Monthly Archives: August 2017

WininiCrypt Ransomware is a vicious file-encrypting malware that is after user’s files and even their shadow copies. As a result, the malicious application’s victims may receive a lot of damage, and there might be no way to undo it. In this article, we will present more details about the threat, for example, how users could infect their systems with it, so if you wish to know this malware better, you came to the right place. Moreover, our researchers at Anti-spyware-101.com have prepared deletion instructions to guide users through the removal process. Thus, users who have no idea how to deal with WininiCrypt Ransomware manually, should not hesitate to use these steps. On the other hand, if the task looks quite difficult, it might be best not to take any chances and employ a legitimate antimalware tool. Read more »

Cyron Ransomware can infect your computer by stealth and then encrypt many of your files with an AES encryption algorithm. Its creators want you to pay 50 Euros, which means that this program was created to be distributed in the Eurozone countries in Europe. We recommend not wasting your time trying to pay the ransom because you might not get the promised decryptor/decryption tool, so you might also lose your money. For this reason, we advise that you remove this program as soon as you can. To find out more about it, please read this whole article. Read more »

A new ransomware infection has been discovered by our research team, and it goes by the name Kappa Ransomware. By the time you are reading this, the malicious ransomware might have been unleashed already, and your personal files might have been encrypted, but at the time of our research, this threat was still in development stages. The sample that our Anti-Spyware-101.com malware researchers have tested had a fully functional encryption and decryption algorithm, and it could connect to a remote server to transfer certain information. It was found that the threat could record technical details about the infected computer, and some of it could be used to create the so-called Client ID. It was found that this ID is a combination of the MAC Address and the Processor ID, as well as the Hard Drive serial number. This ID is sent to a remote server (http://185.106.120.162/key/key.php?hwid=) along with the encryption key that is used for the corruption of files. Also, you are introduced to this ID via a window that the infection launches right after the encryption is complete. Unfortunately, your files will remain encrypted if you delete Kappa Ransomware, but, of course, removing this threat is crucial. Read more »

Ransom Prank Ransomware is not a program that you want to have fully active on your personal computer. If unfortunately, this intrusive application is already active on your PC, make sure to execute its complete removal right away. It is critical to do so because this program, like a lot of other applications classified as ransomware, might be capable of locking vast quantities of data in just a few moments. It goes without saying that due to such functionality you might have to face disastrous outcomes. For further information regarding the overall functionality of this intrusive program, make sure to read the rest of our detailed report. Besides all of that, you will also find a few virtual security recommendations to help you avoid various suspicious and malicious programs. Finally, to delete Ransom Prank Ransomware in just a few simple steps, make sure to follow the detailed instructions that we present below. Read more »

Aac Ransomware is a new variant of the NMoreira Ransomware infection that was discovered last year. It is believed that both infections were created by the same cyber criminal or group of cyber criminals, but there is no denying that they have many differences. For example, the original ransomware was found to remove itself after the encryption was complete, appropriate registry keys were added, and the ransom note file was created. Our Anti-Spyware-101.com research team has not observed this to be the case with the newer variant. Also, the messages hidden in the launcher file are different. The first original one was specifically addressed to the malware research community, while the new ransomware has a message for researchers who managed to decrypt NMoreira Ransomware. At the time of research, a decryptor that would work with the new version of the threat did not exist, and it is possible that it will not be developed at all. While the decryption of files might be impossible, deleting Aac Ransomware is something anyone can handle, and that should be done sooner rather than later. Read more »