Virus and Spyware Removal Guides, uninstall instructions

What kind of website is raymarine[.]top?

We have discovered raymarine[.]top after receiving spam with the website URL in the email. Once we opened raymarine[.]top, it displayed a deceptive message suggesting that it is necessary to agree to receive notifications to download/stream a video.

What is Duty-Search?

Duty-Search is a rogue browser extension, which our researchers have determined to be a browser hijacker. On our test system, it modified browser settings to promote the duty-search.xyz fake search engine.

What is Dark Viewer?

Dark Viewer is a rogue browser extension, one of the many we have noticed promising to create a dark mode for websites that do not have this feature. Our researchers have observed this software delivering various advertisements; in other words, Dark Viewer exhibits behavior typical for adware.

What kind of malware is Vfgj?

Vfgj is the name of ransomware belonging to a ransomware family called Djvu. Our team has discovered this ransomware variant while inspecting ransomware samples recently submitted to VirusTotal. While testing the sample, we identified that Vfgj appends the ".vfgj" extension to filenames and creates the "_readme.txt" file as a ransom note.

What is InfinityHardware?

When searching the newest submissions to VirusTotal, our researchers discovered InfinityHardware - another adware-type application from the AdLoad malware family.

When installed onto our testing system, it operated by running intrusive advertisement campaigns. However, from our extensive research into the previously mentioned malware family, we can state that InfinityHardware may exhibit browser hijacker qualities (though it did not during our analysis). This also extends to any data tracking abilities the app may possess.

What kind of malware is Fhkf?

We have analyzed ransomware samples on VirusTotal and discovered a new Djvu ransomware variant called Fhkf. While testing this variant, we found out that it encrypts files (and modifies filenames) and creates the "_readme.txt" file containing a ransom note. It also appends the ".fhkf" extension to filenames, for example, it renames "1.jpg" to "1.jpg.fhkf", "document.txt", to "document.txt.fhkf", etc.

What is 2wfv1 ransomware?

During a routine search into the newest malware samples uploaded to VirusTotal, we discovered and afterwards analyzed the 2wfv1 ransomware. This malicious program is designed to encrypt data (lock files) and demand payment for the decryption.

Following successful installation on our test machine, we observed this ransomware appending encrypted files with a random character string and the ".2wfv1" extension. For example, a file initially tilted "1.jpg" appeared as "1.jpg.8_pJXFkzn75rIv_hAkqcIN0oOZamsF-T-AcCb31mZ0P_AAAAAAAAAAA0.2wfv1". Once the encryption was finished, a ransom note "T3yp_HOW_TO_DECRYPT.txt" was created on the desktop.

What kind of application is PremiumSearch?

Once we installed the PremiumSearch application, we saw that it changed specific web browser's settings to premiumsearch.xyz - a search engine that shows results generated by Bing (bing.com). For this reason, we can state that it is a browser hijacker promoting a fake search engine.

What is Put Darker?

Put Darker is a rogue browser extension endorsed as a tool that can enable dark mode on simple websites. Instead, our researchers found that this piece of software operates as a browser hijacker. Put Darker extension modifies browsers to promote the kmmx49.com fake search engine.

What is KMA47 ransomware?

During a routine investigation into new malware samples submitted into VirusTotal, our researchers detected and subsequently analyzed the KMA47 ransomware.

It encrypts data (renders files inaccessible) and demands a ransom for the decryption (access recovery). The researched sample renamed files by adding the ".encrypt" extension to filenames, e.g., "1.jpg" appeared as "1.jpg.encrypt", "2.jpg" as "2.jpg.encrypt", etc. KMA47 also created a ransom note titled "read_me.txt" and changed the desktop wallpaper.