Anti-spyware 101

HappyLocker Ransomware is a malicious program that appends an extension called .happy to its encrypted files. As our researchers at Anti-spyware-101.com report, the malware can encipher a broad range of file types, although it does not seem to affect any program data. If you suspect your computer could be infected with this particular threat, we advise you to carefully read through all the rest of the article and find more details about it. Also, if you would like to get rid of HappyLocker Ransomware manually, but do not know how we could offer our deletion instructions placed at the end of the article. As for not so experienced users, it might be easier to install a legitimate antimalware tool and let it remove the malware. Read more »

GPCode Ransomware is very similar to already existing ransomware infections encrypting files the way it acts; however, unlike the majority of older threats, it targets Windows Servers primarily. Once this infection is inside the system, it starts encrypting files the same second. It affects files located in different directories on the computer, but, luckily, it leaves the %WINDIR% directory containing system files alone. It means that the OS running on the computer will not be ruined. Even though you could reach your Desktop, you will find your programs and browsers (Mozilla Firefox and Google Chrome) encrypted next to personal data as well. Unfortunately, GPCode Ransomware uses a strong encryption algorithm (AES for personal files and RSA for the key), so it will be impossible to unlock those files without paying money for cyber criminals. Yes, you will be asked to pay a ransom after sending an email to gpcode@gp2mail.com, as told in the ransom note left on Desktop, folders containing encrypted files, and %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup (the ransom note is placed there so that it will be opened automatically for users on the startup of the system). Read more »

The entrance of a malicious application iRansom Ransomware means that a bunch of personal files stored on the computer will become unusable. Even though this infection was first detected at the beginning of November 2016 and is quite new, it also encrypts files like older ransomware infections. Just like these other threats, it does that so that it would give users a reason to pay money cyber crooks want from them. If you have got infected with this ransomware infection too, do not transfer money to cyber criminals even though it is said that purchasing the private key “stored on a hidden Internet database” is the only way to unlock files. What you should do instead of buying the key is to fully delete the ransomware infection from the system. Even though these personal files will stay encrypted, iRansom Ransomware could not encrypt new files you create in the %USERPROFILE% directory again. Also, the blue window with a ransom note will no longer be visible on Desktop. Read more »

Telecrypt Ransomware is a malicious threat that targets your personal files to encrypt them and, eventually, demand a ransom in return for their release. This devious infection is targeted at users who live in Russia (possibly the neighboring countries where Russian is spoken as well), and, of course, all information it provides is in Russian. The primary source of communication for this threat is a three-part notification that is represented via a pop-up window. It does not lock the screen, and you can easily close it by clicking the “X” button on the top-right corner. According to the information in this notification, you need to pay a ransom to have your files back, and we will discuss this notification in depth further in this report. Right now, we need to tell you that you must focus on this threat completely. The longer you postpone dealing with it, the more trouble you might get yourself into. You can read this report to learn if you can delete Telecrypt Ransomware from your operating system yourself, as well as what you can do to potentially retrieve your personal files. Read more »