Virus and Spyware Removal Guides, uninstall instructions

What is Bitrep?

Bitrep (also known as Trojan: Win32/Bitrep.A) is a trojan-type infection that infiltrates the system and performs various malicious tasks. Note that trojans of this type infiltrate computers stealthily, without users' consent. Cyber criminals often proliferate them using other trojans (chain infections) and malicious websites.

The presence of Bitrep might cause a number of issues. However, it is very important to note that anti-virus suites may detect this threat even though its a false positive. For instance, Windows Defender has been detecting legitimate Chromium browser builds as Bitrep trojan.

False positive detections typically occur due to inaccurate entries in malware databases, which lead to detection of legitimate files/data as viruses.

What is Registry Mechanic?

The Registry Mechanic program supposedly allows computers to run faster and also cleans them. According to the developers, it can improve computer performance by removing junk files, fixing and cleaning the registry, and optimizing browsers. In fact, this is a malicious program known as Trojan.Clicker, a tool used for 'click fraud'. Registry Mechanic is simply a name used to disguise the real purpose of this program.

What is Microsoft Cleaner?

Microsoft Cleaner is promoted as a program that cleans junk files, boosts memory, cleans and fixes the registry, optimizes browsers, and so on. Developers present it as a legitimate system optimization tool, however, it also operates as a Trojan.Clicker, a malicious program used to perform 'click fraud'. This application has nothing to do with the Microsoft company.

What is DDOS?

Discovered by Jakub Kroustek, DDOS is yet another ransomware infection from the Dharma family. DDOS is designed to stealthily infiltrate the system and encrypt most stored files. During encryption, DDOS renames each file by appending the ".DDOS" extension plus the victim's unique ID and developer's email address.

For example, "1.jpg" might be renamed to a filename such as "1.jpg.id-1E857D00.[decripted@cock.li].DDOS". As with other ransomware from the Dharma family, DDOS opens a pop-up window and stores a text file ("RETURN FILES.txt") on the desktop.

What is search.hbible-verses.app?

Bible Verses is promoted as a useful app that provides verses from the Bible, however, it is actually a potentially unwanted application (PUA) that operates as a browser hijacker. It promotes search.hbible-verses.app, a dubious (fake) search engine by making changes to browser settings.

It also collects information relating to users' browsing activity. Do not trust or use this search engine or any apps of this type.

What is PLUT?

The PLUT program was discovered by Jakub Kroustek and belongs to the Dharma ransomware family. This software is used to encrypt data and block access to it until a ransom is paid. Ransomware victims are forced to purchase a decryption tool/key. Furthermore, PLUT adds the ".PLUT" extension to every encrypted file.

For example, "1.jpg" might be renamed to a filename such as "1.jpg.id-1E857D00.[adolfhackler@tutanota.com].PLUT" (it adds the developer's email address and victim's ID). A ransom message can be found within a file called "RETURN FILES.txt". PLUT also displays a message in a pop-up window.

What is Jack?

Jack is high-risk ransomware that belongs to a family of ransomware infections called Dharma. This malware was first discovered by cyber security researcher, Jakub Kroustek. After successful infiltration, Jack encrypts most stored data and appends filenames with the ".jack" extension plus the victim's unique ID and developer's email address.

Therefore, "sample.jpg" might be renamed to a filename such as "sample.jpg.id-1E857D00.[lockhelp@qq.com].jack". In addition to encrypting data, Jack stores the "RETURN FILES.txt" text file on the desktop and opens a pop-up window.

What is search.privatesearch.online?

The search.privatesearch.online website operates as a search engine, however developers promote it using a browser hijacker called Private Browsing by Safely.

Browser hijackers are categorized as potentially unwanted applications (PUAs). The search engines that they promote are generally useless and should not be trusted. Private Browsing by Safely promotes search.privatesearch.online by changing browser settings and, as with most apps of this type, also collects browsing-related data.

What kind of malware is Wesker Encrypter?

Wesker Encrypter is malicious software (ransomware) that prevents victims from accessing their files by encoding them with strong encryption.

Therefore, victims cannot access files unless a cryptocurrency ransom is paid. Unlike most programs of this type, Wesker Encrypter does not rename any encrypted files. It simply creates a ransom message in the "!!!INSTRUCTION_RNSMW!!!.txt" text file, which contains instructions about how to recover files.

What is Ads By Traffic Junky?

Traffic Junky is a legitimate advertising network that is used by web developers who aim to monetize various websites. In many cases, however, these networks are used by adware developers for malicious purposes and to inject dubious ads into legitimate pages.

If a browser regularly displays ads delivered by Traffic Junky, it is possible that adware-type apps are installed. These display intrusive, often deceptive ads and gather various user-system information.