Virus and Spyware Removal Guides, uninstall instructions

What is search.searchmmap.com?

Maps Driving Directions is a deceptive application that supposedly enables GPS-related functionality. Judging on appearance alone, Maps Driving Directions may seem legitimate and useful, however, this application is categorized as a potentially unwanted program (PUP) and a browser hijacker.

There are three main reasons for these negative associations: 1) installation without users' consent; 2) promotion of a fake web search engine [search.searchmmap.com], and; 3) tracking of the web browsing activity.

What is NMCRYPT?

NMCRYPT is a high-risk ransomware-type virus similar to NM4. Once infiltrated, NMCRYPT encrypts most stored data using AES-256 and RSA-2048 encryption algorithms.

In addition, this malware appends filenames with the ".NMCRYPT" extension. For example, "sample.jpg" is renamed to "sample.jpg.NMCRYPT". Encrypted files become unusable. Once the encryption process is over, NMCRYPT generates an HTML file ("Recover your files.html") and places a copy in every existing folder.

What is Black Heart?

Black Heart (also known as BlackRouter) is a ransomware-type virus discovered by malware security researcher, Jakub Kroustek. Immediately after infiltration, Black Heart encrypts most stored data and appends filenames with the ".pay2me" extension.

Compromised data immediately becomes unusable. After successfully encrypting data, Black Heart opens a pop-up window and creates a text file ("ReadME-BLackHeart.txt"), placing a copy in each existing file.

What is WANNACRY DETECTED?

Displayed by a dubious website, "WANNACRY DETECTED" is a fake error similar to Application.exe Has Stopped Working, Windows Detected ZEUS Virus, Your Device Is Under Threat, and many other similar sites. 

Research shows that users are redirected to this website by various potentially unwanted programs (PUPs) that typically infiltrate computers without users' consent. In addition to redirects, PUPs deliver various ads, misuse system resources, and gather sensitive data.

What is TrickBot?

TrickBot is trojan-type malware designed to steal users' private data. Research shows that, in most cases, developers proliferate TrickBot using spam emails, however, it might also be distributed using fake Adobe Flash Player updates. This virus was first identified in late 2016 targeting various financial institutions, banks, and credit card providers (for more information click here).

In late 2017, cryptomining became very popular, and for this reason, TrickBot was updated and now also targets cryptowallets. Besides, TrickBot can spread itself further and infect as many computers as possible.

What is MaxiCrypt?

MaxiCrypt is a ransomware-type virus recently discovered by malware security researcher, Michael Gillespie. Once infiltrated, MaxiCrypt encrypts most stored data and renames files using the "[random_letters_and_digits].[maxicrypt@cock.li].maxicrypt" pattern.

For example, any file could be renamed to something like "aMo8Il1AfG5KnMoL51sAVoqP.[maxicrypt@cock.li].maxicrypt". Encrypted files become unusable and indistinguishable. After successfully encrypting files, MaxiCrypt generates a text file ("How to restore your data.TXT") and places a copy in every existing folder.

What is Google Chrome Critical ERROR?

"Google Chrome Critical ERROR" is a fake error message similar to System Support Alert, Your Connection To This Site Is Not Private, This Build Of Windows 10 Is Corrupted, and many others. 

The error is displayed by various malicious sites that users often visit inadvertently - they are redirected by potentially unwanted programs (PUPs) or intrusive ads delivered by other malicious sites.

Research shows that potentially unwanted programs typically infiltrate systems without permission and, as well as causing redirects, generate intrusive ads, record sensitive information and, sometimes, run unwanted background processes.

What is Satyr?

Recently discovered by Michael Gillespie, Satyr is a ransomware-type virus similar to Spartacus. Once infiltrated, Satyr encrypts most stored files using AES and RSA cryptographies.

In addition, this malware appends filenames with the ".Satyr" extension (e.g., "sample.jpg" is renamed to "sample.jpg.Satyr"). Encrypted files become unusable. Satyr then opens a pop-up window and creates a text file ("READ ME.txt"), placing it on the desktop.

What is "NATIONAL SECURITY BUREAU"?

NATIONAL SECURITY BUREAU is malware designed to lock the computer screen and display a message stating that the system, together with a number of files, has been blocked, since 'pirated software' was found on the computer. Users are encouraged to pay a fine.

This malware infection is very similar to FBI Cybercrime Division Virus, FBI Virus - Your Computer Has Been Locked, and many others.

What is XTBL?

Recently discovered by MalwareHunterTeam, XTBL is ransomware-type virus designed to stealthily infiltrate the system and encrypt most stored files. In doing so, this malware adds the ".xtbl" appendix to the name of each encrypted file. Once files are encrypted, using them becomes impossible.

Immediately after encryption, XTBL generates a text file ("IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT") and places a copy in each existing directory. This file contains a ransom-demand message.