helper generates a text file ("YOUR FILES ARE ENCRYPTED.TXT") and stores it on the desktop. This file contains a ransom-demand message.

What is Dotmap?

Dotmap is malicious software categorized as ransomware. It encrypts data and forces victims to pay a ransom (purchase a decryption tool/key). Dotmap belongs to Djvu ransomware family and was discovered by Michael Gillespie. This ransomware changes the names of encrypted files by adding the ".dotmap" extension.

For example, "1.jpg" becomes "1.jpg.dotmap". Instructions on how to decrypt data can be found in the form of a ransom message within a "_readme.txt" file, which is stored in folders that contain encrypted files.

What is Mamba?

Discovered by GrujaRS, Mamba is an updated variant of high-risk ransomware called Phobos. After successful infiltration, Mamba encrypts stored files and appends filenames with the ".mamba" extension plus the victim's unique ID and developer's email address.

For instance, "sample.jpg" might be renamed to a filename such as "sample.jpg.id[1E857D00-1130].[fileb@protonmail.com].mamba". Encrypted files instantly become unusable. Mamba also stores the "info.txt" text file on the desktop and displays a pop-up window ("info.hta" HTML application).

What is PC Regcleaners?

PC Regcleaners (other known variants are named Regcleanerz and Regcleaners) is promoted as a system/computer optimization program that supposedly cleans computers and enables them to start faster.

According to the developers, it includes tools such as a registry cleaner, memory booster, and junk cleaner. In fact, after installation, it runs as a Trojan.Clicker, a tool used to engage in 'click fraud'.

What is Registry Cleaner?

As the name suggests, Registry Cleaner supposedly cleans and fixes the system registry. According to its developers, this program is also capable of boosting memory and cleaning junk files. Registry Cleaner may seem to be a legitimate program, however, it is malicious and a Trojan.Clicker used to perform 'click fraud'.

What is gotwidores[.]info?

gotwidores[.]info is yet another rogue website designed to deliver dubious content and cause redirects to potentially malicious websites. It is virtually identical to deloplen.com, checkpost.space, evengsitolightont[.]info, and dozens of other rogue sites.

Generally, users visit gotwidores[.]info inadvertently - they are redirected by potentially unwanted applications (PUAs) or intrusive ads delivered by other rogue sites. PUAs usually infiltrate computers without users’ permission and, as well as causing redirects, deliver intrusive advertisements and gather information.

What is PC Boost Pro?

PC Boost Pro is promoted as a registry cleaner, memory booster, and junk cleaner. Developers claim that it is designed to make computers faster and cleaner. What they do not mention is that PC Boost Pro is a malicious program known as Trojan.Clicker. This is a tool that cyber criminals use to perform 'click fraud'.

What is "CVE-2019-1663"?

"CVE-2019-1663" is the name of a 'sextortion' scam that is used to blackmail people by threatening to leak humiliating/compromising photos. To prevent this, recipients are encouraged to pay a specific amount in a cryptocurrency. There are many emails of this type online, none of which should be trusted. If received, they should be ignored and deleted.

What is "Microsoft detected malicious virus and blocked your computer"?

"Microsoft detected malicious virus and blocked your computer" is one of many technical support scams designed to trick people into believing that their systems are infected. Scammers use them to extort money from unsuspecting people by encouraging them to call the telephone number provided. These scams appear on various dubious, untrustworthy websites.

People do not generally open them intentionally - often, potentially unwanted apps (PUAs) installed on their systems open these web pages. In addition to unwanted redirects, PUAs usually gather information and serve users with intrusive ads.

What is "Cameras and a mic start recording"?

Scammers use the "Cameras and a mic start recording" spam campaign/scam to trick people into transferring cryptocurrency funds to them. They claim that they have recorded a compromising video of the recipient and threaten to share it with other people unless their demands are met. This spam campaign is a typical sextortion scam that should not be trusted.