Trojan.Win32.Save.ExternalUI Virus

*7-day Free Trial w/Credit card, no charge upfront or if you cancel up to 2 days before expiration; Subscription price varies per region w/ auto renewal unless you timely cancel; notification before you are billed; 30-day money-back guarantee; Read full terms and more information about free remover.


Trojan.Win32.Save.ExternalUI is what it best known as a Trojan horse virus. Trojan.Win32.Save.ExternalUI can be programmed to accomplish a wide range of malicious tasks, so its timely removal is crucial for your safety. .externalui

Below we have included a set of instructions with the help of which you should be able to locate and remove Trojan.Win32.Save.ExternalUI and all of its components from your system. However, please be very careful to follow all the steps exactly as described in the removal guide so as to avoid by chance deleting some vital system file that may result in permanent damage to your OS. There is also a professional removal tool available that will help you take care of this process automatically, if you prefer.

But before you head over to either of those removal options, we’d like to give you a little more information regarding Trojan.Win32.Save.ExternalUI and exactly the kind of threat that it represents.

The Trojan.Win32.Save.ExternalUI Virus

A Trojan horse virus like Trojan.Win32.Save.ExternalUI will rarely (if ever) exhibit any symptoms whilst on the computer. At times an infection of this kind may cause system crashes, however, or even significant slowdowns of the compromised computer. But, unfortunately, these same symptoms can be signs of a whole array of other problems.

Trojan horses are particularly notorious for their stealth. This is one of the main reasons that they have become as popular as they are and also why roughly 80% of all malware attacks are attributed to exactly this category of malicious code.

The second invaluable quality of Trojans is their multifunctional nature. A variant like Trojan.Win32.Save.ExternalUI, Multi Speed Up can be set to accomplish all sorts of different malicious tasks, so there’s no way of pinpointing the exact purpose of this particular virus.

But we can give you a rough idea of the range of malicious capabilities this harmful software class has. For instance, a Trojan can steal information from your computer by proving the hackers with remote access to it. It can share your screen with them, copy your keystrokes, hack into your webcam and microphone, etc. If the criminals have more elaborate plans, they can use the Trojan to hijacker your entire traffic data have it go through their servers without you even suspecting it. And this in turn may result in crimes surrounding identity theft, use of your online bank accounts, and various other instances of data misuse.

Other types of usages include the distribution of other malware, most commonly ransomware. A Trojan horse like Trojan.Win32.Save.ExternalUI, PC Accelerate can also exploit your system’s resources to mine cryptocurrencies for the hackers or send out spam to others.

Now as for how you may have landed Trojan.Win32.Save.ExternalUI to begin with, there are several main distribution channels for Trojans. These tend to be malicious online ads (also known as malvertisements) and spam messages. Normally, the hackers will embed the virus in an attached file or a link that you are asked to open or download under whatever pretext. And another fairly common source of malware are torrents and various other illegal or shady download sources.


Detection Tool

Remove Trojan.Win32.Save.ExternalUI Virus

A quick method to remove Trojan.Win32.Save.ExternalUI from your computer is to locate it in the Programs and Features list and uninstall it from there. Here are the instructions in brief:

  • Head to the bottom left of your desktop and click on the Start button.
  • After that, go to Control Panel and open Programs and Features
  • Click on Uninstall a Program and then carefully search for Trojan.Win32.Save.ExternalUI.
  • When you find the threat, highlight it and uninstall it.
  • In case you detect other suspicious programs, do a quick research and uninstall them if they turn out to be dangerous.

Unfortunately, trojans like Trojan.Win32.Save.ExternalUI may add some helper components in different system locations, not only in Programs and Features. Thus, completing the instructions above may not be enough to rid you of the threat completely. The guide below, however, offers a more detailed set of steps that will navigate you to those locations.


For the smooth completion of all the steps in this guide, please Bookmark this page so you can refer back to it as needed. Also, please reboot the infected computer in Safe Mode. This will increase your chances of detecting the threat in the various system locations.



Once the computer launches in Safe Mode, press CTRL + SHIFT + ESC keyboard keys together. The Windows Task Manager will open. Click on the Processes Tab and look for processes that operate in an unusual way or look dangerous. 


As soon as you detect a suspicious-looking process, right-click on it and then select Open File Location. Scan the files in that location with our free online virus scanner that is available here:

Each file will be scanned with up to 64 antivirus programs to ensure maximum accuracy
This scanner is free and will always remain free for our website's users.
This file is not matched with any known malware in the database. You can either do a full real-time scan of the file or skip it to upload a new file. Doing a full scan with 64 antivirus programs can take up to 3-4 minutes per file.
Drag and Drop File Here To Scan
Drag and Drop File Here To Scan
Analyzing 0 s
Each file will be scanned with up to 64 antivirus programs to ensure maximum accuracy
    This scanner is based on VirusTotal's API. By submitting data to it, you agree to their Terms of Service and Privacy Policy, and to the sharing of your sample submission with the security community. Please do not submit files with personal information if you do not want them to be shared.

    If the files related to the questionable process turn out to be malicious, delete them along with the folders that contain them and end their process from the Processes tab.



    Next, open the Control Panel by tapping on the Windows Start button at the bottom left and typing “Control Panel” in the Windows search field. When you get inside, go to Programs and Features and search for entries that look suspicious or seem to be linked to Trojan.Win32.Save.ExternalUI. Uninstall these entries. If a notification like the one below pops up when you press “Uninstall”,  choose NO:





    Next, go back to the Windows search field but this time type msconfig and hit enter. 



    Once in System Configurations, tap on the Startup tab and take a careful look at the entries listed there. Trojans like Trojan.Win32.Save.ExternalUI may add some components that help them to launch as soon as the system launches. These entries sometimes may have “Unknown” Manufacturer or may use fake names of common app processes. In any case, research all the entries in the list and remove the checkmark before those that look suspicious. When you are done, click OK.

    Bigger threats like ransomware and spyware may find their way into your PC if you have been infected with Trojan.Win32.Save.ExternalUI. That’s why it is worth checking if your computer is hacked by completing the steps that follow:

    Open a Run window on your screen by pressing together the Start and R keys from the keyboard. Then copy the command below and paste it in the Run window: 

    notepad %windir%/system32/Drivers/etc/hosts

    Click OK to execute the command and in a second you should see a file named Hosts on the screen. Head to the section where it writes “Localhost” and check for questionable IPs under it. The image below explains what you should be looking for.  

    hosts_opt (1)


    Basically, if you are hacked, you will see some strange IPs under Localhost. If this is your case, please leave us a commend below this post and we will advise you on your next actions.



    Before you close this guide and greet yourself with the successful removal of Trojan.Win32.Save.ExternalUI, in the last step you need to find and remove the Trojan’s entries from the Registry. For that, launch the Registry Editor by typing Regedit in the windows search field and pressing the Enter

    When the Editor opens, use the Find function (CTRL and F key combination) to find the Trojan by typing its name in the text box and clicking on the Find Next button. Delete any entries that are found with that name by right-clicking on them.

    Finally, go manually to the directories listed below and delete/uninstall them in order to ensure that there are no entries related to Trojan.Win32.Save.ExternalUI that are left behind:

    • HKEY_CURRENT_USER—-Software—–Random Directory. 
    • HKEY_CURRENT_USER—-Software—Microsoft—-Windows—CurrentVersion—Run– Random
    • HKEY_CURRENT_USER—-Software—Microsoft—Internet Explorer—-Main—- Random

    If you find it difficult to decide what needs to be deleted, ask us in the comments or simply use a professional removal tool for scanning.


    About the author


    Violet George

    Violet is an active writer with a passion for all things cyber security. She enjoys helping victims of computer virus infections remove them and successfully deal with the aftermath of the attacks. But most importantly, Violet makes it her priority to spend time educating people on privacy issues and maintaining the safety of their computers. It is her firm belief that by spreading this information, she can empower web users to effectively protect their personal data and their devices from hackers and cybercriminals.

    Leave a Comment

    We are here to help! Use SpyHunter to remove malware in under 15 minutes.

    Not Your OS? Download for Windows® and Mac®.

    * See Free Trial offer details and alternative Free offer here.

    ** SpyHunter Pro receives additional removal definitions and manual fixes through its HelpDesk in cases where they are needed.

    Spyware Helpdesk 1