Do you know what Salam Ransomware is?
Salam Ransomware is a ransomware infection that might sneak onto the computer one day. It has been noticed that this usually happens if users tend to download software from third-party sources and torrent websites. If you have recently downloaded some kind of program too or simply have downloaded and opened a spam email attachment, it is not surprising that Salam Ransomware is installed. The name of this ransomware infection is Salam because it opens the window with the word “Salam!” at the top after encrypting files. Yes, this threat does not differ much from other ransomware infections because it encrypts files stored on the computer. Like other well-known ransomware infections, it does that because it seeks to obtain money from innocent computer users. Cyber criminals want to get easy money, so if your files are quite unimportant, you should not hand in your money for them. You should know that it is possible to recover files without paying money too. You should read this article carefully to find out how it is possible to do that.
Salam Ransomware screenshot
Scroll down for full removal instructions
As you already know, Salam Ransomware will immediately encrypt you files. Specialists have thoroughly tested this infection and found that it usually encrypts documents and pictures only. In other words, it is targeted at the most valuable data. There is no doubt that Salam Ransomware has managed to sneak onto the computer and your files are encrypted if you cannot access them. It seems that this threat will not change the extensions of these files, so you might face difficulties in recognizing them. Once Salam Ransomware finishes decrypting files, it immediately puts a warning message on the screen. This message informs users that their files have been encrypted and only the special key can unlock them. Of course, this key is not free:
Your ID: xxxx
Hi. Your files are now encrypted. I have the key to decrypt them back. I will give you a decrypter if you pay me. If you pay me today, the price is only 1 bitcoin. If you pay me tomorrow, you will have to pay 2 bitcoins. If you pay me one week later the price will be 7 bitcoins and so on. So, hurry up.
Contact me using this email address: mohammad@opensourcemail.org
As can be seen, the decryption tool, unfortunately, is not cheap. In addition, it is unclear whether you will really get that key after you make a payment. Therefore, you should not do that, especially if you have a backup of your files and can easily restore them. Yes, unfortunately, this is the only way to restore files without paying money at the time of writing.
The warning message will disappear from the screen after the system restart; however, this ransomware infection will leave the WHATHAPPENDTOYOURFILES.TXT file in every folder. This file will provide the same information as the warning message that is visible on the Desktop right after the encryption. It is very likely that these text files will not disappear and you will have to take care of them yourself.
As you already know, ransomware infections are very serious threats that might sneak onto computers without permission. If you do not wish this to happen to you again, you have to install a security tool and always keep it active. As ransomware might come together with other suspicious programs too, you should not download software from third-party web pages anymore. We are sure that this will help you not to encounter a ransomware infection ever again.
It is possible to remove Salam Ransomware manually, but this will not be very easy to do that. To help less experienced computer users, we have prepared the manual removal instructions. They can be found below this article. Of course, you can also easily install the SpyHunter scanner and scan the system with it to delete Salam Ransomware from the system. You will be able to install it only if you restart your computer.
Delete Salam Ransomware
- Tap the Windows key + E.
- Follow the path C:\Users\user\AppData\Roaming.
- Find the file whose name consists of random numbers, e.g. 764848 and delete it.
- Locate the MatchstickHeterospory or a similar file, right-click on it, and select Delete.
- Find and delete two .dll files.
- Locate and delete the file with the UniKS-UTF32-V or a similar name.
- Empty the Recycle bin.
In non-techie terms:
If you remove Salam Ransomware from your system, it does not mean that the system is really clean, which is why we suggest scanning the system with an automatic scanner after the deletion of Salam Ransomware. Theoretically, it is possible to find malicious software manually too, but it is an extremely difficult job, so you should not do that.