Monthly Archives: November 2018

Matrix-THDA Ransomware

Matrix-THDA Ransomware

Matrix-THDA Ransomware is a threat that drops a text file claiming the user’s files were encrypted because of some server vulnerabilities. The cybercriminals not only claim they can provide the necessary decryption key and decryption software but also offer to help the victim to secure the server/system. However, we would not recommend trusting them as no matter how friendly and polite the ransom note may appear to be, in reality, there are no reassurances they will hold on to their end of the deal. Therefore, what we recommend to those who encounter the malware is deleting it. We believe it is safer to recover files from backup copies. Not to mention, using backup files would be cost-free as Matrix-THDA Ransomware’s creators may ask for a ransom. If you want to learn more before coming up with a decision you should read the rest of this report. For those who have already decided we would suggest completing the steps listed below the article. Read more »

Yourhope@airmail.cc Ransomware

Yourhope@airmail.cc Ransomware

One more ransomware infection - Yourhope@airmail.cc Ransomware - has been recently detected in the wild by specialists working at anti-spyware-101.com. They have immediately understood what it is capable of because research has clearly shown that this threat is a brand new variant of Scarab-Bomber Ransomware, a crypto-threat analyzed by specialists not long ago. Speaking more specifically, there is no doubt that this ransomware infection has been developed by cyber criminals to obtain money from users. One of the tactics used to push users into transferring money is locking their personal files. The ransomware infection tries to convince users that their files have been locked due to a security problem, but we can assure you that the main problem you have is the successful entrance of Yourhope@airmail.cc Ransomware. No worries; you will erase this threat yourself manually with our help. Sadly, we cannot promise that it will be very easy to unlock files encrypted by this threat. Paying money to cyber criminals is definitely not what we suggest that you do, but you need to know the truth – there might be no other ways to get files back. This is especially true if you have never backed up any of your files. Read more »

GamingHub

GamingHub

Would you call yourself a gamer? If you would, it is likely that you have used applications and extensions to satiate your desires already. GamingHub is an extension designed for Google Chrome users, who are interested in playing games online. If your gaming console and your mobile phone are not enough, an extension that offers to play games directly from your web browser might seem like the perfect addition. Unfortunately, although the application is presented in a highly attractive manner, you should think twice before you decide to trust it. Once you install it, data-tracking tools will be activated to monitor your activity. Since the PUP (potentially unwanted program) does that silently, and it might appear to be quite useful to some, not everyone will rush to delete GamingHub. So, should you remove this extension or should you just ignore the security risks and enjoy the services it provides? Continue reading to find out. Read more »

NetMeterX

NetMeterX

NetMeterX is a PUP or a potentially unwanted program to be more precise. Even though such applications are not considered to be harmful or malicious, users should still be extra cautious with them. While the tool itself might be harmless, it could have annoying qualities or might introduce you to potentially dangerous content, for example, unreliable third-party advertisements. Therefore, before placing such software on the system, it is essential to learn all about it, which is why further in this article we will tell you more about NetMeterX. Our researchers do not recommend taking any chances with it, and so at the end of this page, you can find instructions explaining how to remove the PUP manually. Also, if you have any questions, keep in mind you can leave us a message below the article. Read more »

Scrabber Ransomware

Cyber criminals have not stopped developing new ransomware infections on the HiddenTear engine yet because Scrabber Ransomware, a new HiddenTear-based ransomware infection, has been spotted in the wild by malware researchers. It seems that the ransomware infection targets both Russian and English-speaking users because it drops a ransom note in both languages after encrypting users’ personal files. At first glance, it acts as an ordinary ransomware infection; however, unlike ordinary computer threats, it seems that it does not demand money from users who fall victim to it. It only asks them to send a PC name and a user name (these are the same unless there is more than one PC user created). We cannot promise that your files will be unlocked once you do so even though the message dropped on victims’ computers claims that the ransomware infection has not been developed to obtain money from users: “We are not scammers and do not pursue the purpose of collecting money, do not file a complaint against us, please’ (taken from the English version of the ransom note dropped). Cyber criminals will not remove Scrabber Ransomware from the system for you either – you will have to do so yourself. No matter what you decide to do, i.e. whether or not you send the PC/user name to the ransomware developer, do not forget that you must fully remove this infection no matter what. Read more »

Epoblockl Ransomware

Epoblockl Ransomware

Epoblockl Ransomware is a computer infection that can encrypt user and system files. This seems to be one of the many random infections that have been terrorizing users lately. The ransomware program is not prominent enough to draw attention from the media, but it doesn’t mean it is any less dangerous than the notorious WannaCry Ransomware. The bottom line is that you must remove Epoblockl Ransomware from your computer immediately, and by doing so, you have to ensure that similar intruders to do not enter your PC again. Please bear in mind that some of the infection’s consequences might not be reverted. Read more »

LoJax is the First UEFI Rootkit, and It Is a Highly Sophisticated Threat

Do you know what kind of malware might persist even if the infected operating system is reinstalled and the hard disk is replaced? It is UEFI (Unified Extensible Firmware Interface) rootkits. In the past, these rootkits were detected only in internal labs controlled by malware researchers, but LoJax has changed the history. It is the first UEFI rootkit to have been found in the wild. Intel created UEFI to replace BIOS (Basic Input/Output System), and all chipsets should use it by 2020. Unfortunately, that means that anyone could become the target of this malware. The rootkit was found to communicate with C&C servers that belong to Sednit, a well-known cyber-espionage group that is also known by other names, including Fancy Bear, PT28, Sofacy, and Strontium. This group has been active since 2004, and it is known for attacking government-level agencies and organizations. Read more »

Scarab-DD Ransomware

Scarab-DD Ransomware

Scarab-DD Ransomware shows a warning claiming the threat’s victims must contact the malicious program’s developers if they want to get their files back. As you see, the malware encrypts various data with a secure encryption algorithm, which is why once affected it cannot be opened without decryption tools. It is understandable some users might be thinking about complying with the hacker’s demands, but we do not believe it would be wise to do so. After writing to the cybercriminals, you could receive instructions on how to pay a ransom. Needless to say, there are no reassurances these people will hold on to their promises, which means you may lose your money in vain. Because of this we advise erasing the malware and restoring files from backup copies if you have any. To learn how to eliminate Scarab-DD Ransomware manually, you should take a look at the instructions placed below this report. As for more information on the threat's working manner or distribution, you should review the rest of the article. Read more »

LightSpeedPC

LightSpeedPC

LightSpeedPC is a potentially unwanted program (PUP), which suggests that it should not be trusted. This category means the application might have unwanted qualities and could be unreliable, but it does not mean it is malicious or dangerous. Another thing you should know is even though the tool’s creators may claim the software can clean the system and visibly improve the computer’s performance, our specialists say it is rather unlikely. Apparently, the issues that the application detects and blames for the system’s slow performance may not be the cause after all. In which case, using the PUP might not bring the results you wanted to achieve. Consequently, we would recommend not to leave the tool unattended and erase it. To delete LightSpeedPC manually, you should have a look at the instructions placed at the end of the article. On the other hand, if learning about the software is of the same importance to you, we encourage you to read our article first. Read more »

InstallCore

InstallCore

InstallCore is an installer that might have been used to carry in the application you downloaded most recently. It is not surprising if you are not familiar with the name because it is not always displayed, and you might be more interested in the names of the programs represented via the installer. It was not built for the distribution of one specific program or for the use of one specific software developer. It was created to help with the distribution of software and make the process much easier, and various different parties can use it. While many Windows users can download legitimate and reliable programs using the installer in question, Anti-Spyware-101.com research team warns that unreliable installers could be used too. If you do not want to encounter them, you have to stay vigilant and perform thorough research every time you download something new. Otherwise, you might realize soon that you need to delete InstallCore-linked threats. Before you continue reading, immediately perform a full system scan using a trusted malware scanner. Read more »