Virus and Spyware Removal Guides, uninstall instructions

What is Salam!?

Salam! is a ransomware-type malware that infiltrates computers and encrypts various file types. During encryption, Salam! creates CRYPTOSO.KEY and WHATHAPPENEDTOYOURFILES.txt files in each folder containing encrypted files. Encrypted files are given .keyz extension.

The text file contains a message stating that users' data has been encrypted and can only be restored with a specific decrypter. To receive this decrypter, users must pay a ransom.

What is nicesearches.com?

Nicesearches.com is a fake Internet search engine identical to pico-search.com, delta-search.com, gold-page.com, and a number of other dubious sites. Initially, nicesearches.com may seem legitimate, since its appearance is almost identical to Google, Bing, Yahoo, and other search websites.

In fact, developers promote nicesearches.com using dubious software 'installers' that hijack Internet browsers. Furthermore, this fake Internet search engine continually gathers various data related to users' Internet browsing activity.

What is Steel Cut?

Steel Cut is a potentially unwanted program (PUP) created by SuperWeb LLC. This application claims to improve the Internet browsing experience by enabling coupons, comparison shopping, and other similar features. This functionality may seem legitimate and useful, however, Steel Cut is considered to be adware.

The developers of Steel Cut employ a deceptive software marketing method called 'bundling' (stealth installation of additional programs with the chosen software) to install this PUP on Internet browsers (Internet Explorer, Google Chrome, and Mozilla Firefox) without users' permission.

Following successful infiltration, Steel Cut generates intrusive online ads such as banner, search, interstitial, transitional, and pop-up ads. These may lead to high-risk adware or malware infections.

What is stadsear.com?

Stadsear.com is a dubious URL that redirects users to various false Internet search engines. The appearance of these sites may seem legitimate, since they are similar to Google, Bing, and other legitimate websites, however, stadsear.com is promoted using deceptive software 'installers' that hijack Internet browsers (Internet Explorer, Google Chrome, and Mozilla Firefox). In addition, these rogue Internet search engines track users' web browsing activity.

What is Converton?

Converton is ransomware-type malware that stealthily hijacks computers and encrypts various files. This ransomware employs the AES-256 encryption algorithm with an RSA-2048 key.

Thus, two keys (public and private) are generated during encryption. Converton ransomware also adds .converton, .enigma or .czvxce extension to each compromised file. Furthermore, this ransomware creates a !!!-WARNING-!!!.html file on victims' desktops. This file contains all details regarding the encryption.

What is .Cryptohasyou?

.Cryptohasyou is ransomware that encrypts various files stored on the infiltrated system including .exe, .com, .bin, .dat, .sys, any .dmp, .information. .key, .pdb, .bat,. ps1, .vb, .ws, .wsd, .cpl,. reg, .dll,. ini, .msi, .pfx, .sct and .wsc. To achieve this, .Cryptohasyou uses the AES-256 algorithm with an RSA-2048 key.

Thus, private and public keys are generated during encryption. .cryptohasyou also creates a YOUR_FILES_ARE_LOCKED.txt file in each folder containing the compromised files. Note that this ransomware adds a .enc extension to all encrypted files and, therefore, it is straightforward to identify them.

What is HoistSearch.com?

The HoistSearch browser application is developed by Hoist Media. This browser app can be downloaded from its homepage, however, it is often 'bundled' with free software downloaded from the Internet. At time of research, this potentially unwanted application was also bundled with fake downloads such as Java, Flash, and browser updates.

Bundling is a commonly-used and deceptive software marketing method. When installed, this toolbar assigns the browser homepage and default Internet search engine settings to hoistsearch.com This website is not related to malware or virus infections, however, the creators of this toolbar have full control over the software, and therefore, are capable of redirecting users to malicious websites at any time.

What is .Better_Call_Saul?

.Better_Call_Saul is ransomware distributed via spam email messages with infected .doc files attached. After successful infiltration, this ransomware encrypts various files stored on the system. To encrypt them, the ransomware employs the RSA-256 algorithm and, therefore, public and private keys are created during encryption.

Note that this ransomware adds an extension of the same name (.better_call_saul) to the end of each encrypted file. In addition, it changes the user's desktop wallpaper and creates a README1.txt file in each folder containing the encrypted files.

Both text file and desktop wallpaper contain a message stating that the files are encrypted, and to restore them, the victim must pay a ransom.

What is hohosearch.com?

Hohosearch.com is a fake Internet search engine identical to safefinder.com, gold-page.com, zeta-search.com, and a number of other dubious websites. 

On initial inspection, hohosearch.com may seem a legitimate search engine (such as Google, Bing, or Yahoo), however, this site is promoted using deceptive software 'installers'. Furthermore, hohosearch.com continually gathers information relating to Internet browsing activity.

What is Screen Addict?

Screen Addict is a browser toolbar that supposedly allows users to watch movie trailers, quickly access various streaming sites, and access other movie-related functionality.

On initial inspection, search.mysearch.com may seem legitimate and useful, however, due to rogue behavior (stealth installation, modification of browser settings, and tracking of Internet browsing activity) it is classed as a potentially unwanted program (PUP) and adware.