Monthly Archives: February 2018 - Page 9

A scareware infection named PornBlackmailer has made its headlines in January 2018 when an online forum user created a post about a malicious .scr file reportedly downloaded from the free pornography website Xvideos. The PornBlackmailer ransomware blackmails victims to pay a fee so that they are not reported to the police about the use of pornographic material involving children.

It is still not specified whether the name of the infection PornBlackmailer is the right name for the threat, because the string "HowSexWithDolls" found in the codes of different variants of the threat suggests that this could be another name to use.

The PornBlackmailer ransomware differs from conventional ransomware infections that encrypt files and show the victim a ransom note in full screen or a program window. The PornBlackmailer does not tamper with the victim’s files but uses other scare tactics to extort money from the unsuspecting user. The infection should be removed immediately after being spotted, and you should also keep in mind that the threat resides on the computer even if no ransom notification is displayed after restarting the computer. The threat does not create its point of execution, which means that it does not start at every system startup, but that does not change the fact that it is necessary to remove PornBlackmailer. Read more »

Gh0st RAT was a threat involved in the operation called GhostNet back in 2008. GhostNet is the name of the network consisting of both compromised computers and C&C servers. Users initiated the installation of Gh0st RAT themselves by opening a phishing email and clicking on a malicious URL inside it, which when clicked, connected the user to the C&C server and downloaded a dropper. The dropper then connected to the C&C server once again and downloaded this Trojan. Infected computers were considered a part of GhostNet. Specialists say that Gh0st RAT infected 1295 computers in 103 countries. Among its victims were diplomatic, political, and military institutions. It is hard to say whether GhostNet is still active, but researchers are sure that users might still discover Gh0st RAT on their PCs if they keep them unprotected because the builder of this Trojan is available for download at GitHub (https://github.com/sincoder/gh0st). It might be downloaded by anyone and then used for various malicious purposes. Specialists say that this infection will not act the same in all the cases because cyber criminals might customize it to fit their needs. Consequently, it might be harder for users to detect it, especially when it infiltrates users’ computers without their knowledge and performs all its malicious activities in the background. Read the rest of this article to find out what it is capable of and how to erase this infection fully from the system. Read more »

Scarabey Ransomware is not a program, which should never be up and running on your personal computer. In fact, we highly advise you to delete it if it is ever found up and running on your operating system. Doing so is critical because this malicious piece of software can act in an incredibly devious manner. If you are not familiar with ransomware programs, you must know that this category of applications can easily encrypt a massive amount of data stored on the affected computer without any notification or authorization. As you can imagine, having such program will have devastating outcomes, to put it lightly. Learn more about the inner workings of this malicious program by reading this report entirely. Additionally, we provide a few virtual security tips that will help you maintain a clean and secure system at all times. Finally, to help you delete Scarabey Ransomwareonce once and for all, we include a detailed removal guide that you can find below. Read more »

Most likely, you have found this report and started reading it because you have already discovered Yoshikada Ransomware on your computer. This is a new crypto-threat, but it does the same job as many other ransomware-type infections. That is, this nasty infection locks users’ personal files right away after slithering onto their computers without their knowledge. A motive behind this activity is only one – to obtain money from users. If this threat has already entered your system without your knowledge, and locked your files, you should be able to find a new file on your computer. This file is a ransom note. You might not find the exact amount of money you have to send to cyber criminals indicated in it, but you will find out that you need to purchase the special decryptor from cyber crooks so that you could unlock those encrypted files. If you do not know what to do, we want you to know that we do not recommend transferring money to crooks no matter how much money they ask. It is unclear whether you will get the tool you pay for. Cyber criminals might change their minds and not give it to you. In this case, you could only blame yourself because nothing else could be done. In addition, if you send money to them, they will realize that it is worth spending time on the development of malware. Consequently, you might encounter new harmful threats in the future. Read more »