Virus and Spyware Removal Guides, uninstall instructions

What kind of malware is Payk?

Payk is the name of ransomware that encrypts files and creates a ransom note (the "Decrypt-me.txt" text file). It also renames files by appending the paykter@gmail.com email address, a string of random characters (possibly a victim's ID), an the ".payk" extension.

For instance, Payk renames a file named "1.jpg" to "1.jpg.[PAYKTER@gmail.com][MJ-XD4879165032].payk", "sample.jpg" to "sample.jpg.[PAYKTER@gmail.com][MJ-XD4879165032].payk". This ransomware variant is part of the VoidCrypt ransomware family.

What kind of software is ExtendedRotator?

ExtendedRotator generates advertisements and hijacks a web browser to promote a fake search engine. The majority of users install apps like ExtendedRotator inadvertently. Apps installed (and downloaded) in such circumstances are called potentially unwanted applications (PUAs).

What is Bcksz ransomware?

Bcksz is a malicious program categorized as ransomware. This malware encrypts data (locks files) and demands ransoms for the decryption.

Affected files are appended with a random character string and a ".bcksz" extension. For example, a file initially named "1.jpg" would appear similar to "1.jpg.pBMQVdweMNvRpG2B0K4rYBc7P_xIwrPHNWyYA7Rh8Pr_rfgT9F2dAv80.bcksz".

After the encryption process is complete, a text file titled "s4Qi_HOW_TO_DECRYPT.txt" is created on the desktop. This file contains the ransom-demanding message.

What is Cutdrywoe ransomware?

Cutdrywoe is a ransomware-type program. It operates by encrypting data (rendering files inaccessible) and demanding payment for the decryption.

Affected files are appended with an extension consisting of four random characters. For example, a file originally named "1.jpg" would appear similar to "1.jpg.hboo", "2.jpg" as "2.png.x830", etc. Once this process is complete, a file titled "read_me!.txt" is created, and the desktop wallpaper is changed. The text file and wallpaper contain ransom notes.

What is gospeljingle[.]com?

Gospeljingle[.]com is an illegal streaming website. In addition to infringing copyright laws, this site also uses rogue advertising networks.

The Internet is rife with pages that use such networks for monetization purposes;  zippyshare.com, yifymovies.pro, ytop1.com, onlymp3.net and naijawide.com are just some examples. Rogue advertising networks operate by promoting various webpages, many of which are deceptive and dangerous.

What is ChannelParameter?

ChannelParameter is an adware-type app with browser hijacker traits. It is also classified as a PUA (Potentially Unwanted Application) due to the questionable methods used to distribute it.

What kind of application is SyncApp?

SyncApp is the name of an advertising-supported and browser-hijacking application. It generates ads and hijacks a web browser (changes its settings) to promote a fake search engine. Most of the apps like SyncApp are promoted and (or) distributed using deceptive methods. Thus, most users download and install them unintentionally.

What is LiteBrowser?

LiteBrowser is a rogue browser that is based on the Chromium open-source project. This PUA (Potentially Unwanted Application) is also classified as adware. This dubious browser can run intrusive advertisement campaigns and likely has data tracking abilities as well.

What kind of page is investmentbitc[.]com?

Investmentbitc[.]com asks for permission to show notifications and promotes shady websites. There are plenty of pages sharing these qualities, for example, akaiksots[.]com, bestclevercaptcha[.]top, and sweepstakessurvey[.]org. Most of them get opened through dubious ads, pages, or potentially unwanted applications (PUAs).

What kind of page is greentabs.net?

Greentabs.net is a fake search engine that does not generate its own search results. Usually, such search engines are promoted through browser-hijacking applications. A big part of these apps gets installed by users accidentally. Thus, browser hijackers fall into the category of potentially unwanted applications (PUAs).