Virus and Spyware Removal Guides, uninstall instructions

What kind of page is worldcoolfeed[.]com?

Worldcoolfeed[.]com is a deceptive website that we have discovered while examining torrent, illegal movie streaming, and similar sites that use questionable advertising networks. We found that the purpose of worldcoolfeed[.]com is to trick visitors into allowing it to show notifications and redirect them to other pages.

What is Gomorrah?

Gomorrah is an information-stealing malware. We obtained a sample from VirusTotal and subsequently analyzed this malicious program. We discovered that it primarily targets account credentials and credit card numbers.

What is Cat4er ransomware?

During a routine inspection of new malware submissions to VirusTotal, our research team found the Cat4er ransomware.

When a sample was launched on our test machine, this malware encrypted files and appended them with the ".Cat4er" extension. For example, a filename like "1.jpg" appeared as "1.jpg.Cat4er" after encryption. Once this process was completed, Cat4er dropped a ransom note - "HOW_FIX_FILES.htm" - onto the desktop.

What kind of address is chillsearch.xyz?

The chillsearch.xyz address (a fake search engine) became known to us after using a couple of fake Adobe Flash Player installers downloaded from deceptive websites. We have found that those installers hijacked a web browser - our browser opened chillsearch.xyz every time we entered a search query into the URL bar.

What is Bar1 New Tab?

Bar1 New Tab is a browser hijacker. After analyzing this piece of software, our researchers determined that it modifies browser settings to promote the barone.live fake search engine. Additionally, Bar1 New Tab spies on users' browsing activity.

What kind of page is kexvideo[.]ru?

The kexvideo[.]ru is an untrustworthy website that our malware researchers have discovered while visiting pages that use questionable advertising networks. We have analyzed kexvideo[.]ru and found that it displays deceptive content to trick visitors into agreeing to receive notifications and redirects to other websites.

What is "FITS email virus"?

"FITS email virus" refers to a malware-proliferating spam campaign. These scam emails supposedly concern payment advice from FITS (Fire International Technical Services LLC). We must emphasize that this spam mail is not associated with any companies or other legitimate entities.

After receiving and analyzing the "FITS" scam email, our researchers determined that its attachment is designed to infect recipients' devices with Agent Tesla malware.

What kind of software is PDFEditor?

We have discovered the PDFEditor application while checking the samples submitted to VirusTotal. Our team has tested PDFEditor and found that it has the qualities of adware - it is an advertising-supported application. Although, it is promoted as a PDF editor - a tool that allows users to edit PDF documents.

What kind of malware is Farattack?

We have discovered the Farattack ransomware while inspecting the samples that have been submitted to VirusTotal. During the analysis, we have found that Farattack has three main qualities: it encrypts files, appends the ".farattack" extension to filenames, and creates the "How_to_recovery.txt" text file (a ransom note).

An example of how Farattack ransomware modifies filenames: it renames "1.jpg" to "1.jpg.farattack", "document.txt" to "document.txt.farattack", and so on.

What kind of malware is Qqqr?

Qqqr is the name of ransomware belonging to a family of ransomware called Djvu. We have discovered this ransomware variant while examining the samples submitted to VirusTotal. After analyzing the Qqqr ransomware, we have found that it encrypts files, appends its extension (".qqqr") to filenames, and generates a text file ("_readme.txt") with a ransom note in it.

An example of how Qqqr ransomware modifies filenames: it renames a file named "image.jpg" to "image.jpg.qqqr", "document.txt.qqqr", and so on.