Virus and Spyware Removal Guides, uninstall instructions

What is .HaCk?

.HaCk ransomware was discovered by dnwls0719 and ransomware is designed to prevent victims from accessing their files by encryption with a strong encryption algorithm, renaming them and generating a ransom message. It renames encrypted files by appending the ".HaCk" extension to filenames.

For example, it changes a file such as "1.jpg" to "1.jpg.HaCk", "2.jpg" to "2.jpg.HaCk", and so on. It also drops ransom messages (text files named "LEEME.txt") in all folders that contain encrypted files.

What is StreamingSearch?

Like most browser hijackers, StreamingSearch promotes the address of a fake search engine and gathers various data. This browser hijacker promotes streamsrch.com by changing certain browser settings. Apps of this type are categorized as potentially unwanted application (PUAs), since people often download and install them inadvertently.

What is Zemblax?

Discovered by James, Zemblax is a part of the Jigsaw ransomware family. Like most programs of this type, Zemblax blocks access to files by encryption, modifies their filenames and generates a ransom message. It renames encrypted files by appending the ".zemblax" extension to filenames.

For example, it renames "1.jpg" to "1.jpg.zemblax", "2.jpg" to "2.jpg.zemblax", etc. Instructions about how to pay for data decryption are provided in a pop-up window.

What is 0day0?

Discovered by dnwls0719, 0day0 is a malicious program belonging to the Dharma ransomware family. This malware encrypts data in order to demand ransom payments for decryption tools/software.

During the encryption process, files are renamed following this pattern: original filename, unique ID assigned to the victim, cyber criminals' email address and the ".0day0" extension. For example, a file like "1.jpg" would appear as something similar to "1.jpg.id-1E857D00.[day_0@aol.com].0day0", and so on for all affected files.

Once this process is complete, ransom messages are created in a pop-up window and the "FILES ENCRYPTED.txt" text file.

What is GlobalDeskSearch?

GlobalDeskSearch is an adware-type application, which shares common characteristics with browser hijackers. It operates by delivering intrusive ad campaigns, modifying browsers and promoting bogus search engines. Additionally, most adware and browser hijackers monitor users' browsing activity.

GlobalDeskSearch is often proliferated using fake Adobe Flash Player updates and, due to these dubious distribution methods, is also categorized as a Potentially Unwanted Application (PUA). Bogus software updaters/installers are also used to proliferate Trojans, ransomware and other malware.

What is SystemHelper?

SystemHelper is a potentially unwanted application (PUA) classified as adware. It is designed to generate revenue for developers by serving advertisements and collecting information. Additionally, this app is designed to promote the Safe Finder web page by opening it via akamaihd.net.

Adware-type apps are categorized as PUAs, since many users download and install them unintentionally.

What is Typing Test Guru?

Typing Test Guru is a browser hijacker that promotes a fake search engine (htypingtestguru.com). Typically, apps of this type promote these search engines by modifying browser settings. Commonly, they also gather various browsing-related (and other) data.

Since users often download and install browser hijackers unintentionally, they are categorized as potentially unwanted applications (PUAs).

What is UniversalWebSearch?

UniversalWebSearch is a rogue application classified as adware. It operates by running intrusive advertisement campaigns. This app also possesses browser hijacker characteristics such as browser modification and fake search engine promotion.

Additionally, most adware-type apps and browser hijackers have data tracking capabilities, which are employed to monitor users' browsing activity. UniversalWebSearch is often distributed using fake Flash Player updates and, therefore, is classified as a Potentially Unwanted Application (PUA).

Note that bogus software updaters/installers are used to proliferate various PUAs as well as ransomware, Trojans and other malware.

What is Himynameisransom?

Himynameisransom is malicious software belonging to the Medusa ransomware family. It is a new variant of Hellomynameisransom ransomware. Systems infected with this malware experience data encryption and users receive ransom demands for decryption.

When Himynameisransom encrypts, all files are appended with the ".himynameisransom" extension. For example, a file originally named something like "1.jpg" would appear as "1.jpg.himynameisransom" following encryption. After this process is complete, a ransom message ( "HOW_TO_RECOVER_DATA.html") is dropped into every compromised folder.

What is TaskProduct?

TaskProduct is adware that displays various unwanted advertisements, collects sensitive information and promotes the Safe Finder web page by opening it through akamaihd.net. Apps of this type are categorized as potentially unwanted applications (PUAs), since users often download and install them unintentionally.