Virus and Spyware Removal Guides, uninstall instructions

What is Rakhni?

Rakhni is high-risk trojan/ransomware distributed using spam emails. Users receive an email letter containing a message (in Russian) encouraging them to open an attached .PDF document, which is presented as an "act of reconciliation". This is deceptive - in fact, the attachment is a malicious executable written in the Delphi programming language.

Once opened, this executable downloads and installs Rakhni malware. Research shows that most infected machines are located in Russia - unsurprising, due to the Russian email text and that non Russian-speaking users are likely to delete these emails without opening attachments.

What is search.hplayfreemusic.com?

search.hplayfreemusic.co is a search engine, a browser hijacker also known as Play Free Music. It is installed on your web browser in a form of add-on or extension. It could also be installed as a program on your computer.

Play Free Music is software distributed by a company called Polarity Technologies Ltd., and is not the only software distributed by this company. If you have the Play Free Music browser hijacker installed on your browser, then you will notice that the default search engine now looks different.

The Play Free Music search engine contains two search boxes (one in the top-left corner and one in the middle of the page). It also contains various icons with links, and links to websites such as youtube.com, soundcloud.com, spotify.com, iheartradio.com, pandora.com, espn.com, amazon.com, gmail.com, yahoo.com, twitter.com and instagram.com.

It also shows current local time and weather. It encourages you to visit a National Weather Agency website or read news on 5thavenuenews.com This fake search engine may seem similar to search engines such as search.youreasyemailsh.com, search.thenewssource.co and search.hinstantgamesnow.com - all are distributed by the same company, Polarity Technologies Ltd., and redirect to search.yahoo.com, which is a search engine owned by Yahoo.

You can see that this is a music-related browser hijacker, since the links redirect to pages such as YouTube, SoundCloud, iHeartRadio, Pandora, and Spotify.

What is search.hdesignyoursite.com?

search.hdesignyoursite.co is a fake search engine, a browser hijacker, which is installed on web browsers as an extension, add-on or even as a program on your computer (called Design Your Site). Design Your Site is software distributed by a Cyprus company called Polarity Technologies Ltd.

If you have the Design Your Site extension or add-on installed, you will see that your search engine has two search boxes (one in the middle and one in the top-left corner) and various icons with links to pages such as gmail.com, yahoo.com, amazon.com, pinterest.com, sitebuilder.com, squarespace.com, and networksolution.com.

It also shows the current local weather on the top of the Design Your Site search engine and encourages you to visit the so-called National Weather Agency's website by clicking the "Local Weather" link. This is a browser hijacker that looks very similar to search.youreasyemailsh.com, search.thenewssource.co, search.hinstantgamesnow.com, and other search engines.

These fake search engines are distributed by the same company, the Polarity Technologies Ltd., and all redirect to search.yahoo.com, which is a search engine owned by Yahoo.

What is search.hinstantgamesnow.com?

search.hinstangamesnow.com is another browser hijacker (also known as Instant Games Now), which is installed on the web browser as an add-on, extension or as a program on your Windows computer. search.hinstangamesnow.com (Instant Games Now) is software distributed by Polarity Technologies Ltd.

This browser hijacker is a fake search engine that has two search boxes and icons with links to various websites such as amazon.com, gmail.com, yahoo.com, terrarcade.com, addictinggames.com, roblox.com, bigfishgames.com, and links to games such as Minecraft and Skincraft.

It also shows the current local weather and allows you to access the so-called National Weather Agency or to read news on a website called 5thavenuenews.com The search engine is very similar to search.thenewssource.co or search.youreasyemailsh.com and is distributed by the same company, Polarity Technologies Ltd.

When you enter an enquiry into a search box and press the search button, you are redirected to search.yahoo.com, which is a search engine owned by Yahoo.

What is search.youreasyemailsh.com?

search.youreasyemailsh.com is a browser hijacker installed on web browsers as an extension, program, or add-on called Your Easy Emails. Your Easy Emails is software distributed under an exclusive license by Polarity Technologies Ltd.

This search engine has two search boxes and various icons with links to websites such as amazon.com, gmail.com, yahoo.com, facebook.com, youtube.com, macys.com, twitter.com, ancestry.com, trivago.com, and hotmail.com It allows you to access Google Maps, 5thavenuenews.com, and nationalweatheragency.org, and also displays local weather and the current local time.

The search engine is very similar to search.hfastestsearches.com and is distributed by the same company (Polarity Technologies Ltd.) When you enter an enquiry into a search box and press the search button, you are redirected to the search.yahoo.com website, which is a search engine owned by Yahoo.

What kind of malware is BitPaymer?

BitPaymer (also known as "wp_encrypt") is a ransomware-type virus discovered by malware security researcher, S!Ri. Immediately after infiltration, BitPaymer encrypts most stored files and appends filenames with the ".locked" extension (i.e., "sample.jpg" is renamed to "sample.jpg.locked").

Updated variants of this ransomware use ".LOCK" extensions for encrypted files. Compromised data immediately becomes unusable. Furthermore, BitPaymer creates a text file for each encrypted file. For example (a text file named "sample.jpg.readme_txt" would be created for "sample.jpg").

What is search.findthatsearch.com?

search.findthatsearch.com is a browser hijacker that claims to be an advanced, legitimate search engine. If installed, the browser homepage and default search engine options are assigned to search.findthatsearch.com It also differs from other popular search engines such as Google, Bing, and Yahoo, since it has no logo, just a search bar and search button.

This search engine may therefore seem legitimate or even better than other popular search engines. In fact, it might not even display search results due to multiple redirects. 

What is search.thenewssource.co?

search.thenewssource.co is a search engine that arrives at your web browser as an add-on or extension, an extra component called My Email XP. Email XP is software distributed by Polarity Technologies LTD - a browser hijacker that sets the home page to search.thenewssource.co and allows you to access email (Gmail or Yahoo) with one-click from the home and new tab pages.

The search engine has two search boxes and various icons with links to websites such as amazon.com, terraarcade.com, addictinggames.com, roblox.com, and bigfishgames.com. You can also access the nationalweatheragency.org website by clicking the Local Weather button (you can see current local weather beside it).

Additionally, it has a menu whereby you can find links to Skincraft and Minecraft. When entering an enquiry into a search box and pressing the search button, you are redirected to the search.yahoo.com website (a search engine owned by Yahoo).

What is search-mate.com?

Developers present search-mate.com as a quality search engine that supposedly enhances the browsing experience by generating improved results. Judging on appearance alone, search-mate.com may seem similar to Google, Bing, Yahoo, and other legitimate Internet search engines.

Therefore, many users believe that search-mate.com is also legitimate and useful. In fact, developers promote this site using browser-hijacking downloaders/installers that modify browser options without permission. Furthermore, search-mate.com gathers information relating to browsing activity.

What is search.bittsearch.com?

search.bittsearch.com is a fake web search engine that supposedly enhances the browsing experience by generating improved results and providing quick access to various popular websites.

Judging on appearance alone, search.bittsearch.com may seem legitimate and useful, however, this site is promoted using a browser-hijacking application called bittsearch. Furthermore, search.bittsearch.com and bittsearch gather information relating to web browsing habits.