Virus and Spyware Removal Guides, uninstall instructions

What is MoWare H.F.D?

MoWare H.F.D is a ransomware-type virus discovered by malware security researcher, Jaromir Horejsi.

Once infiltrated, MoWare H.F.D encrypts various data and appends the ".H_F_D_locked" extension to the name of each encrypted file (for example, "sample.jpg" is renamed to "sample.jpg.H_F_D_locked"). MoWare H.F.D then opens a pop-up window containing a ransom-demand message.

What is Donald Trampo?

Donald Trampo is a ransomware-type virus discovered by security researchers, MalwareHunterTeam. After successfully infiltrating systems, Donald Trampo encrypts various information and appends the ".SN-16_digits-webmafia@asia.com_donald@trampo.info" extension to the name of each encrypted file.

For example, "sample.jpg" is renamed to "sample.jpg.SN-0906583417089982-webmafia@asia.com_donald@trampo.info". Once files are encrypted, Donald Trampo ransomware changes the desktop wallpaper.

What is saferqueries.com?

Identical to my-search-start.com, chumsearch.com, coolasearch.com, and a number of other websites, saferqueries.com is a fake Internet search engine that supposedly enhances the browsing experience by generating improved search results. Judging on appearance alone, saferqueries.com barely differs from Google, Bing, Yahoo, and other legitimate search engines.

Therefore, many users believe that it is also legitimate. In fact, developers promote this site by employing deceptive download/installation set-ups that hijack web browsers and stealthily modify various options. Furthermore, saferqueries.com continually records various information relating to users' Internet browsing activity.

What is DMA Locker?

DMA Locker is ransomware that stealthily infiltrates systems and encrypts stored data . Following successful encryption, DMA Locker displays a message stating that victims must pay a ransom in exchange for a private key required to decrypt their files.

What is my-search-start.com?

Developers present my-search-start.com as a 'high-experience' Internet search engine that significantly enhances the browsing experience by generating improved results.

Judging on appearance alone, my-search-start.com may appear legitimate and useful, however, developers promote it by employing rogue download/installation set-ups designed to hijack web browsers and modify various options without consent. Furthermore, this website continually records various information relating to users' web browsing activity.

What is AnonymizerGadget?

AnonymizerGadget (NotToTrack) is presented as the fastest proxy application currently available. On initial inspection, this app may seem legitimate and useful, however, it is often distributed as a 'bundle' with other software. Furthermore, it generates various intrusive online advertisements.

What kind of scam is Windows Security Alert?

"Windows Security Alert" is a fake error message displayed by a malicious website. Users often visit this website inadvertently - they are redirected by potentially unwanted adware-type programs (PUPs). These apps usually infiltrate systems without consent.

As well as causing unwanted redirects, this type of adware collects various data relating to Internet browsing activity and delivers intrusive online advertisements.

What is Amnesia?

Amnesia is ransomware-type malware discovered by xXToffeeXx and developed using the Delphi programming language. Once infiltrated, this malware encrypts various data and appends filenames with the ".amnesia" extension (for example, "sample.jpg" is renamed to "sample.jpg.amnesia").

Other variants of this ransomware append .ssimpotashka@gmail.com, .am, .LOGOZ, .TRMT, .onion, .[black.mirror@qq.com].oled, .@decrypt_files2017, .SON, .[Help244@Ya.RU].LOCKED, .@decrypt2017, "program3200@mail.ru, .CRYPTBOSS and .01 or .02 extensions to encrypted files.

Following successful encryption, Amnesia creates a text file ("HOW TO RECOVER ENCRYPTED FILES.TXT"), placing it in each folder containing encrypted files.

What is MyShopBot?

MyShopBot is a rogue application that supposedly saves time and money by providing various coupons and notifying users of special deals/discounts available within online stores.

Many users believe that MyShopBot is a legitimate and useful application, however, this app records user/system information, displays intrusive online advertisements, and often infiltrates systems without users' permission. For these reasons, MyShopBot is categorized as adware and a potentially unwanted program (PUP).

What is WebDiscover?

WebDiscover (also known as WebDiscover Browser) is a browser that supposedly allows users to surf the Internet directly from the desktop and enables various features such as VPN, music streaming, media play, weather forecasts, etc. - "The WebDiscover browser seamlessly integrates your favorite Chrome features and settings into one convenient tool to search the web... all from the comfort of your desktop."

Since this app is based on Google Chrome, and has the same User Interface, it may seem legitimate and useful, however, it is categorized as adware and a potentially unwanted program (PUP). WebDiscover often installs on systems without users’ consent (one of the reasons for these negative associations). Furthermore, this app monitors Internet browsing activity, displays ads, and may cause unwanted browser redirects.