Virus and Spyware Removal Guides, uninstall instructions

What is Zpps ransomware?

Zpps is a ransomware-type program that our researchers found while inspecting new malware submissions to VirusTotal. This malicious program is part of the Djvu ransomware family.

After launching a sample of Zpps ransomware on our test machine, it encrypted files and appended their filenames with the ".zpps" extension. For example, a file initially titled "1.jpg" appeared as "1.jpg.zpps", "2.png" as "2.png.zpps", and so forth. Once the encryption process was completed, a ransom note named "_readme.txt" was created.

What kind of malware is Qlln?

Qlln is the name of ransomware belonging to the ransomware family called Djvu. We have discovered this variant during our routine check for malware samples submitted to VirusTotal. It was found that Qlln encrypts files and appends ".qlln" extension to filenames, and provides a ransom note (creates the "_readme.txt" file).

An example of how Qlln renames files: it changes "1.jpg" to "1.jpg.qlln", "2.png" to "2.png.qlln", "3.exe" to "3.exe.qlln", and so forth.

What kind of malware is Nnuz?

Nnuz is ransomware that encrypts files and appends the ".nnuz" extension to filenames. Also, it creates the "_readme.txt" file that contains instructions on how to contact the attackers and other information. Our malware researchers have discovered Nnuz while checking samples submitted to the VirusTotal page. They found that Nnuz is part of the Djvu family.

An example of how Nnuz ransomware modifies filenames: it renames "1.jpg" to "1.jpg.nnuz", "2.png" to "2.png.nnuz", and so forth.

What kind of application is Web Saver?

We discovered the Web Saver application on a shady website offering to install it before continuing to the page. After installing this app, we learned that it functions as adware - it displays annoying advertisements. The download page for Web Saver states that this app removes error pages and provides useful information.

What is VastVista?

VastVista is a rogue app that our researchers found while inspecting new submissions to VirusTotal. Once we installed this application on our test machine, we learned that VastVista operates as adware and belongs to the AdLoad malware family.

What is browser extension is "text info"?

While inspecting questionable download webpages, our research team discovered the text info browser extension. Our analysis of this piece of software revealed that it operates as adware.

What kind of scam is "McAfee - Your iPhone is infected with 5 viruses!"?

It is a scam that uses a scare tactic to trick visitors into purchasing a McAfee Total Protection subscription. The McAfee company does not use websites like this one to promote its products. Thus, this site must be ignored. Our team has discovered this scam page while inspecting pages that use rogue advertising networks.

What is Keep Secure Search?

Our researchers found the Keep Secure Search browser extension while inspecting deceptive download webpages. After analyzing this piece of software, we determined that it is a browser hijacker promoting the keepsecuresearch.com fake search engine.

What kind of application is Tap togo?

We have discovered the Tap togo application while inspecting various deceptive websites. After downloading the app, we found that it functions as a browser hijacker: it changes certain settings to promote togosearching.com - a fake search engine.

What is ERMAC 2.0?

ERMAC 2.0 is the name of an Android banking Trojan targeting Polish users. We have discovered it on a hacker forum. Its developer sells it for $5000 per month. ERMAC 2.0 masquerades as a legitimate Bolt Food application. This malware steals credentials for financial and cryptocurrency applications.