Chatgigi2.com Pop-up Virus (Malware removal guide)

What is Chatgigi2.com?

Chatgigi2.com is a malicious domain used by attackers to distribute malicious content (Quasar RAT). RAT is a remote access Trojan. It is designed to allow attackers to remotely control an infected computer or server. Remote access trojans can infect computers like any other type of malware. They might be be hosted on a malicious website (in this case, attackers use chatgigi2.com), attached to an email, or exploit a vulnerability in an unpatched computer.

Chatgigi2.com used to spread malware:

QUICK LINKS

• What is Chatgigi2.com?
• Protection
• Removal

Chatgigi2.com in detail

Chatgigi2.com is a domain that is associated with a malware called “Quasar RAT”. Quasar RAT is a malware family written in .NET which is used by a variety of attackers. Cybercriminals use it to gain full administrative privileges and remote control of a target computer. RATs often come in bulk, attached to freeware or shareware, bundled with other malicious programs that users installed.

VirusTotal flagged Chatgigi2.com as malicious:

Chatgigi2.com malware is a Quasar RAT, so it can steal user credentials, arbitrary files from the user’s computer, credit card details, cryptocurrency wallets, cookies, autofill data, and passwords stored on Chrome/Firefox web-browser, as well as collect information about the user’s location. The collected data can be used for fraudulent purchases, transfers, spreading malware and Trojans, sending spam by email, and tricking users into making money transactions. In addition, stolen accounts can be sold and used by attackers to commit cybercrimes.

VirusTotal flagged a Chatgigi2.com file as Quasar Rat malware:

Quasar RAT is often distributed along with other malware, including ransomware and cryptominers malware. It can lead to blackmail, very serious privacy problems, identity theft, as well as significant financial losses. Ransomware can lead to the loss of personal documents and important data. Cryptominers are malware that uses computer resources to secretly mine cryptocurrency. Therefore, it is very important to use an antivirus, and if there are signs of an attack (if the Quasar RAT is detected) immediately scan the computer and remove the malware.

To summarize, Chatgigi2.com malware can lead to all types of fraud including stolen accounts and identify theft. It can also lead to other malware attacks, including ransomware, cryptojacking malware, and spyware. GodFather can seriously affect user privacy, phone performance and security.

Malware examples

On the Internet, users can come across many malicious apps that perform various malicious actions. Among them there are such as Altruistics Virus, Your File Is Ready To Download.iso, Trojan Wacatac, Winlogson.exe malware, Setup.rar Password 123456 Virus, although, of course, there are many more. Some of them collect user data, others install malware on computers, and still others add infected smartphones and computers to botnets, and so on.

In any case, each malicious app (adware, browser hijacker, trojan, worm, …) is a huge threat to both user privacy and device security. Therefore, malicious apps must be removed immediately after detection; using an infected phone is very dangerous.

How can you protect against Chatgigi2.com malware?

There are a number of methods that you can use to protect against Chatgigi2.com. It is better to use them together, this will provide stronger protection.

1. Use a trusted ad blocker. Ad blockers allow you to browse sites without ads, thus eliminating the possibility of clicking on something malicious and preventing it from being downloaded to the machine.
2. Pay for premium versions of popular services. The easiest way to avoid malware is to pay for the service you use. Many Internet services make it possible to use them without ads if you purchase a premium subscription. This helps ensure that malicious software cannot reach you.
3. Buy devices from trusted companies with built-in security. There have already been many cases where people who bought inexpensive Android devices found that trojans was already installed on their devices. Cheap Android devices do not receive security updates and are therefore particularly susceptible to infection and should be avoided.
4. Use an antivirus. Most antivirus programs can block trojans. Some trojans can block antiviruses, in which case a more aggressive method should be used, which is to use malware removal software. This software can detect and remove trojans that has a negative impact on the device.

Threat Summary

Name	Chatgigi2.com
Type	malicious domain
Distribution	social engineering, hacked software, malicious email attachments, deceptive apps, phishing pages
Hosted malware	Quasar RAT (Backdoor:MSIL/Quasar.e9ed57b0, Trojan[Spy]/Win32.Agent.foqx, Win.Malware.Bulz-9823462-0, HEUR:Trojan-Spy.MSIL.Downeks.gen, Generic.Trojan.MSIL.DDS, Backdoor:MSIL/Quasar.GG!MTB)
Damage	malware infection, financial losses, stolen banking credentials, stolen personal information, decreased Internet speed
Removal	Chatgigi2.com removal guide

Examples of such sites

Chatgigi2.com isn’t the only one on the Internet that aims to spread malware. We have already reported on such sites many times: Update Your Chrome browser extension, Cleaner Update for Android is Recommended, Crystal-blocker.com, Important Update for Chrome.

Why is my browser being redirected to Chatgigi2.com?

Usually, users end up on Chatgigi2.com and similar sites by going to a misspelled URL or, clicking on a fake link from push notifications and spam emails. In addition, they can be redirected to this site by malicious advertisements (malvertising) and Adware.

Push notifications are originally developed to alert the user of recently published news. Cyber criminals abuse ‘push notifications’ to display unwanted ads. These ads are displayed in the lower right corner of the screen urges users to play online games, visit phishing pages, install malicious browser add-ons & so on.

Here are some examples of the scam notifications:

How to remove Chatgigi2.com pop-ups

In order to get rid of malicious redirects, detect and remove the Chatgigi2.com malware, start by closing any applications and pop ups that are open. If a pop up won’t close, then close your browser (Microsoft Internet Explorer, Google Chrome, Firefox and Edge). If a program won’t close then please restart your PC. Next, follow the steps below.

To remove Chatgigi2.com malware, use the following steps:

1. Kill Chatgigi2.com malware
2. Disable Chatgigi2.com malware
3. Uninstall Chatgigi2.com related software
4. Scan computer for malware
5. Reset Google Chrome
6. Reset Internet Explorer
7. Reset Firefox

Kill Chatgigi2.com malware

Press CTRL, ALT, DEL keys together.

Click Task Manager. Select the “Processes” tab, look for the “Chatgigi2.com” malware then right-click it and select “End Task” or “End Process” option. If your Task Manager does not open or the Windows reports “Task manager has been disabled by your administrator”, then follow the guide: How to Fix Task manager has been disabled by your administrator.

This malware masks itself to avoid detection by imitating legitimate Microsoft Windows processes. A process is particularly suspicious: it’s taking up a lot of memory (despite the fact that you closed all of your applications), its name is not familiar to you (if you’re in doubt, you can always check the program by doing a search for its name in Google, Yahoo or Bing).

Disable Chatgigi2.com malware

Select the “Start-Up” tab, look for something suspicious that is the Chatgigi2.com malware, right click to it and select Disable.

Close Task Manager.

Uninstall Chatgigi2.com related software

Check the list of installed apps on your computer and remove all unknown and recently installed apps. If you see an unknown program with incorrect spelling or varying capital letters, it have most likely been installed by malware and you should clean it off first with a malware removal utility such as MalwareBytes Anti-Malware.

Windows 7	Windows 8
Click ‘Start’. In the Start menu select ‘Control Panel’. Find and select ‘Programs and Features’ or ‘Uninstall a program’. Select the program. Click ‘Uninstall’.	Press and hold Windows key and hit X key. Select ‘Programs and Features’ from the menu. Select the program. Click ‘Uninstall’.
Windows 10	Mac OS
Press and hold Windows key and hit X key. Select ‘Programs and Features’ from the menu. Select the program. Click ‘Uninstall’.	On the top menu select ‘Go’, then ‘Applications’. Drag an unwanted application to the Trash bin. Right-click on the ‘Trash’ and select ‘Empty Trash’.

Scan computer for malware

We recommend you use the following free malware removal tools: MalwareBytes Anti-Malware and Kaspersky Virus Removal Tool. The antivirus programs can be used to identify the Chatgigi2.com malware and remove it from the computer.

You can remove the Chatgigi2.com malware virus automatically with the help of MalwareBytes. We recommend this malware removal utility because it can easily remove spyware, trojans, browser hijackers, adware, PUPs and toolbars with all their components such as files, folders and registry entries for free.

First, visit the page linked below, then click the ‘Download’ button in order to download the latest version of MalwareBytes.

Once the downloading process is complete, run it and follow the prompts. Once installed, MalwareBytes will try to update itself and when this procedure is done, click the “Scan” button to run a virus scan to see if your computer has a virus or malware infection. A scan can take anywhere from 10 to 30 minutes, depending on the count of files on your computer and the speed of your personal computer. The scan will detect malware, trojans, spyware, adware and malicious files. The scan generates a report of the malware and recommendations on how to manage them. Make sure all security threats have ‘checkmark’ and click “Quarantine” button.

MalwareBytes is a free malware removal tool that you can use to remove all detected folders, files, services, registry entries and so on. To learn more about this program, we advise you to read the article or follow the video guide below.

Kaspersky Virus Removal Tool (KVRT) is another antivirus program that can remove malware for free. KVRT can remove crypto malware, adware, spyware, trojans, worms, potentially unwanted programs, malicious software and other security threats from your computer. You can use this tool to search for malware even if you have an antivirus or any other security program.

Download Kaspersky virus removal tool by clicking on the following link. Save it directly to your Windows Desktop.

After the downloading process is complete, double-click on the KVRT icon. Once initialization procedure is complete, you’ll see the KVRT screen as displayed below.

Click “Change Parameters” and set a check near all your drives. Click OK to close the Parameters window. Next click “Start scan” button to scan your computer for the Chatgigi2.com malware and other known infections. This task can take quite a while, so please be patient. While the tool is scanning, you can see how many objects and files has already scanned.

As the scanning ends, Kaspersky virus removal tool will create a list of malware found, as displayed in the figure below.

All detected threats will be marked. You can delete them all by simply clicking Continue.

Reset Google Chrome

Open the Google Chrome menu by clicking on the button in the form of three horizontal dotes (). It will display the drop-down menu. Choose More Tools, then click Extensions. You can also type chrome://extensions into Chrome’s address bar.

Examine your list of installed extensions and find any that you don’t recognize, you know are malicious or simply want to remove. Click the “Remove” button below the extensions you want to remove. In the pop-up that comes up, click “Remove” once again. The extension box and icon should disappear from the screen.

If the “Remove” option is not available as the extension is being detected as “Installed by administrator” or “Managed by your organization” then the easiest way to fix this is to follow the instructions: Remove Google Chrome extensions installed by enterprise policy, Chrome Managed by your organization malware removal guide.

After removing the malicious extension, it is recommended to reset the browser settings. Resetting Google Chrome will turn off all extensions, clear your cookies, reset unwanted changes in your browser but will save your bookmarks and passwords.

Open the Google Chrome main menu again, click “Settings”. Click Reset settings and then “Restore settings to their original defaults”.

Confirm your action, click the “Reset settings” button.

Reset Firefox

If your Firefox web browser is hijacked by the Chatgigi2.com malware, then it may be time to perform the browser reset. Keep in mind that resetting your web-browser will not remove your history, bookmarks, passwords, and other saved data.

Start the Firefox and click the menu button (it looks like three stacked lines) at the top right of the internet browser screen. Next, click the question-mark icon at the bottom of the drop-down menu. It will open the slide-out menu.

Select the “Troubleshooting information”. If you are unable to access the Help menu, then type “about:support” in your address bar and press Enter. It bring up the “Troubleshooting Information” page as displayed in the following example.

Click the “Refresh Firefox” button at the top right of the Troubleshooting Information page. Select “Refresh Firefox” in the confirmation prompt. The Firefox will start a process to fix your problems that caused by the Chatgigi2.com malware virus. Once, it is finished, click the “Finish” button.

How to stay safe online

If you browse the Internet, you can’t avoid malicious sites and phishing pages. But you can protect your internet browser against it. Download and use an ad blocking program. AdGuard is an ad-blocker which can filter out a huge number of of the malicious advertising, blocking dynamic scripts from loading harmful content.

1. First, visit the following page, then click the ‘Download’ button in order to download the latest version of AdGuard.
   
   

   Adguard download
   26629 downloads
   Version: 6.4
   Author: © Adguard
   Category: Security tools
   Update: November 15, 2018
   
2. When the downloading process is complete, start the downloaded file. You will see the “Setup Wizard” window. Follow the prompts.
3. After the installation is complete, press “Skip” to close the installation program and use the default settings, or press “Get Started” to see an quick tutorial which will help you get to know AdGuard better.
4. In most cases, the default settings are enough and you don’t need to change anything. Each time, when you run your computer, AdGuard will launch automatically and stop unwanted advertisements, block harmful and misleading webpages. For an overview of all the features of the program, or to change its settings you can simply double-click on the icon called AdGuard, which can be found on your desktop.

Finish words

We suggest that you keep Malwarebytes (to periodically scan your device for malware) and AdGuard (to help you stop malicious pop-ups and scam sites). Moreover, to prevent any malware, please stay clear of unknown and third party programs, make sure that your antivirus software, turn on the option to search for potentially unwanted programs.

If you need more help with Chatgigi2.com related issues, go to here.