Virus and Spyware Removal Guides, uninstall instructions

What is Protected?

Protected is a ransomware that encrypts victims' files using an asymmetric encryption algorithm. During encryption, this ransomware appends the name of each encrypted file with the .protected extension. For example, if the file before encryption was named "sample.jpg", it would become "sample.jpg.protected".

A "HOW_TO_RESTORE_YOUR_DATA.html" file is then created, which is placed in each folder containing the encrypted files.

What is search.searchsmg.com?

Super Mega Gaming is a rogue application claiming to allow users to play various arcade games.

On initial inspection, this app may seem legitimate and useful, however, due to rogue behavior (stealth installation, hijacking of web browsers, display of intrusive ads, and tracking of users' web browsing activity), Super Mega Gaming is classed as a potentially unwanted program (PUP) and a browser hijacker.

What is search.searchwag.com?

Created by SaferBrowser company, Watch Any Game is a deceptive application that supposedly allows users to watch live Football matches free of charge.

Some users believe this app is legitimate and useful, however, Watch Any Game is classed as a potentially unwanted program (PUP) and a browser hijacker. This application infiltrates systems without users’ permission, hijacks web browsers, tracks Internet browsing activity, and delivers various intrusive online advertisements.

What is Odcodc?

Odcodc is ransomware that encrypts various files stored on victims' computers (for example, .doc, .docx, .mp3, .jpeg, .pptx, and many others).

During encryption, this ransomware changes the name of each encrypted file using the "C-email-email_address-original_filename-.odcodc" name format. For example, if the original file was named "sample.jpg", the name after encryption would be "[email protected]". A file named "readthis.txt" is then created and placed in each folder containing encrypted files.

What is LeChiffre?

LeChiffre ransomware encrypts files stored on victims' computers. Unlike other ransomware, LeChiffre is not distributed by the most common methods (for example, malicious email attachments, fake updates, trojans, etc.) - it is proliferated manually. Cyber criminals manually infiltrate the system and run a malicious executable file.

User-files are then encrypted and LeChiffre creates a _How to decrypt LeChiffre files.html file in each folder containing the encrypted files. This file contains all information regarding encryption.

What is bacdau.vn?

bacdau.vn is a deceptive website claiming to be a legitimate Internet search engine. It also claims to enhance the web browsing experience by generating the most relevant search results and providing quick access to various popular websites (for example, YouTube, Gmail, Facebook, Google, etc.).

Although, this functionality may seem legitimate, be aware that this website is promoted using dubious installation set-ups that hijack Internet browsers. Furthermore, bacdau.vn continually monitors users' web browsing activity.

What is Vegclass?

Vegclass is another ransomware infection identical to Mahasaraswati, Green_Ray, and JohnyCryptor. After stealthily infiltrating the system, Vegclass uses an asymmetric encryption algorithm to encrypt various files stored on victims' computers. During encryption, Vegclass ransomware adds the .Vegclass(@)aol.com.xtbl extension to the name of each encrypted file.

It also changes the desktop wallpaper and creates a 'How to decrypt your files' text file, placing it in each folder containing encrypted files.

What is Ecovector?

Ecovector is a ransomware-type virus identical to Green_Ray, Mahasaraswati and JohnyCryptor. After infiltrating computers, Ecovector encrypts various files and appends the name of each encrypted file with the .{ecovector3(@)aol.com}.xtbl extension.

To encrypt files ,Ecovector uses asymmetric encryption and, thus, public (encryption) and private (decryption) keys are generated during the encryption process. Furthermore, Ecovector changes desktop wallpapers and creates a 'How to decrypt your files.txt' file, placing it in each folder containing encrypted files.

What is trendingbees.com?

Trendingbees.com is a fake Internet search engine identical to freewebtrending.com. By falsely claiming to generate the most relevant search results and improve the web browsing experience, trendingbees.com often tricks users into believing that this site is legitimate.

In fact, developers promote trendingbees.com using dubious software 'installers' that modify web browser settings without direct user permission. In addition, trendingbees.com continually tracks users' web browsing activity.

What is YTDownloader?

The YTDownloader application is presented as a great tool to facilitate download of videos from various video sharing websites. This software may seem legitimate and useful, however, YTDownloader is classed as a potentially unwanted program (PUP).

This association is made due to a deceptive software marketing method employed by the developers called 'bundling' (stealth installation of third party applications together with the chosen software). YTDownloader installation is known to cause browser redirects to the www-searching.com website and intrusive online advertisements (Ads by Shopper-pro and iWebar).

Advertisements generated by applications bundled with YTDownloader often redirect to bogus websites containing infectious content, thereby exposing your computer to risk of infection.