• Tag Archives Local Virus removal

  • New file-encrypting ransomware called CryptoGraphic Locker

    Posted on by admin Comment

    A new file-encrypting ransomware was discovered today by BartBlaze called CryptoGraphic Locker. Just like other encrypting ransomware, this infection will scan your your data files and encrypt them so that they are unusable. The infection will then display a ransom note that requires you to purchase the decryption key in order to decrypt your files. The initial cost to purchase the key is .2 BTC, or approximately $100 USD, which makes this one of the cheaper ransoms that we have seen in a long time. Though the ransom starts out small, there is a 24 hour timer built into the application that will increase the ransom amount each time it hits 0.

    Computer Virus Removal in Fort Lauderdale
    Cryptographic Locker

    When you are infected with CryptoGraphic Locker, the application will configure itself to start when you login to Windows. It will then scan your drives for data files and create new encrypted copies using AES encryption and then delete the old ones. These new files will be renamed to have the extension .clf. A list of all encrypted files will be stored in the %Temp%\CryptoLockerFileList.txt file. The data files that CryptoGraphic Locker targets are:

    .odt,.ods,.odp,.odm,.odc,.odb,.doc,.docx,.docm,.wps,.xls,.xlsx,.xlsm,.xlsb,.xlk,.ppt,.pptx,.pptm,.mdb,.accdb,.pst,.dwg,.dxf,.dxg,.wpd,.rtf,.wb2,.mdf,.dbf,.psd,.pdd,.pdf,.eps,.ai,.indd,.cdr,.dng,.3fr,.arw,.srf,.sr2,.mp3,.bay,.crw,.cr2,.dcr,.kdc,.erf,.mef,.mrw,.nef,.nrw,.orf,.raf,.raw,.rwl,.rw2,.r3d,.ptx,.pef,.srw,.x3f,.lnk,.der,.cer,.crt,.pem,.pfx,.p12,.p7b,.p7c,.jpg,.png,.jfif,.jpeg,.gif,.bmp,.exif,.txt

    When the infection has finished encrypting your data it will display a ransom screen that explains how you can pay the ransom and decrypt your files. Unlike other file-encrypting ransomware that have been released lately, instead of using a decryption site, the malware application itself allows you to make payments, receive your decryption keys, enter your key to decrypt files, etc. While the infection is running it will also terminate the following applications if they are started or are running: Process Hacker, MalwareBytes, Spyhunter, Msconfig, Task Manager, Registry Editor, System Restore, or Process Explorer.

    Last, but not least, the infection will also change your Windows desktop background to the background below. Suprisingly, it uses the CryptoLocker name in the wallpaper instead of the CryptoGraphic Locker name that it uses in the application window.

    wallpaper.jpg

    At this time the Command & Control servers are down, so there is no way to pay the ransom. There is, though, some good news for those who are infected. This ransomware does not delete files using a secure deletion method and does not wipe your system restore points. Therefore you can use a file recovery tool to undelete your files or a program like Shadow Explorer to restore your files from Shadow Volume Copies. Information on how to restore your files from Shadow Volume Copies can be found in the CryptoLocker guide.

    Thanks to BartBlaze, Decrypterfixer, and Cody Johnston for providing info on this malware.

    File additions and registry changes are:

    %Temp%\CryptoLockerFileList.txt
%Temp%\wallpaper.jpg
<Path to Dropper>\<random.exe

HKCU\Control Panel\Desktop\Wallpaper	"C:\Users\User\AppData\Local\Temp\wallpaper.jpg"(old value="")
HKCU\Control Panel\Desktop\WallpaperStyle	"1"(old value="10")
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\CLock

    Please Visit our Computer News Website and Blog

    for latest computer repair and online news.

    Local and Online Virus removal and computer repairs anytime, anywhere

    Fort Lauderdale, Miami, Boca Raton, Boynton Beach and all South Florida

    Greased Lightbox

    →←+–↻

    Loading image

    Click anywhere to cancel

    Image unavailable

    Greased Lightbox

    →←+–↻

    Loading image

    Click anywhere to cancel

    Image unavailable


    📂This entry was posted in Virus Threats 📎and tagged

  • Virus Removal Tech In South Florida Miami, Fort Lauderdale and Boca Raton

    Posted on by admin Comment

    Virus Removal In Miami and Fort Lauderdale

    Professional Computer Repair, Virus Removal Authorized Center

    Computer Repair and Laptop Repair Maintenance fort lauderdale miramar miami boca raton hollywood north miami beach miami gardens davie weston
                                             
    PC and Apple Computer Repair Online Anytime, Anywhere
     

    Maintenance                             Small Business

    Computer Repair                                           Onsite Services

    Online Virus Removal, Laptop Screen Repair, Motherboard Repair Specialist technician for

    Acer Laptop – TravelMate, Extensa, Ferrari, Aspire One  Apple Computer – MacBook, MacBook Air, MacBook Pro, Imac G4 G5 Ibook
    Dell Laptop – Inspiron, Latitude, Precision, Studio, Vostro, XPS, Studio XPS, Alienware Mini Legacy System Adamo
    Asus Laptop – Asus Eee, Lamborghini Fujitsu – LifeBook, Stylistic  Lenovo Laptop Repair – ThinkPad, IdeaPad, 3000, IBM
    Compaq Computer – Armada, Concerto, Contura, Presario, ProSignia, LTE, Mini, EVO, SLT and many More.
    HP Laptop Repair – Hewlett-Packard, HP Pavilion, HP Omnibook Envy EliteBook ProBook   Sony LaptopRepair – VAIO Series
    Gateway Laptop Repair – Solo & Pro Series   Toshiba Laptop Repair – Dynabook, Portege, Tecra, Satellite, Qosmio, Libretto
    MSI laptops – Micro-Star International, Megabook, Wind   Samsung Computer Repair – Sens, eMachines, Pro

    Laptop Repair Macbook Pro Air Computer Repair
    Do you have a Broken laptop screen? Cracked Screen? Dim Screen? Dark Screen? Color lines on screen? We fix it in 20 minutes. We have the Best Top technicians in South Florida, Local computer tech and service in your area call Today.

    Let us help keep your PC or Apple computer personal and business data safe from cyber thieves and organizations that could hold your data hostage online, making it unreachable to you until you pay a fee or purchase a bogus software package. You don’t have to visit questionable websites or participate in torrent file sharing to acquire computer viruses. New viruses and malware exploits are being put in place every day in the hopes that you will make the mistake of visiting an infected website by opening a questionable file or e-mail. We will provide you with professional and reliable laptop computer repair services, Call for a store near you.

    * Lower prices than best buy geek squad computer repair stores, tiger direct, compusa computer repair department, office depot computer repair stores, office max computer repair store, staples and any other major computer repair store chain in south florida. We crush our competitors with free in home service, lowest prices, in stock parts and super fast speedy same day service. We are rated 5 star and listed on the top 10 best computer repair companies in the south florida area. Please check our customer reviews and ratings on Google Places,Yelp, Bing, Yahoo and google maps. Satisfaction guaranteed.


    📂This entry was posted in Computer Repair bulletin 📎and tagged

  • Certain DevianArt advertising Campaigns lead to Malware, Spyware and Unwanted Applications on your computer

    Posted on by admin Comment

     

    DeviantArt Malwaretising

     

    Today, the estimated number of known computer threats like viruses, worms, backdoors, exploits, Trojans, spyware, password stealer, and other variants of potentially unwanted software range into millions. It has the capability to create several different forms of itself dynamically in order to thwart antimalware programs.

    Users of the biggest online artwork community, DevianART with Global Alexa Rank 148, are targeted by the potentially unwanted software programs — delivered by the advertisements on the website, Stop Malvertising reported on Sunday.

    A Potentially Unwanted Application (PUA) is a program that may not be intentionally malicious, but can negatively affect the performance and reliability of the system by distributing spyware or adware that can cause undesirable behavior on the computer. Some may simply display annoying advertisements, while others may run background processes that cause your computer to slow down. However, unlike malware, users themselves consent to install a PUA into their systems.

    The malicious advertisements are delivered via newly registered (3rd March 2014) domains – Redux Media (www.reduxmedia.com) and avadslite.com. “Over the past months, this domain has been seen to resolve to the following IP addresses: 107.20.210.36 (2014-05-01), 54.243.89.71 (2014-05-01) and 184.170.128.86 (2014-05-25). According to VirusTotal, malware has communicated with the last two IP addresses.” Kimberly from Stop Malvertising said.

    Once the user click on the Ad served by the DevianArt website, they are redirected to the Optimum Installer, a source of Potentially Unwanted Applications (PUA’s) that downloads legitimate software applications as well as bundled third-party software including toolbar.

     

    malware ad

    As shown, a pop-under warning will urge users to “update Media Player“, immediately followed by a second advertisement to “update Windows 7 Drivers” to avoid vulnerabilities, reduce crashes and ensure an optimal browsing experience. This is just a scam nothing more or less.

    Obviously, these are well known social engineering techniques to trick the computer user into installing malicious or ad-support software. Such infection are designed specifically to make money, generate web traffic, and will display advertisements and sponsored links within your web browser.

     

    Please Visit our Computer News Website and Blog

    for latest computer repair and online news.

    Local and Online Virus removal and computer repairs anytime, anywhere

    Fort Lauderdale, Miami, Boca Raton, Boynton Beach and all South Florida


    📂This entry was posted in Virus Threats 📎and tagged

  • Zeus Trojan (or Zbot Trojan) steals confidential information from the infected computer.

    Posted on by admin Comment
    Pandemiya hacking trojan

    A new and relatively rare Zeus Trojan program was found which is totally different from other banking Trojans and has capability to secretly steal data from forms, login credentials and files from the victim as well as can create fake web pages and take screenshots of victim’s computer.

    Researchers at RSA Security’s FraudAction team have discovered this new and critical threat, dubbed as ‘Pandemiya’, which is being offered to the cyber criminals in underground forums as an alternative to the infamous Zeus Trojan and its many variants, that is widely used by most of the cyber-criminals for years to steal banking information from consumers and companies.

     

    The source code of the Zeus banking Trojan is available on the underground forums from past few years, which lead malware developers to design more sophisticated variants of Zeus Trojan such as Citadel, Ice IX and Gameover Zeus.

     

    But, Pandemiya is something by far the most isolated and dangerous piece of malware as the author spent a year in writing the code for Pandemiya, which includes 25,000 lines of original code written in C.
    Like other commercial Trojan, Pandemiya infect the machines through exploit kits and via drive-by download attacks to boost infection rate that exploit flaws in the vulnerable software such as Java, Silverlight and Flash within few seconds victim lands on the web page.

    Pandemiya’s coding quality is quite interesting, and contrary to recent trends in malware development, it is not based on Zeus source code at all, unlike Citadel/Ice IX, etc.,” researchers from RSA, the security division of EMC, said Tuesday in a blog post. “Through our research, we found out that the author of Pandemiya spent close to a year of coding the application, and that it consists of more than 25,000 lines of original code in C.

    Pandemiya Trojan using Windows CreateProcess API to inject itself into every new process that is initiated, including Explorer.exe and re-injects itself when needed. Pandemiya is being sold for as much as $2,000 USD and provides all the nasty features including encrypted communication with command and control servers in an effort to evade detection.The Trojan has been designed with modular architecture to load more external plug-ins, which allows hackers to add extra features simply by writing new DLL (dynamic link library). The extra plug-ins easily add capabilities to the Trojan’s core functionality, that’s why the developer charge an extra of $500 USD to get the core application as well as its plugins, which allows cybercriminals to open reverse proxies on infected computers, to steal FTP credentials and to infect executable files in order to inject the malware at start up.

     

    The advent of a freshly coded new trojan malware application is not too common in the underground,” Marcus writes, adding that the modular approach in Pandemiya could make it “more pervasive in the near future.

    The malware developers are also working on other new features to add reverse Remote Desktop Protocol connections and a Facebook attack module in order to spread the Trojan through hijacked Facebook accounts.

    HOW TO REMOVE PANDEMIYA TROJAN

    The Trojan can be easily removed with a little modification in the registry and command line action, as explained below:

      1. Locate the registry key HKEY_LOCAL_USER\Software\Microsoft\Windows\CurrentVersion\Run and identify the *.EXE filename in your user’s ‘Application Data’ folder. Note the name, and delete the registry value.
      2. Locate the registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls. Find the value with the same name as the *.EXE file in the previous step. Note the file name, and remove the value from the registry.
      3. Reboot the system. At this stage Pandemiya is installed but no longer running. Delete both files noted earlier. This will remove the last traces of the Trojan. Your system is now clean.

    Please Visit our Computer News Website and Blog

    for latest computer repair and online news.

    Local and Online Virus removal and computer repairs anytime, anywhere

    Fort Lauderdale, Miami, Boca Raton, Boynton Beach and all South Florida


    📂This entry was posted in Virus Threats 📎and tagged

  • Cryptowall Ransomware Spreading on the internet rapidly through advertisements

    Posted on by admin Comment
    Cryptowall Lock Malware spyware spreading
    Cryptowall Lock Malware

     

    Ransomware is an emerging threat in the evolution of cybercriminals techniques to part you from your money. Typically, the malicious software either lock victim’s computer system or encrypt the documents and files on it, in order to extort money from the victims.

    Though earlier we saw the samples of Ransomware tended to be simple with dogged determinations to extort money from victims. But with the exponential rise in the samples of Ransomware malwares, the recent ones are more subtle in design, including Cryptolocker, Icepole, PrisonLocker, CryptoDefense and its variants.

    Now, the ransomware dubbed as Cryptowall, a latest variant of the infamous ransomware Cryptolocker is targeting users by forcing them to download the malicious software by through advertising on the high profile domains belonging to Disney, Facebook, The Guardian newspaper and others.

    Cryptolocker is designed by the same malware developer who created the sophisticated CryptoDefense (Trojan.Cryptodefense) ransomware, appeared in the end of March, that holds the victims’ computer files hostage by wrapping them with strong RSA 2048 encryption until the victim pays a ransom fee to get them decrypted.

    But unfortunately, the malware author failed to realize that he left the decryption keys left concealed on the user’s computer in a file folder with application data.

    So, to overcome this, the developer created Cryptowall ransomware and alike the latest versions of CryptoDefense, the infected system’s files and documents encrypted by CryptoWall are impossible to decrypt.

    The story broke, when researchers at Cisco revealed that cybercriminals have started targeting people with RIG Exploit Kits (EK) to distribute malicious Cryptowall ransomware malware.

    The Rig Exploit Kit was first spotted by Kahu Security in April, which checks for an unpatched version of Flash, Internet Explorer, Java or the Silverlight multimedia program on the infected users and if found, the system is instantly exploited by the bad actors.

    Researchers at Cisco have noticed high levels of traffic consistent with the new “RIG” exploit kit, thereby blocking requests to over 90 domains. On further investigation, the company observed that many of its Cloud Web Security (CWS) users were visiting on those malicious domains after clicking advertisements on high-profile domains such as “apps.facebook.com,” “awkwardfamilyphotos.com,” “theguardian.co.uk” and “go.com,” and many others.

    cryptowall ransomware If clicked, the advertisements redirect victims to one of those malicious domains in order to malvertise users and once the system get infected with the RIG Exploit Kit, it will deliver the payload which includes the Cryptowall Ransomware malware.

    Now, when this CryptoWall is installed in the infected system, it will start scanning the system Hard Drive for data files and encrypt them.

    After encrypting the files on victim’s system, it will create files containing ransom instructions in every folder it had encrypted, demanding up to $500 USD. The service where users are instructed to pay the ransom amount is a hidden service that uses the Command-and-Control server hosted on TOR .onion domain.

    The largest share of infections, some 42 percent, are in the United States, followed by England and Australia, but it believes that several groups and bad actors are involved in this attack chain.

    IF INFECTED Visit Our Main Site OR call 754-234-5598

    for latest computer repair and online news.

    Local and Online Virus removal and computer repairs anytime, anywhere

    Greased Lightbox

    →←+–↻

    Loading image

    Click anywhere to cancel

    Image unavailable

    Greased Lightbox

    →←+–↻

    Loading image

    Click anywhere to cancel

    Image unavailable

    Greased Lightbox

    →←+–↻

    Loading image

    Click anywhere to cancel

    Image unavailable

    Greased Lightbox

    →←+–↻

    Loading image

    Click anywhere to cancel

    Image unavailable

    Greased Lightbox

    →←+–↻

    Loading image

    Click anywhere to cancel

    Image unavailable

    Greased Lightbox

    →←+–↻

    Loading image

    Click anywhere to cancel

    Image unavailable

    Greased Lightbox

    →←+–↻

    Loading image

    Click anywhere to cancel

    Image unavailable


    📂This entry was posted in Virus Threats 📎and tagged

  • New Malware goes viral spreading through Facebook Messages

    Posted on by admin Comment

    Facebook Malware threat

    In yet another method for cyber criminals to utilize the world’s most popular social networks for their own nefarious purposes, it appears a trojan is circulating through Facebook, stealing accounts and (probably) taking creds.

    Thanks to the vigilant mind of Malwarebytes User, Showbizz, we were able to take a look at this new threat and what it could mean for the rest of the net.

    Here is how it works:

    1. User gets a Facebook instant message from a friend of their’s, which includes the words ‘lol’ and a file waiting to be downloaded.
    2. The user downloads the file because they can assume it can be trusted.  The filename matches the usual filename of a photo: ‘IMG_xxxx’.zip.
    3. Once downloaded, the user unzips the file and clicks on what they assume is an image file, still called IMG_xxxx.jar
    4. The JAR file executes, downloads malware and infects the system.
    5. The infected users Facebook account is compromised and then used to send more malware to the users friends.

    Unlike previous versions of this scam, it is almost like the cyber criminals decided to make an amalgam of different infection tactics to obtain the normal goal.

    The first is the use of instant messaging, we have seen plenty of malware use instant messaging in various forms to send malicious files to victims, including Skype, MSN, Yahoo, etc.

    Please Visit our computer repair section page if infected

    for latest computer repair and online news.

    Local and Online Virus removal and computer repairs anytime, anywhere

     


    📂This entry was posted in Virus Threats 📎and tagged

  • Local Computer Repair We crush the big computer repair store chains

    Posted on by admin Comment

         Online & On-Site Computer Repair Services

    VIRUS REMOVAL – LAPTOP SCREEN REPAIR – LOCAL COMPUTER REPAIR

    Fort Lauderdale, Miami and South Florida Apple, HP, Dell, Asus, Samsung, Toshiba, Sony, Compaq, Lenovo, Acer, Gateway Fujitsu, MSI, macbook Pro, Macbook Air Computer Repair solutions.

    We can fix your PC remotely, or dispatch a tech to your location.
    We can fix most problems for PC and Apple in less than 1 hour.
    Online and Local Computer Repair Solutions Anytime, Anywhere

    CALL TODAY 754-234-5598

    		 LOCAL REPAIRS FLAT FEE
    Why pay extra for the Geek Squad, Tiger Direct, Compusa, Staples, Office Depot?
    Best Service, Sameday Fast Repairs, In home service. CALL NOW

     

    Fort Lauderdale, Miami and South Florida computer and laptop repair services for Apple, Macbook Pro, Macbook Air, Hp, Compaq, Acer, Samsung, Asus, Lenovo, Sony, Toshiba, Gateway, Fujitsu, MSI, IBM, Dell and more

    www.CCREPAIRSERVICES.COM

    FAST SAME DAY COMPUTER REPAIR, VIRUS REMOVAL AND LAPTOP SCREEN REPAIR SERVICE


    📂This entry was posted in Current Repair Sales and Promotions 📎and tagged