Threats - Page 122 category archyve:

Cyber Police Ransomware shows a message claiming it enciphered user’s data because of his illegal activities. Our researchers at Anti-spyware-101.com say it is nothing more than a harmful program developed to extort money from inexperienced users. Consequently, if you come across it, we advise you to consider all options carefully. The malicious program’s creators could promise to deliver decryption tools once you pay the requested ransom, but there are no guarantees these hackers will keep up with such promises. To put it simply, there is a chance you might lose not just your files, but also some of your money. For users who would like to avoid such a scenario, we recommend erasing Cyber Police Ransomware with the instructions located below this text. As for those who wish to learn more about the malware first; we encourage reading the rest of the article. Read more »

Wannasmile Ransomware belongs to the group of crypto-malware, so it will encrypt your entire hard drive if it ever infiltrates your computer. This threat will affect your .jpeg, .docx, .rtf, .xlsx, .ppt, .mrw, .odb, .ods, .p7b, .wmv, .zip, .7z, .mp4, .avi, and a bunch of other files. No doubt the file you are trying to open belongs to the group of encrypted data if you cannot open it, and you see a new extension .WSmile appended to it. You will be told that you could unlock your files with the special decryptor after you purchase it from cyber criminals, but you should not fall for this. Nobody knows whether cyber criminals behind this infection will still be willing to share the decryptor with you after receiving a ransom you send to them, so we recommend that you do not spend your money on it. Instead, you should delete the ransomware infection from your computer right away. If you leave this infection active on your computer, it might encrypt even more files on your system because it has a point of execution and starts working automatically on system startup. That is, it scans the system with every new launch and encrypts those files that are not locked yet. We will talk about its removal in detail in the last paragraph. Read more »

If all pictures, videos, songs, slides, and other files that belong to you have been marked by the .nightmare extension, Foxy Ransomware must have infiltrated your computer. It is another HiddenTear-based ransomware infection, so our specialists have not found it surprising at all that it acts the way it does, i.e. goes to lock files on compromised machines the first thing. All ransomware infections act similarly – they make it impossible to access files so that cyber criminals behind them could have a chance to obtain easy money from users. At the time of writing, Foxy Ransomware was not a very prevalent threat if compared to similar ransomware-type infections, but it does not mean that it cannot become popular over time, so you should take all security measures to prevent it from entering your system. If it is already too late for prevention, i.e. you have already encountered this threat, you should delete it from your computer right away because the ransomware infection creates a copy of itself in %TEMP%, and you might accidentally launch it again one day. In this case, your files will become encrypted again. Once all components of Foxy Ransomware are erased from your system, you could restore your files. Unfortunately, free decryption software does not exist. Cyber criminals will not give you the special decryption tool to you for free either, so the only thing you can do is to restore these encrypted personal files from a backup. Read more »

Finding Relec Ransomware on your system may not cause severe devastation yet since this ransomware infection is not fully operational at the moment. As a matter of fact, our malware experts at anti-spyware-101.com say that this is an open-source educational project just like Hidden Tear Ransomware was originally. This ransomware program was coded in C++ and does have the capability of encrypting your files; however, this version does not do so. So if you have been infected with this sample, chances are your files have not been affected by this ransomware infection. Learning from the Hidden Tear spin-off cases, we can surely say that there will be more and more variants emerging as hackers and wannabes can both use it as a good base for their malicious attacks. We recommend that you regularly save a backup of your important files to cloud storage or a removable drive so that you can use these clean copies if the nightmare hits you. We advise you to remove Relec Ransomware even if right now it may not be as dangerous as it may soon become. Read more »

Goofed Ransomware is another malicious application based on an open source ransomware known as Hidden Tear. The malware got its name from the extension it appends to its enciphered data, for example, sky.jpg.goofed. If some of your files on the computer where marked by this extension too, we advise you to keep reading this article and learn more details about the threat. As you may already realize, the malicious application’s purpose is to take user's files as hostages, and by creating such an infection, its developers are hoping they will be able to extort money from their victims. Paying the ransom is not something we would advise you to do even if the sum does not look huge or the malware encrypts important data because there is not knowing if its developers will keep up to their promises. In other words, you could be left with nothing. Users who choose to delete Goofed Ransomware instead could follow the instructions available below the text. Read more »

The malicious Cobra Ransomware is not like most other file-encryptor. Just like most threats of this nature, it encrypts personal files, such as photos, archives, or documents, but it also goes on to encrypt files that belong to programs. These, of course, are much easier to replace, but that still can create problems. When files are encrypted, the “.id-.[cranbery@colorendgrace.com].cobra” extension is added to their names, and so it is impossible for you to miss the ones that were hit. Unfortunately, removing the extension from files will not help you recover your files. You will also be unable to recover files if you rely on shadow volume copies because the ransomware erases them using the “vssadmin delete shadows /all /quiet” command. Third-party decryptors that would help in this situation do not exist either. Basically, there is nothing anyone can do to help you recover the encrypted files. Unfortunately, the cyber crooks behind this threat will dangle a decryptor in front of your nose using the ransom note, and instead of focusing on that, you need to focus on the removal of the threat! Read more »