Monthly Archives: June 2018

Scarab-Danger Ransomware

Scarab-Danger Ransomware belongs to Scarab Ransomware family. It is a threat that enciphers targeted files located on the infected computer and then displays a note saying the user has to pay a ransom if he wishes to get his data back. As you see recovering it on your own could be impossible if you do not have any backup copies. Nonetheless, we do not think it would be wise to pay these cybercriminals. It is entirely possible they may not bother to help even if they promise to do so once you send the requested sum. Therefore, to victims who are not prepared to risk losing their money for recovery of their data that might never happen, we can only suggest removing Scarab-Danger Ransomware. If you think it is the best option as well, we encourage you to have a closer look at the deletion instructions located below, but if you have not yet decided what to do, it could be a good idea to read the rest of this text and learn more about the malware in question. Read more »

gamingZone Search

gamingZone Search

Do not install gamingZone Search on your computer if you like the default search provider you use because this browser extension will alter it. No doubt some users install this piece of software consciously because it is promoted as a useful tool that allows users to search and play free online games without limitation. At the time of writing, there were 14 925 users who installed it directly from the Chrome Web Store, but we are sure the total number of users who have this extension active on their computers is higher because it can be downloaded from http://www.theappjunkies.com too. If you are among those users who have found gamingZone Search installed on their PCs, you have a right to know that it is not fully reliable software. We do not say that it is a malicious application, but we are 100% sure that it has certain features that make it a potentially unwanted application. One of the reasons it is considered potentially unwanted software is the fact that it might slither onto computers without permission. Additionally, it changes the default search tool on the affected web browser. Unlike serious malware, it does not try to hide the fact that it alters browsers’ settings. Read more »

Kingouroboros Ransomware

Kingouroboros Ransomware

Kingouroboros Ransomware might be a new version of a dangerous file-encrypting threat called CryptoWire Ransomware. Our researchers tell they noticed a lot of similarities in the malicious applications’ codes and their working manner. Of course, we will explain how the new infection works further in the text, so if you came here to learn all about this malware, you should read our full article. As usual, we do not advise contacting it’s developers or sending them money, even if their offered decryption tools could be the only way to get your data back. Keep it in mind, the hackers who created Kingouroboros Ransomware might have the needed decryption tools, but it does not mean they will be willing to provide them once you pay the ransom. In other words, for users who do not want to risk losing their money in vain, we advise deleting the malicious application. To remove it manually you could follow the instructions located below, and if you prefer automatic features, you could employ a legitimate antimalware tool instead. Read more »

StreamingOnlineWatch

StreamingOnlineWatch

StreamingOnlineWatch is a potentially unwanted program (PUP) targeted at users looking for tools to stream movies or similar content online. However, users should realize it is not the extension that streams the content, but the links it suggests. In other words, installing the add-on could be unnecessary. Instead, you could add the links you find useful to your browser’s bookmarks, and you could reach them just as fast as with the PUP. In any case, the main reason we do not think it is worth wasting any time with StreamingOnlineWatch is there is a chance the add-on might encourage users to browse with an untrustworthy search engine. If you keep reading our report you can learn more about this as well as how to get rid of this suspicious application. What’s more, to make this task easier we will place steps showing how to eliminate it at the end of this report. Read more »

CyberSCCP Cryptor Ransomware

CyberSCCP Cryptor Ransomware

CyberSCCP Cryptor Ransomware is an infection that was built to push you into communicating with cyber criminals and paying a ransom for a decryptor that would, allegedly, save your personal files. The infection is most likely to spread using spam emails with a misleading message that is meant to trick you into opening a corrupted file attachment or link. Note that both messages and the email addresses via which they are sent can be extremely misguiding, and you need to be careful. For example, if it appears that you have been sent a legitimate message from a postal service, you need to think if you are expecting a package. If you are not careful enough, you could execute the infection without even realizing it. Once executed, it can perform in a malicious way, and it was found that it can indeed encrypt your personal files. In this situation, you might be focusing on the decryption of your files, but we suggest redirecting your focus to the removal of CyberSCCP Cryptor Ransomware. You can learn all about that by reading this report prepared by Anti-Spyware-101.com researchers. Read more »

I Need Directions Now

I Need Directions Now

I Need Directions Now is an extension for Mozilla Firefox and Google Chrome users, and an application for Internet Explorer users. Although it offers services that might attract some users, our research team at Anti-Spyware-101.com classifies it as a potentially unwanted program; generally known as “PUP.” It does not look malicious, and its installer is free, which is why it is not surprising that many users choose to download it. Unfortunately, problems start showing up as soon as the installation is initiated. First of all, the tool might ask to change homepage and search provider settings. If you have the option to decline an unfamiliar search tool, you certainly should use it. Of course, you do not have the option to decline changes to your New Tab, as this is where the extension represents itself. Whether or not changes to your browser are welcome, you should delete I Need Directions Now, and we discuss this in depth in this report. If you are curious about why you should remove this extension/application or how to do it, you should continue reading. Read more »

Kwaaklocked Ransomware

Kwaaklocked Ransomware is not yet fully developed, but it seems it could be another malicious file-encrypting application based on an open source ransomware program known as Hidden Tear. Most of them were created the year the original Hidden Tear’s sample was uploaded (2015), but apparently, there are still some hackers who keep using this code to generate more infections. Further, in the text, we will discuss the threat’s possible distribution channels and explain what to expect if it enters your system. Of course, you will find tips on how to avoid malicious applications like Kwaaklocked Ransomware as well as how to get rid of this malware manually. However, we would like to stress that since the infection is still in the process of being developed it might change and it is difficult to say how accurate the instructions at the end of this article can be. Therefore, if you encounter this threat, it might be best to use a legitimate antimalware tool instead. Read more »

Donut Ransomware

Donut Ransomware

If you do not want to put your personal files at risk, Donut Ransomware is an infection you need to keep away from your operating system. Any careless click could let this malware in, which is why you need to be most cautious. For example, you should forget about interacting with spam emails. If you are not smart about it, you could let in all kinds of malware, including other well-known file-encrypting threats, such as Danger Ransomware, Scarab-Leen Ransomware, Autismlocker Ransomware, or BansomQare Manna Ransomware. If you are interested, all of these – and many others – infections have been reviewed by our Anti-Spyware-101.com research team. Once the infection slithers in silently, it immediately scans your operating system and encrypts files. Although the threat evades all system files, as well as some specific files (“autorun.inf,” “boot.ini,” “bootsect.bak,” “desktop.ini,” “iconcache.db,” “ntuser.dat,” “ntuser.dat.log,” and “thumbs.db”) regardless of their location, it does not ignore what we call “personal files.” You can save them only if you delete Donut Ransomware in time, and, unfortunately, it is most likely that you have found this removal guide because your personal files got encrypted already. Read more »

Crybrazil Ransomware

Crybrazil Ransomware

If you live in Brazil or speak Portuguese, Crybrazil Ransomware is an infection that is specifically targeted at you. The installer of this dangerous infection could be dropped using remote access or introduced to you as a harmless spam email attachment. Other methods could be employed to spread this malware as well. Our Anti-Spyware-101.com research team has found that the infection was built using the infamous Hidden Tear source code. We have reviewed hundreds of other infections (e.g., Cyberresearcher Ransomware) that have been built using the same code and spread in similar ways. Although all of these threats have unique features, they function in the same ways. For one, they were all created to terrorize Windows users, hijack their files, and demand huge ransom fees in return for decryptors and decryption keys. In some cases, free decryptors are released by malware researchers, but one that would work with this malware did not exist at the time of research. All in all, whether or not you decrypt your files, you must delete Crybrazil Ransomware as soon as possible. The removal tips we have for you will surely help. Read more »

Danger Ransomware

Danger Ransomware does not meet us with anything new. If anything, our research team suggests that this program is just a version of a previously released infection. So it will exhibit the same behavioral patterns as its predecessors. On the other hand, although it should be easier to deal with an infection when you know what it is up to, we cannot say that about ransomware programs. That is because each ransomware application is unique, and so while we can apply similar methods to remove Danger Ransomware, they will not work for the file decryption. That is perhaps the most frustrating part about ransomware infections. Read more »