Virus and Spyware Removal Guides, uninstall instructions

What kind of malware is Saturn?

First discovered by MalwareHunterTeam, Saturn is a ransomware-type virus that, once infiltrated, encrypts stored data and makes ransom demands. During encryption, Saturn appends filenames with the ".saturn" extension (e.g., "sample.jpg" is renamed to "sample.jpg.saturn").

From this point, files become unusable. Following successful encryption, Saturn creates five files ("#DECRYPT_MY_FILES#.vbs", "#DECRYPT_MY_FILES.BMP" [also set as desktop wallpaper], "#DECRYPT_MY_FILES#.txt", "#DECRYPT_MY_FILES#.html", and "#KEY-dea23dbdbbfeba538e0c3aac3751331d.KEY"), placing them on the desktop. The BMP, TXT, and HTML files contain ransom-demand messages.

What is search.salamangal.com?

Developers present search.salamangal.com as a legitimate Internet search engine that significantly enhances the web browsing experience by generating improved results. Judging on appearance alone, search.salamangal.com may seem similar to Google, Bing, Yahoo, and other legitimate search engines.

Therefore, many users believe that search.salamangal.com is also legitimate, however, criminals promote this site using rogue downloaders/installers that modify browser options without users' consent. Furthermore, search.salamangal.com continually records various information relating to browsing activity.

What is search.froktiser.com?

According to the developers, search.froktiser.com is a high-end Internet search engine that significantly enhances users' browsing experience by generating improved results.

Judging on appearance alone, search.froktiser.com may appear legitimate and useful, however, criminals promote this site via browser-hijacking downloaders/installers that modify web browsers options without permission. In addition, search.froktiser.com continually records various sensitive data.

What is hdwallpaper123.com?

Developers present hdwallpaper123.com as a high-end Internet search engine that supposedly generates improved results and, therefore, enhances the web browsing experience. Judging on appearance alone, hdwallpaper123.com may seem a legitimate search engine such as Google, Bing, Yahoo, and so on.

Therefore, many users believe that hdwallpaper123.com is also legitimate and useful, however, developers promote this site using browser-hijacking download/installation set-ups that modify browser options without users' consent. Furthermore, hdwallpaper123.com gathers various data relating to browsing activity.

What is feed.emoji-search.com?

feed.emoji-search.com is another fake Internet search engine that, according to the developers, enhances the web browsing experience by generating improved results. Initially, feed.emoji-search.com may appear legitimate and useful, however, developers promote this site using a browser-hijacking application called Emoji Search.

In addition, feed.emoji-search.com and Emoji Search record various sensitive information relating to users' Internet browsing activity.

What is SlimCleaner?

Developed by Slimware Utilities Holdings Inc., SlimCleaner is a deceptive application presented as a legitimate system optimization tool. Although its features may seem legitimate and useful, SlimCleaner is categorized as a potentially unwanted program (PUP). Furthermore, SlimCleaner typically infiltrates systems without users' consent.

What is search.dsearchm3f2.com?

Find Forms Fast is presented as a legitimate application that supposedly helps to find various printable forms online. These claims often trick users into believing that Find Forms Fast is legitimate and useful, however, this PUP (potentially unwanted program) typically infiltrates systems without permission and gathers sensitive data.

In addition, Find Forms Fast is categorized as a browser hijacker - a form of unwanted software that modifies web browser options without users’ permission.

What is Wana Decrypt0r?

First discovered by S!Ri, Wana Decrypt0r is a new variant of a high-risk ransomware called WannaCry. Once infiltrated, Wana Decrypt0r encrypts most files and appends filenames with the ".wannacry" extension (e.g., "sample.jpg" is renamed to "sample.jpg.wannacry").

From this point, files become unusable. Following successful encryption, Wana Decrypt0r changes the desktop wallpaper and opens a pop-up window, both containing ransom-demand messages.

What is search.hemailinboxlogin.com?

Developers present Email Inbox Login as a legitimate application that provides quick access to emails. This functionality may seem legitimate and useful, however, Email Inbox Login is classified as a potentially unwanted program (PUP) and a browser hijacker.

There are three main reasons for these negative associations: 1) stealth installation without users' consent; 2) modification of web browser settings, and; 3) tracking of sensitive data.

What is David?

David is another ransomware-type virus discovered by malware security researcher, Martin Stopka. Once infiltrated, David encrypts stored data and adds the ".david" extension to the name of each compromised file. For instance, "sample.jpg" is renamed to "sample.jpg.david".

Encrypted files become unusable. After successful encryption, David creates a text file ("get_my_files.txt") and places a copy in every existing folder.