virus – Complete Computer Repair Latest Virus news Local Fort Lauderdale Miami, USA https://www.ccrepairservices.com/blog Thu, 23 Jan 2025 03:57:45 +0000 en hourly 1 Broward County Repairs https://www.ccrepairservices.com/blog/computer-repair-bulletin/broward-county-repairs/ Thu, 23 Jan 2025 03:53:05 +0000 https://www.ccrepairservices.com/blog/?p=1057

Complete Computer Repair Services Broward is your trusted partner for expert computer repair solutions across Broward County, FL. Whether you’re dealing with a slow computer, virus infections, hardware malfunctions, or need system upgrades, our experienced team is here to help. We offer services to both residential and commercial clients, covering a wide range of areas from ZIP codes 33004 to 33394. Our hours of operation are 9:30 AM to 9:30 PM every day, ensuring we’re available whenever you need us. We accept a variety of payment methods, including Cash, Credit Card, PayPal, and digital payment systems like Zelle, Venmo, CashApp, as well as cryptocurrencies like XRP, Bitcoin (BTC), Ethereum (ETH), Litecoin (LTC), and Hedera (HBAR). At Broward Computer Repair Services, we prioritize quality, convenience, and customer satisfaction with every repair we perform.

]]> Using DNS to weaken Locky ransomware threat https://www.ccrepairservices.com/blog/computer-news/using-dns-to-weaken-locky-ransomware-threat/ Wed, 08 Feb 2017 21:42:26 +0000 http://www.ccrepairservices.com/blog/?p=973

Ransomware and other cyberthreats often go unseen by traditional detection methods like antivirus, deep packet inspection (DPI) or sandboxing. In fact, a report by Lastline Labs indicates that 51% of zero-day malware—threats that strike before developers have time to release a patch—is undetected by anti-virus solutions. So what can security professionals do to stop attacks? The answer lies, in part, in DNS.

One of the most powerful ransomware threats currently targeting individuals and organizations is Locky, which infects up to 100,000 devices per day, of which 3% submit payments. Cybersecurity experts estimate that Locky possesses 17% of the entire global market share for all ransomware infections.

First, let’s look at a few statistics that demonstrate the power and expense of Locky:

Locky is typically delivered through aggressive spam campaigns, often claiming to be an invoice. Despite the known dangers of clicking on links in unknown emails, Locky is so sly it entices even trained IT staff to click on obscure messages and activate downloads.

Once a download has completed, Locky connects with its Command & Control (C&C) server to get a cryptographic key to use for encryption. There are three known mechanisms for Locky to reach its C&C hosts:

  1. Direct IP communication
  2. A number of fixed domains
  3. A time-based Domain Generation Algorithm (DGA) that creates a set of random-looking domains that are only valid for a few days

Here is where DNS can play a role. DNS data can be analyzed to identify C&C connection mechanisms. When these communications are blocked, Locky’s ability to obtain encryption keys is limited, giving infected users a better chance of being protected.

Unfortunately, the DGA used by Locky to generate domains and get encryption keys is marked with the current time period combined with a secret seed, making it harder to block new domains quickly. Locky changes seeds frequently, and reverse engineering current versions of the malware to discover each new seed takes time. Every new seed indicates another wave in the life of the exploit, so until there is an accurate way to identify traffic associated with Locky, it can’t be permanently blocked.

But examination of a worldwide feed of anonymized DNS queries, along with anomaly detection and correlation technology, makes it possible to identify suspected domains used by Locky to download encryption keys in real time. ForcePoint is one company that has done some work to reverse engineer the DGA used by Locky. By using the existing DGA and conducting some additional processing of suspect domains, it is possible to determine new seeds used by Locky, thereby enumerating all future new domains Locky will use.

Below is a sampling of more recent domains created by Locky as detected by our DNS algorithms:

  • mrjuvawlwa[.]xyz
  • uydvrqwgg[.]su
  • uwiyklntlxpxj[.]work
  • owvtbqledaraqq[.]su
  • udfaexci[.]ru
  • eabfhwl[.]ru
  • olyedawaki[.]pl
  • uxwfukfqxhydqawmf[.]su
  • ikdcjjcyjtpsc[.]work
  • wrbwtvcv[.]su
  • osxbymbjwuotd[.]click
  • qtuanjdpx[.]info

As Locky and other types of ransomware become more adept at avoiding detection and remediation, new strategies need to be used to combat them. Many of the new cyberthreat strategies make traditional malware block lists less effective. Facing DGAs with fast-changing seeds, security researchers must constantly identify the new seeds used by each wave of phishing to pre-generate domains. Once new seeds are released the old ones immediately become obsolete.

By utilizing a broad set of DNS query data, it is possible to detect and track the evolution of generated domains through a variety of algorithmic methods such as clustering, reputation scoring, reverse engineering and additional methods that continuously evolve. Recent innovations include anomaly detection algorithms, new domain clustering and a Domain Reputation System that resulted in almost 100,000 domains and C&Cs provisioned daily for blocking.

By employing these advanced methods, suspicious domains can be detected with a high level of accuracy very quickly, and false positives can also be weeded out so good traffic can still reach legitimate sites. Currently, this is the best defense against Locky. Service providers and companies can use this technique to protect their online users from having their files encrypted, and identify machines that have been infected.

Locky provides ample evidence that attackers are continuously innovating. Staying one step ahead requires cybersecurity expertise and real-time processing of massive, worldwide data sets to uncover malicious activity. Blocking traffic to these domains is a good way to avoid the threat of Locky, and expert security teams that take the right steps to understand its behavior and put appropriate measures in place to protect would-be victims will render cyberthreats much less effective.

]]> Proteus botnet Malware with Remote Access https://www.ccrepairservices.com/blog/virus-and-malware-threats/proteus-botnet-malware-with-remote-access/ Mon, 23 Jan 2017 01:03:19 +0000 http://www.ccrepairservices.com/blog/?p=965

 

The Proteus botnet emerged toward the end of November 2016.  Only a few samples of it were found in the wild and, at the moment, it doesn’t seem to have a widespread campaign.  So, what does it do? It launches a multi-layered attack on an infected machine where it runs several processes aimed at coin mining, credential theft, and keylogging.  In addition, the bot can perform on its own; it offers the cybercriminal to send commands over HTTP to download malicious executables and execute them.

 

In some samples, the botnet disguises itself as a Google Chrome executable. The functionality of the botnet is highly reliant on its C&C (command and control) server, hxxp://proteus-network[.]biz or hxxp://proteus-network[.]ml (the latter is inaccessible). The URL is hardcoded in the sample and is contacted multiple times to obtain necessary credentials for the tasks the botnet performs. The host name also appears in Pastebin, under the URL hxxp://pastebin[.]com/raw/LidbEiiR, in its encrypted form, and the botnet can retrieve the domain from there as well.

 

The botnet starts by identifying the infected machine and obtaining the operating system’s info (whether 64 or 86 bit), the machine’s name, and the Windows version. All of the information is sent to the C&C to “register” the machine.

 

After the machine is acknowledged by the C&C, the botnet proceeds to perform different tasks. As the botnet contacts the C&C to receive various pieces of information, the web requests are sent along with an encrypted string specifying the purpose of the request. These encrypted strings perform the following functions:

 

  • api/register – Register the infected machine
  • api/ping – Check if the machine is already registered
  • api/module – Check the mining module
  • api/proxy – Use reverse proxy
  • api/command – Receive commands from the C&C
  • api/account – Receive an account from the C&C
  • api/log – Handle the key logging document

 

The header section of the HTTP requests is similar throughout the different sections of the source code:

Content-type: application-json

Authorization: {2D592824-48DE-49F8-8F96-A40B3904C794}

 

When contacting the C&C, a POST request is sent with one of the above modes appended to the domain’s name, for example, hxxp://proteus-network.biz/api/log. The C&C sends a response to this request, which is then parsed by the botnet in search for the C&C’s reply.

 

CheckerTask:

 

The CheckerTask starts by contacting the C&C with the api/account string appended to the domain’s name. After sending a POST request, it receives a four-tuple composed of an account ID, an e-mail, a password, and the account type. The botnet attempts to access and steal the user’s credentials from a number of online websites, including:

 

  • eBay.com
  • otto.de
  • amazon.de
  • breuninger.com
  • dhl.de
  • netflix.com
  • coderbay.net
  • zalando.de

 

The majority of these websites are German-based and the botnet searches for German words appearing in the responses. This leads us to believe this specific sample of Proteus targets are German victims. For example, if the message received from the website includes the phrase “stimmen nicht mit den bei uns hinterlegten Daten”, which means, “This does not match the data provided by us”. The botnet attempts to change the password’s first character from lower case to upper case or to append the character “1” to the end of the password and tries to log in again after three seconds. The response from the website is then checked to harvest more information about the victim, including name, address, country, bought and sold items, seller type and the last feedback received.

 

Some of the websites which the CheckerTask tries to steal the credentials from may include a Captcha to prevent such automated logins. The Proteus botnet uses Death by Captcha (DBC), an API which solves any given Captcha and turns it into a text that the botnet can insert into the website, and proceeds with the login. Using DBC requires a username and a password, which are both hardcoded into the sample to enable Captcha analysis. We have managed to access the DBC account used in the sample, and found that it resolved 200 Captchas so far, which could hint to the number of successfully infected machines.

 

LoggerTask:

 

This task performs key logging on the infected machine. It starts by initializing a list of all the keyboard keys, and stores the logged keys into a file called tmpV213.txt found under the TEMP directory. When this file includes more than 250 characters, it is cleared and its content is sent to the C&C along with the api/log string.

 

CommandsTask:

 

This task receives commands from the C&C. The botnet sends a request to the C&C with the fingerprint and the api/command string. If the C&C sends a command to download a file, a new directory is created in the TEMP folder using a GUID, and a file called temp.exe is created in that directory. Alternatively, if the command is to “kill”, the process is killed. The task checks for new commands every two minutes.

 

MiningTask, EMiningTask:

 

The C&C determines the type of mining which the infected machine attempts, as well as the mining pool it will join. The EminingTask downloads an executable to the TEMP directory with the name loader.exe. The types of mining that appear in the sample are CPU, Zcash, Scrypt, and SHA256. During the mining task, and depending on the chosen type, the resources of the infected machine, such as the memory, CPU, and RAM, are used to provide the computing power necessary to produce the hashes accepted as a proof of work by each method. Even using a pool instead of individual mining, CPU usage soared rapidly and reached 100% in our labs when we ran the sample, which shows the processing power needed for the mining tasks.

 

Conclusion:

 

To summarize, the botnet conducts a complex attack: it infects a machine, steals credentials, logs keys and mines for currency, causing CPU level to reach 100%. Although the botnet has many of the crucial implementation tools needed for its attack, it heavily depends on communication with its C&C server and the information it transmits for the execution of its most basic functions.

]]> Ransomeware Decrypters Available Decryption Service – Decryptor Download Decrypt Files https://www.ccrepairservices.com/blog/computer-news/ransomeware-decrypters-available-decryption-service-decryptor-download-decrypt-files/ Tue, 17 Jan 2017 03:52:34 +0000 http://www.ccrepairservices.com/blog/?p=963 New version of ODCODCDecoder Released Download Decrypter

BloodDolly has released a new version of his ODCODC Ransomwaredecryptor. The decryptor can be downloaded from.

Emsisoft Decrypter for Marlboro Download Decrypter

The Marlboro ransomware was first seen on January 11th, 2017. It is written in C++ and uses a simple XOR-based encryption algorithm. Encrypted files are renamed to “.oops”. The ransom note is stored inside a file named “_HELP_Recover_Files_.html” and includes no further point of contact.

Due to a bug in the malware’s code, the malware will truncate up to the last 7 bytes from files it encrypts. It is, unfortunately, impossible for the decrypter to reconstruct these bytes.

To use the decrypter, you will require an encrypted file of at least 640 bytes in size as well as its unencrypted version. To start the decrypter select both the encrypted and unencrypted file and drag and drop them onto the decrypter executable.

Decryptor released for the Merry Christmas or Merry X-Mas Ransomware Download Decrypter

Fabian Wosar has done it again and released a decryptor for the files encrypted by the Merry Christmas or Merry X-Mas Ransomware. These files will have the extensions .PEGS1, .MRCR1, .RARE1, .RMCM1 appended to them.

Crypt38Decrypter Download Download Decrypter

BitStakDecrypter Download Download Decrypter

lphaDecrypter Download Download Decrypte

Unlock92Decrypter Download Download Decrypter

Hidden Tear Decrypter Download Download Decrypter

Hidden Tear BruteForcer Download Download Decrypter

PowerLockyDecrypter Download Download Decrypter

GhostCryptDecrypter Download Download Decrypter

MicroCop Decryptor Download Download Decrypter

Jigsaw Decrypter Download Download Decrypter

Rannoh Decryptor (updated 20-12-2016 with CryptXXX v3) Download Decrypter

RannohDecryptor tool is designed to decrypt files encrypted by:

  • CryptXXX versions 1, 2 and 3.
  • Marsjoke aka Polyglot;
  • Rannoh;
  • AutoIt;
  • Fury;
  • Crybola;
  • Cryakl;

Globe3 Decryptor Download Decrypter
The tool is designed to decrypt files encrypted by Globe3 Ransomware.

Derialock Decryptor Download Decrypter
Derialock decryptor tool is designed to decrypt files encrypted by Derialock

PHP Ransomware Decryptor Download Decrypter
PHP ransomware decryptor tool is designed to decrypt files encrypted by PHP ransomware

WildFire Decryptor Download Decrypter
WildfireDecryptor tool is designed to decrypt files encrypted by Wildfire

Chimera Decryptor Download Decrypter
ChimeraDecryptor tool is designed to decrypt files encrypted by Chimera

Teslacrypt Decryptor Download Decrypter
TeslaDecryptor can decrypt files encrypted by TeslaCrypt v3 and v4

Shade Decryptor Download Decrypter
ShadeDecryptor can decrypt files with the following extensions: .xtbl, .ytbl, .breaking_bad, .heisenberg.

CoinVault Decryptor Download Decrypter

The CoinVault decryption tool decrypts files encrypted by Coinvault and Bitcryptor.

Rakhni Decryptor (updated 14-11-2016) Download Decrypter

RakhniDecryptor tool is designed to decrypt files encrypted by:

  • Crysis;
  • Chimera;
  • Rakhni;
  • Agent.iih;
  • Aura;
  • Autoit;
  • Pletor;
  • Rotor;
  • Lamer;
  • Lortok;
  • Cryptokluchen;
  • Democry;
  • Bitman (TeslaCrypt) version 3 and 4.

Trend Micro Ransomware File Decryptor Download Decrypter

Supported Ransomware Families

The following list describes the known ransomware-encrypted files types can be handled by the latest version of

the tool.

Ransomware

File name and extension

CryptXXX V1, V2, V3*

{original file name}.crypt, cryp1, crypz, or 5 hexadecimal characters

CryptXXX V4, V5

{MD5 Hash}.5 hexadecimal characters

Crysis

.{id}.{email address}.xtbl, crypt

TeslaCrypt V1**

{original file name}.ECC

TeslaCrypt V2**

{original file name}.VVV, CCC, ZZZ, AAA, ABC, XYZ

TeslaCrypt V3

{original file name}.XXX or TTT or MP3 or MICRO

TeslaCrypt V4

File name and extension are unchanged

Rating:

485 found this helpful

Category:

Troubleshoot

Solution Id:

1114221

13/12/2016, 22)42

Using the Trend Micro Ransomware File Decryptor Tool

Page 2 of 6

https://success.trendmicro.com/solution/1114221#

#

TeslaCrypt V4

File name and extension are unchanged

SNSLocker

{Original file name}.RSNSLocked

AutoLocky

{Original file name}.locky

BadBlock

{Original file name}

777

{Original file name}.777

XORIST

{Original file name}.xorist or random extension

XORBAT

{Original file name}.crypted

CERBER V1

{10 random characters}.cerber

Stampado

{Original file name}.locked

Nemucod

{Original file name}.crypted

Chimera

{Original file name}.crypt

LECHIFFRE

{Original file name}.LeChiffre

MirCop

Lock.{Original file name}

Jigsaw

{Original file name}.random extension

Globe/Purge

V1: {Original file name}.purge

V2: {Original file name}.{email address + random characters}

V3: Extension not fixed or file name encrypted

DXXD

V1: {Original file name}.{Original extension}dxxd

Teamxrat/Xpan

V2: {Original filename}.__xratteamLucked

Crysis

.{id}.{email address}.xtbl, crypt

NMoreira Decryptor download
The tool is designed to decrypt files encrypted by NMoreira Ransomware.

Ozozalocker Decryptor download
The tool is designed to decrypt files encrypted by Ozozalocker Ransomware.

Globe Decryptor download
The tool is designed to decrypt files encrypted by Globe Ransomware.

Globe2 Decryptor download
The tool is designed to decrypt files encrypted by Globe2 Ransomware.

FenixLocker Decryptor download
The tool is designed to decrypt files encrypted by FenixLocker Ransomware.

Philadelphia Decryptor download
The tool is designed to decrypt files encrypted by Philadelphia Ransomware.

Stampado Decryptor download
The tool is designed to decrypt files encrypted by Stampado Ransomware.

Xorist Decryptor download
The tool is designed to decrypt files encrypted by Xorist Ransomware.

Nemucod Decryptor download
The tool is designed to decrypt files encrypted by Nemucod Ransomware.

Gomasom Decryptor download
The tool is designed to decrypt files encrypted by Gomasom Ransomware.

Linux.Encoder Decryptor download

Decryption tools have been designed for infections of the Linux.Encoder.1 and Linux.Encoder.3 ransomware

 

]]> Ransomware developers look to educate victims and Help Decrypt files https://www.ccrepairservices.com/blog/computer-news/ransomware-developers-look-to-educate-victims-and-help-decrypt-files/ Sat, 07 Jan 2017 00:15:57 +0000 http://www.ccrepairservices.com/blog/?p=958 Knowledge is good, At least according to the cybercriminals who are developing ransomware that will give a free decryption key if the victim reads two articles about ransomware.

A new variant of Koolova was discovered by security researcher Michael Gillespie, that demands the victim read two articles: a Google Security Blog, Stay safe while browsing, and a Bleeping Computer article, Jigsaw Ransomware Decrypted: Will delete your files until you pay the Ransom.

Lawrence Abrams, said the ransomware itself behaves like Jigsaw in that once it encrypts the files it delivers a scrolling note telling the victim to read stories or else risk having their files deleted. In Jigsaw’s case the demand is for a ransom payment.

]]> CTB-Locker ransomware spreading through fake Windows 10 Update emails https://www.ccrepairservices.com/blog/computer-news/ctb-locker-ransomware-spreading-through-fake-windows-10-update-emails/ Tue, 04 Aug 2015 16:39:43 +0000 http://www.ccrepairservices.com/blog/?p=903 With the highly publicized release of Microsoft’s Windows 10 on July 29th, scammers and malware developers were quick to jump in and use it as a method of distributing malware. Cisco’s Talos Group has discovered a email campaign underway that pretends to be from Microsoft and contains an attachment that will supposedly allow you to upgrade to Windows 10. In reality, though, this email is fake and once you double-click on the attached file, you will instead become infected with the encrypting ransomware CTB-Locker.
win10_blacked_out.png
Image of fake Windows Update Email courtesy of Cisco

As you can see the email pretends to be from the email address update@microsoft.com and contains the subject [b]Windows 10 Free Update. Even the email message looks legitimate with no spelling mistakes or strange grammar. This is because the content is copied directly from Microsoft’s site. The only tell-tale sign is that there will be some characters that do not render properly. Unfortunately, this small sign will not be enough for many people to notice.

Furthermore, once they download the attachment and extract it, the attached Win10Installer.exe icon will be the familiar Windows 10 logo.

It isn’t until you inspect the file properties of the attachment, do you see that something is not right as its file description will be iMacros Web Automation and the copyright for the program will belong to Ipswitch. Ipswitch is a legitimate company and not the ones who released this malware.

Finally, if a user double-clicks on the Win10Installer.exe file, they will not be greeted with the normal Windows 10 upgrade screen. Instead, after a brief delay they will be shown the screen for the CTB-Locker ransomware.

CTB-Locker Computer Virus removal and data file recovery service. Local and Online service. Fort Lauderdale,Miami, Boca Raton and all South florida
CTB-Locker Computer Virus removal and data file recovery service. Local and Online service. Fort Lauderdale,Miami, Boca Raton and all South florida

At this point, the computer’s data will be encrypted and there is not much that can be done about it.

 

IF INFECTED Visit Our Main Site OR call 754-234-5598

for latest computer repair and online news.

Local and Online Virus removal and computer repairs anytime, anywhere

]]> Cryptowall 3.0 is back and rapidly spreading – Ransom Virus Malware Spyware Spam Email https://www.ccrepairservices.com/blog/computer-news/cryptowall-3-0-is-back-and-rapidly-spreading-ransome-virus-malware-spyware-spam-email/ Sun, 12 Jul 2015 00:27:16 +0000 http://www.ccrepairservices.com/blog/?p=894 Cryptowall 3.0 Spreading again Removal DecrypterCryptowall 3.0 Rapidly Spreading again Removal Repair Recovery and Decrypter
Cryptowall 3.0 Spreading again Removal DecrypterCryptowall 3.0 Rapidly Spreading again Removal Repair Ransom Recovery and Decrypter CALL 754-234-5598

Since the Angler Exploit Kit began in late May spreading Cryptowall 3.0 ransomware, traffic containing the malware has continued to grow, putting more potential victims in harm’s way.

A week ago, the SANS Internet Storm Center reported that Cryptowall 3.0 infections are emanating from not only the prolific exploit kit, but also from malicious spam campaigns. The two means of infections share some common characteristics, lending credence to the theory that the same group may be behind both.
Version 3.0 is the latest iteration of Cryptowall, which is also known as Crowti. Like other ransomware families, Cryptowall 3.0 encrypts files stored on a compromised computer and demands a ransom, usually $500 payable in Bitcoin, in exchange for the encryption key. The malware uses numerous channels to communicate and send stolen traffic to its keepers, including I2P and Tor anonymity networks. Researchers at Cisco in February said that Cryptowall 3.0 abandoned using a dropper for propagation, opting instead to use exploit kits.

As of this morning, SANS incident handler and Rackspace security researcher Brad Duncan said that the latest run of Angler Exploit Kit traffic showed that the attackers had added a different Bitcoin address than the one used previously.

At this point, I’m not 100 percent certain it’s the same actor behind all this Cryptowall 3.0 we’ve been seeing lately,” Duncan wrote on the SANS ISC website. “However, my gut feeling tells me this activity is all related to the same actor or group. The timing is too much of a coincidence.

Duncan said that a check on blockchain.info for activity on the two Bitcoin addresses shows some transactions, indicating some victims are paying the ransom.

“We’re seeing a lot more samples of CryptoWall 3.0 in the spam/EK traffic now than before, so maybe the increased exposure might help infect more computers,” Duncan said, adding that he had no data on whether any of the victims who did pay the ransom were receiving encryption keys and are able to salvage their data.

Duncan said this latest spike began May 25 from both the malicious spam and Angler angles; both campaigns were still active as of early this morning.

The spam campaign uses Yahoo email addresses to send Cryptowall 3.0 via attachments. The attachments are called my_resume.zip and contain an HTML file called my_resume.svg. Duncan said the attackers have begun appending numbers to the file names, such as resume4210.html or resume9647.html.

Opening the attachment and extracting the malicious file gives you an HTML document. If you open one of these HTML files, your browser will generate traffic to a compromised server,” Duncan wrote. “The return traffic is gzip compressed, so you won’t see it in the TCP stream from Wireshark. Exporting the text from Wireshark shows HTML that points to a shared document from a Google server.

Cryptowall is hosted on a number of different docs.google.com URLs, he said, a list of which is posted on the SANS website. The Bitcoin address used for payment in the spam campaign is 16REtGSobiQZoprFnXZBR2mSWvRyUSJ3ag, the same address found in other spam samples.

Infections coming from Angler began May 26, and were the first Cryptowall 3.0 infections seen from Angler. The Bitcoin address used in Angler infections is 16Z6sidfLrfNoxJNu4qM5zhRttJEUD3XoB, SANS said. Duncan reports that a second Bitcoin address, 12LE1yNak3ZuNTLa95KYR2CQSKb6rZnELb, was used as of today.

“There are any number of reasons to use more than one Bitcoin address. It could be a back-up, in case law enforcement is closing in on the other one. It could be a way to track different infections, geographically,” Duncan said. “I’m not sure on this one. It’s just my gut feeling, which could be wrong.”

Duncan said that a new slate of WordPress sites were redirecting to Angler in this campaign, based on web injects observed.

“The significance is that there are plenty of vulnerable websites running outdated or unpatched versions of WordPress,” Duncan said. “The actors behind this (and other) campaigns will have a continuous supply of websites that can be compromised and used for these efforts.”

www.CCREPAIRSERVICES.COM

Local and Online PC Computer Repair Tel. 754-234-5598

FAST SAME DAY COMPUTER REPAIR, VIRUS REMOVAL, CRYTOWALL FILE RECOVERY AND LAPTOP SCREEN REPAIR SERVICE

]]> Computer Repair Services – Local Repair and On line Computer Technician Available https://www.ccrepairservices.com/blog/computer-repair-bulletin/computer-repair-services-local-repair-and-on-line-computer-technician-available/ Mon, 22 Jun 2015 03:55:12 +0000 http://www.ccrepairservices.com/blog/?p=890 If you need your computer up and running today, Call a reliable PC technician. Proudly Serving and providing on site local service in South Florida. Online service repair technicians available Anytime, Any day, Anywhere. Call 754-234-5598

Complete Computer Repair

SOME OF OUR COMPUTER AND NETWORK SERVICES

  • Networking — home office / business
    • Onsite PC support and installation
    • Hard drive Failure / Laptop Motherboard Repair
    • Data Backup and Data recovery
    • Malware, Viruses, Trojans, Rootkits, Ransomeware and Spyware Removal
    • Screen Replacement and repair
    • Apple Repair, PC Repair, Laptop Repair, Desktop Repair
    • Computer Upgrades and Build Custom Computers
    • Windows Upgrade, OSX Upgrades
    • Memory Upgrade, Hard drive upgrade,
    • Network Security, Secure Your Network, Internet Security
    • Wireless routers Installations
    • Wireless Printers Installation and Configuration
    • Anti-Virus Protection and Configuration
    • Windows Recovery for XP, Vista, Windows 7, windows 8, windows 10
    • Re install Windows 98, Windows XP, Windows Vista, Windows 7, Windows 8, Windows 10 Installations

–> We have computer parts for sale at low prices new and old for every make and model, HP, Compaq, Acer, Lenovo, Dell, Asus, Samsung, Toshiba, Sony, IBM, Emachines, Fujitsu, MSI and more.

TEL. 754-234-5598

*Lower prices than Geek Squad Fort Lauderdale, CompUSA Fort Lauderdale, Tiger Direct Fort Lauderdale, Staples Fort Lauderdale, Office Depot Fort Lauderdale, Online Virus Removal Sites, Local Computer Repair Shops. If you find a lower price call us and we will match that price. Computer Repair Coupons welcome, Computer repair discount for seniors.

]]> Malicious Ads on Yahoo, AOL, Match.com, Trigger CryptoWall Infections https://www.ccrepairservices.com/blog/computer-news/malicious-ads-on-yahoo-aol-trigger-cryptowall-infections-threatpost-the-first-stop-for-security-news/ Sun, 26 Oct 2014 02:45:02 +0000 http://www.ccrepairservices.com/blog/?p=882 cryptowall

Attackers have been leveraging the FlashPack Exploit Kit to peddle the CryptoWall 2.0 ransomware on unsuspecting visitors to sites such as Yahoo, The Atlantic and AOL. Researchers believe that for about a month the malvertising campaign hit up to 3 million visitors and netted the attackers $25,000 daily.

According to experts at Proofpoint, a firm that primarily specializes in email security, the exploit kit targeted a vulnerability in Adobe Flash via users’ browsers to install the ransomware on users’ machines.

Malvertising is an attack that happens when attackers embed malicious code – in this case code that led to the latest iteration of CryptoWall – into otherwise legitimate ads to spread malware via drive-by downloads. Users can often be infected without even clicking on anything.

CryptoWall, which takes users’ files, encrypts them with rigid RSA-2048 encryption, then asks for a fee to decrypt them, made a killing earlier this summer. In August it was reported that the ransomware made more than $1.1 million for its creators in just six months.

Similar to Critoni/Onion, a ransomware dug up in July, CryptoWall 2.0 downloads a TOR client on the victim’s machine, connects to a command and control server and demands users send Bitcoin – $500 worth – to decrypt their files. Since the campaign lasted about a month, from Sept. 18 to this past Saturday, researchers are estimating that 40 of the campaign’s Bitcoin addresses collected at least 65 BTC each, a number that roughly translates to $25,000 a day.

cryptowall1

Proofpoint claims that high ranking sites such as AOL, The Atlantic, Match.com and several Yahoo subdomains such as their Sports, Fantasy Sports and Finance sites, were spotted serving up the tainted ads. Other sites lesser known in the U.S. such as Australia’s Sydney Morning Herald, The Age, and the Brisbane Times, were reportedly also doling out the ads.

While the campaign started a month ago the firm claims things didn’t start to ramp up until recently.

“After crossing a threshold level, it became possible to associate the disparate instances with a single campaign impacting numerous, high-traffic sites,” Wayne Huang, the company’s VP of Engineering, said of the campaign.

The firm claims it worked quickly to notify those involved in the campaign, including the ad providers, and as of this week, believes the situation has been nullified.

Last month researchers with Barracuda Labs found a CryptoWall variant with certificate signed by Comodo being distributed through ads on a handful of different websites. None of those sites were nearly as trafficked as those spotted by this most recent campaign however. The Alexa rankings for Yahoo (4), AOL (37), Match (203), and The Atlantic (386) place them within the top 500 of the internet’s most popular sites, something that likely upped the campaign’s exposure level.

Please Visit our Computer News Website and Blog

for latest computer repair and online news.

Local and Online Virus removal and computer repairs anytime, anywhere

Fort Lauderdale, Miami, Boca Raton, Boynton Beach and all South Florida

]]> TripAdvisor’s Viator Hit by Massive 1.4 Million Payment Card Data Breach https://www.ccrepairservices.com/blog/computer-news/tripadvisors-viator-hit-by-massive-1-4-million-payment-card-data-breach/ Thu, 25 Sep 2014 04:09:01 +0000 http://www.ccrepairservices.com/blog/?p=825
TripAdvisor’s Viator Hit by Massive 1.4 million Payment Card Data Breach
TripAdvisor has reportedly been hit by a massive data breach at its Online travel booking and review website Viator, that may have exposed payment card details and account credentials of its customers, affecting an estimated 1.4 million of its customers.

The San Francisco-based Viator, acquired by TripAdvisor – the world’s largest travel site – for £122 million (US$ 200 million) back in July, admitted late on Friday that the intruders have hacked into some of its customers’ payment card accounts and made unauthorized charges.

The data breach was discovered in the bookings made through Viator’s websites and mobile offerings that could potentially affect payment card data.

Viator said that the company has hired forensic experts to figure out the extent of the breach. Meanwhile, the company has begun notifying its affected customers about the security breach as said by the travel outfit in a press release.

“On September 2, we were informed by our payment card service provider that unauthorized charges occurred on a number of our customers’ credit cards,” Viator wrote. “We have hired forensic experts, notified law enforcement and we have been working diligently and comprehensively to investigate the incident, identify how our systems may have been impacted, and secure our systems.”

“While our investigation is ongoing, we are in the process of notifying approximately 1.4 million Viator customers, who had some form of information potentially affected by the compromise.”

During investigation it found that the cybercriminals have broken into its internal databases and accessed the payment card data – including encrypted credit or debit card number, card expiration date, name, billing address and email address – of approximately 880,000 customers, and possibly their Viator account information that includes email address, encrypted password and Viator ‘nickname.’

Additionally, the intruders may have also accessed the Viator account information, including email addresses and encrypted passwords, of over 560,000 Viator customers.

According to the company, Debit-card PIN numbers were not included in the breach because Viator does not store them. The travel advisor said that they believe that the CVV number, the security numbers printed on the back of the customer’s credit card, were also not stolen in the breach.

For those who are affected by the breach in United States, Viator is offering them identity protection and credit card monitoring services for free and and the company is also investigating the possibility of offering similar services to customers outside the country.

Meanwhile, the company has warned its affected customers to regularly monitor their card activity and report any fraudulent charges to their card company. “Customers will not be responsible for fraudulent charges to their accounts if they are reported in a timely manner,” Viator said.

Viator also recommends its users to change their password for the site, as well as all other websites that uses the same credentials.

Please Visit our Computer News Website and Blog

for latest computer repair and online news.

Local and Online Virus removal and computer repairs anytime, anywhere

Fort Lauderdale, Miami, Boca Raton, Boynton Beach and all South Florida

]]> Rise in Anti-Child Porn Spam Protection Ransomware infections https://www.ccrepairservices.com/blog/virus-and-malware-threats/rise-in-anti-child-porn-spam-protection-ransomware-infections/ Thu, 04 Sep 2014 02:55:02 +0000 http://www.ccrepairservices.com/blog/?p=806

This ransomware pretends to be from a legitimate government organization that states that the infected computer is sending out SPAM that contains links to child pornography sites. The ransom program then states that in order protect yourself, and others, it has encrypted your data using Advanced Encryption Standards, or AES, encryption. Just like the Malware Protection and the ACCDFISA Protection Program variants, these files are not actually encrypted but are password protected RAR files.

sl.png

ScreenLocker window for ACCDFISA v2.0, There are actually a few different versions of this. ACCDFISA v2.0 HTML file, These can be worded slightly different, and can have different emails to message the virus creator.

There seems to be either a leak of the ACCDFISA v2.0 source, or the creator is mixing up the layout of Ransom Note, Screen Locker, and even the internal code. So far I have found 3 different version of ACCDFISA v2.0 with different contact emails, Ransom Notes, Code, and what is worse is even the method of delivery. The previous ACCDFISA v2.0 mostly only affected servers with RDP enabled with weak security. But the last 2 victims I have been messaging had neither a server or RDP enabled, and claimed to have gotten it either by email or a malicious or hacked site. This makes this older modified infection another top placer for worst encrypting infections because the key is unrecoverable, Restore Points are wiped, the computer is locked down, services are mangled, free space and deleted files are wiped with SDelete, and of course files are encrypted with WinRar SFX AES exe’s.

For informational purposes, the 2 virus creator emails I have found with these variants are brhelpinfo@gmail.com and Dextreme88@gmail.com.

When first run, this program will scan your computer for data files and convert them to password protected RAR .exe files. These password protected data files will be named in a format similar to test.txt(!! to decrypt email id <id> to <Email>@gmail.com !!).exe. It will then use Sysinternal’s SDelete to delete the original files in such a way that they cannot be undeleted using file recovery tools. It will also set a Windows Registry Run entry to start c:\<Random Number>\svchost.exe when your computer starts. This program is launched immediately when you logon and blocks access to your Windows environment. If you boot your computer using SafeMode, Windows Recovery disk, or another offline recovery CD, you can delete or rename the c:\<Random Number>\svchost.exe file in order to regain access to your Windows Desktop. This “lockout” screen will also prompt you to send the hackers the ransom in order to get a passcode for the system lockout screen and for your password protected files.

This variant took 3 hours to completely finish on my VM. I was able to access the key file, and decrypt nearly all files and back them up before shutdown. So if you are lucky enough to see this happening, you should immediately backup the key file on the desktop / in the ProgramData folder.

Sadly, just like the past variants, files cannot be decrypted either without the key, or a backup. If you are reading this infection free I have one question, Have you backed up today?. If not, you better get to it as these types of computer infections are on the rise and definitely here to stay!

The files that this infection creates when it is installed are:

File List:

c:\<Random>\svchost.exe – ScreenLocker / Decrypter

c:\<Random>\howtodecryptaesfiles.htm – RansomNote that all RansomNotes lnk’s point to

c:\ProgramData\fdst<Random>\lsassw86s.exe – Encrypter / Main dropper

c:\ProgramData\<Random>\<Random>.dll – Different Numbers and Hashes used by the infection / Also where Temp Key is kept, But removed after completion

c:\ProgramData\<Random>\<Random>.DLLS – List of files to be infected by WinRar

c:\ProgramData\<Random>\svchost.exe – WinRar CUI renamed

c:\ProgramData\<Random>\svchost.exe – Sdelete Renamed

c:\ProgramData\svcfnmainstvestvs\stppthmainfv.dll – List of Numbers used by the infection

c:\ProgramData\svtstcrs\stppthmainfv.dll – List of Numbers used by the infection

c:\Windows\System32\backgrounds2.bmp – Renamed ScreenLocker / Decrypter, Used to replace the one in ProgramData if deleted

c:\Windows\System32\lsassw86s.exe – Renamed Encrypter / Main dropper, Used to replace the one in ProgramData if deleted

c:\Windows\System32\scsvserv.exe – Used to complete mangle / disable services to further lock down computer

c:\Windows\System32\lsassvrtdbks.exe – Assists with encryption

c:\Windows\System32\session455.txt – Temp Storage used with .BAT file to logoff user account

c:\Windows\System32\decryptaesfiles.html – Used to copy to ProgramData

c:\Windows\System32\Sdelete.dll – Used to copy Sdelete to ProgramData

c:\Windows\System32\kblockdll.dll – Used to Lock desktop

c:\Windows\System32\btlogoffusrsmtv.bat – Used to log user off

c:\Windows\System32\default2.sfx – Used with winrar to encrypt files

c:\Windows\System32\cfwin32.dll – WinRar CUI renamed

%Desktop%\<Random>.Txt – Also contains Decrypt Key, But removed after completion

Registry List:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run C:\<Random>\svchost.exe – Launches ScreenLocker

HKCU\Software\Microsoft\Windows\CurrentVersion\Run C:\<Random>\svchost.exe – Launches ScreenLocker

HKLM\Software\Microsoft\Windows\CurrentVersion\Run C:\ProgramData\<Random>\svchost.exe – Launches ScreenLocker

Please Visit our Computer News Website and Blog

for latest computer repair and online news.

Local and Online Virus removal and computer repairs anytime, anywhere

Fort Lauderdale, Miami, Boca Raton, Boynton Beach and all South Florida

]]> Secret Government and Law enforcement spyware leaked https://www.ccrepairservices.com/blog/computer-news/secret-government-and-law-enforcement-spyware-leaked/ Fri, 08 Aug 2014 02:28:53 +0000 http://www.ccrepairservices.com/blog/?p=798 Thursday, August 07, 2014

 

Company That Sells 'FinFisher' Spying Software Got Hacked, 40GB Data Leaked
FinFisher spyware, a spyware application used by government and law enforcement agencies for the purpose of surveillance, appears to have been hacked earlier this week and a string of files has been dumped on the Internet.
The highly secret surveillance software called “FinFisher” sold by British company Gamma International can secretly monitors computers by turning ON webcams, recording everything the user types with a keylogger, and intercepting Skype calls, copying files, and much more.
A hacker has claimed on Reddit and Twitter that they’d infiltrated the network of one of the world’s top surveillance & motoring technology company Gamma International, creator of FinFisher spyware, and has exposed 40GB of internal data detailing the operations and effectiveness of the FinFisher suite of surveillance platforms.
The leaked information was published both on a parody Gamma Group Twitter account (@GammaGroupPR) and Reditt by the hacker that began publishing links to the documents and satirical tweets.
The leaked files includes client lists, price lists, source code of Web Finfly, details about the effectiveness of Finfisher malware, user and support documentation, a list of classes/tutorials, and much more.
The Reddit post Gamma International Leaked in self.Anarchism said, “a couple days ago [when] I hacked in and made off with 40GB of data from Gamma’s networks. I have hard proof they knew they were selling (and still are) to people using their software to attack Bahraini activists, along with a whole lots of other stuff in that 40GB.”

The FinFisher files were first leaked on Dropbox as a torrent file and since have been shared across the internet, which means that it is now impossible to stop the information from being leaked.

One spreadsheet in the dump titled FinFisher Products Extended Antivirus Test dated April this year, details the anti-virus detection rates of the FinFisher spyware which German based Gamma Group sold to governments and law enforcement agencies.

It shows how FinFisher performed well against 35 top antivirus products. That means FinFisher would probably not be detected by a targeted users’ security systems.


One more document also dated April this year has been identified that detailed release notes, for version 4.51 of FinSpy, show a series of patches made to the products including patch to ensure rootkit component could avoid Microsoft Security Essentials, that the malware could record dual screen Windows setups, and improved email spying with Mozilla Thunderbird and Apple Mail.


The file dump also reveals that FinFisher is detected by OS X Skype (a recording prompt appears), so the users of OS X Skype would be alerted to the presence of FinFisher by a notification indicating that a recording module was installed.
Company That Sells 'FinFisher' Spying Software Got Hacked, 40GB Data Leaked
FinFisher cannot tap Windows 8 users, so rather the desktop client, the users should opt for the Metro version of Skype.
The dump also contains a fake Adobe Flash Player updater, a Firefox plugin for RealPlayer and an extensive (though still undetermined) documentation for WhatsApp.

“A price list, which appeared to be a customers’ record, revealed the FinSpy program cost 1.4 million Euros and a variety of penetration testing training services priced at 27,000 Euros each,” the Reg. reported. “The document did not contain a date but it did show prices for malware targeting the recent iOS version 7 platform.”

The leaked documents also included a FinSpy user manual and brochure. This previously kept so-called spying secret is not a secret now and we’ll be going to find a lot more in the upcoming weeks.

Please Visit our Computer News Website and Blog

for latest computer repair and online news.

Local and Online Virus removal and computer repairs anytime, anywhere

Fort Lauderdale, Miami, Boca Raton, Boynton Beach and all South Florida

]]> SandroRAT Mobile Phone Android Malware that Disguises as Kaspersky Mobile Security https://www.ccrepairservices.com/blog/virus-and-malware-threats/sandrorat-mobile-phone-android-malware-that-disguises-as-kaspersky-mobile-security/ Tue, 05 Aug 2014 14:59:55 +0000 http://www.ccrepairservices.com/blog/?p=774
Researchers have warned users of Android devices to avoid app downloads from particularly unauthorized sources, since a new and sophisticated piece of malware is targeting Android users through phishing emails.
The malware, dubbed SandroRAT, is currently being used by cybercriminals to target Android users in Poland via a widely spread email spam campaign that delivers a new variant of an Android remote access tool (RAT).
The emails masquerade itself as a bank alert that warns users of the malware infection in their mobile device and offers a fake mobile security solution in order to get rid of the malware infection.
The mobile security solution poses as a Kaspersky Mobile Security, but in real, it is a version of SandroRAT, a remote access tool devised for Android devices, whose source code has been put on sale on underground Hack Forums since December last year.
A mobile malware researcher at McAfee, Carlos Castillo, detailed the new variant of Android remote access trojan over the weekend. According to the researcher, the package spread via phishing campaign is capable of executing several malicious commands on the infected devices.
SandroRAT gives the attacker an unrestricted access to sensitive details such as SMS messages, contact lists, call logs, browser history (including banking credentials), and GPS location data stored in Android devices and store all the data in an “adaptive multi-rate file on the SD card” to later upload them to a remote command and control (C&C) server.

“Spam campaigns (via SMS or email) are becoming a very popular way to distribute Android malware, which can steal personal information or even obtain complete control of a device with a tools like SandroRat,” wrote Carlos Castillo. “This attack gains credence with the appearance of a bank offering security solutions against banking malware, a typical behavior of legitimate banks.”

This new version of SandroRAT also has a self-update feature in it and it can install additional malware through user prompts for such actions. The malware gives the attacker full control over the messages, who can intercept, block and steal incoming messages, as well as insert and delete them.
It also appears that the attacker can send multimedia messages with specific parameters sent by the C&C server and can also record nearby sounds using the device’s mic.
Castillo also notes that the SandroRAT variant of malware had decryption capabilities for older releases of Whatsapp messaging app. But, the users running the latest version of Whatsapp in their Android devices are not vulnerable because the developers adopted a stronger encryption scheme.

“This decryption routine will not work with WhatsApp chats encrypted by the latest version of the application because the encryption scheme (crypt7) has been updated to make it stronger (using a unique server salt),” Castillo explained. “WhatsApp users should update the app to the latest version,” he advised.

Users are advised to avoid application downloads from unauthorized sources, particularly when the app download link is send through an email. Good practice is to always prefer downloading apps from the Google Play Store or other trusted sources.

Please Visit our Computer News Website and Blog

for latest computer repair and online news.

Local and Online Virus removal and computer repairs anytime, anywhere

Fort Lauderdale, Miami, Boca Raton, Boynton Beach and all South Florida

 

]]> Certain DevianArt advertising Campaigns lead to Malware, Spyware and Unwanted Applications on your computer https://www.ccrepairservices.com/blog/virus-and-malware-threats/certain-devianart-advertising-campaigns-lead-to-malware-spyware-and-unwanted-applications-on-your-computer/ Mon, 16 Jun 2014 19:58:47 +0000 http://www.ccrepairservices.com/blog/?p=636  

DeviantArt Malwaretising

 

Today, the estimated number of known computer threats like viruses, worms, backdoors, exploits, Trojans, spyware, password stealer, and other variants of potentially unwanted software range into millions. It has the capability to create several different forms of itself dynamically in order to thwart antimalware programs.

Users of the biggest online artwork community, DevianART with Global Alexa Rank 148, are targeted by the potentially unwanted software programs — delivered by the advertisements on the website, Stop Malvertising reported on Sunday.

A Potentially Unwanted Application (PUA) is a program that may not be intentionally malicious, but can negatively affect the performance and reliability of the system by distributing spyware or adware that can cause undesirable behavior on the computer. Some may simply display annoying advertisements, while others may run background processes that cause your computer to slow down. However, unlike malware, users themselves consent to install a PUA into their systems.

The malicious advertisements are delivered via newly registered (3rd March 2014) domains – Redux Media (www.reduxmedia.com) and avadslite.com. “Over the past months, this domain has been seen to resolve to the following IP addresses: 107.20.210.36 (2014-05-01), 54.243.89.71 (2014-05-01) and 184.170.128.86 (2014-05-25). According to VirusTotal, malware has communicated with the last two IP addresses.” Kimberly from Stop Malvertising said.

Once the user click on the Ad served by the DevianArt website, they are redirected to the Optimum Installer, a source of Potentially Unwanted Applications (PUA’s) that downloads legitimate software applications as well as bundled third-party software including toolbar.

 

malware ad

As shown, a pop-under warning will urge users to “update Media Player“, immediately followed by a second advertisement to “update Windows 7 Drivers” to avoid vulnerabilities, reduce crashes and ensure an optimal browsing experience. This is just a scam nothing more or less.

Obviously, these are well known social engineering techniques to trick the computer user into installing malicious or ad-support software. Such infection are designed specifically to make money, generate web traffic, and will display advertisements and sponsored links within your web browser.

 

Please Visit our Computer News Website and Blog

for latest computer repair and online news.

Local and Online Virus removal and computer repairs anytime, anywhere

Fort Lauderdale, Miami, Boca Raton, Boynton Beach and all South Florida

]]> Zeus Trojan (or Zbot Trojan) steals confidential information from the infected computer. https://www.ccrepairservices.com/blog/virus-and-malware-threats/zeus-trojan-or-zbot-trojan-steals-confidential-information-from-the-infected-computer/ Fri, 13 Jun 2014 18:46:56 +0000 http://www.ccrepairservices.com/blog/?p=623
Pandemiya hacking trojan

A new and relatively rare Zeus Trojan program was found which is totally different from other banking Trojans and has capability to secretly steal data from forms, login credentials and files from the victim as well as can create fake web pages and take screenshots of victim’s computer.

Researchers at RSA Security’s FraudAction team have discovered this new and critical threat, dubbed as ‘Pandemiya’, which is being offered to the cyber criminals in underground forums as an alternative to the infamous Zeus Trojan and its many variants, that is widely used by most of the cyber-criminals for years to steal banking information from consumers and companies.

 

The source code of the Zeus banking Trojan is available on the underground forums from past few years, which lead malware developers to design more sophisticated variants of Zeus Trojan such as Citadel, Ice IX and Gameover Zeus.

 

But, Pandemiya is something by far the most isolated and dangerous piece of malware as the author spent a year in writing the code for Pandemiya, which includes 25,000 lines of original code written in C.
Like other commercial Trojan, Pandemiya infect the machines through exploit kits and via drive-by download attacks to boost infection rate that exploit flaws in the vulnerable software such as Java, Silverlight and Flash within few seconds victim lands on the web page.

Pandemiya’s coding quality is quite interesting, and contrary to recent trends in malware development, it is not based on Zeus source code at all, unlike Citadel/Ice IX, etc.,” researchers from RSA, the security division of EMC, said Tuesday in a blog post. “Through our research, we found out that the author of Pandemiya spent close to a year of coding the application, and that it consists of more than 25,000 lines of original code in C.

Pandemiya Trojan using Windows CreateProcess API to inject itself into every new process that is initiated, including Explorer.exe and re-injects itself when needed. Pandemiya is being sold for as much as $2,000 USD and provides all the nasty features including encrypted communication with command and control servers in an effort to evade detection.The Trojan has been designed with modular architecture to load more external plug-ins, which allows hackers to add extra features simply by writing new DLL (dynamic link library). The extra plug-ins easily add capabilities to the Trojan’s core functionality, that’s why the developer charge an extra of $500 USD to get the core application as well as its plugins, which allows cybercriminals to open reverse proxies on infected computers, to steal FTP credentials and to infect executable files in order to inject the malware at start up.

 

The advent of a freshly coded new trojan malware application is not too common in the underground,” Marcus writes, adding that the modular approach in Pandemiya could make it “more pervasive in the near future.

The malware developers are also working on other new features to add reverse Remote Desktop Protocol connections and a Facebook attack module in order to spread the Trojan through hijacked Facebook accounts.

HOW TO REMOVE PANDEMIYA TROJAN

The Trojan can be easily removed with a little modification in the registry and command line action, as explained below:

    1. Locate the registry key HKEY_LOCAL_USER\Software\Microsoft\Windows\CurrentVersion\Run and identify the *.EXE filename in your user’s ‘Application Data’ folder. Note the name, and delete the registry value.
    2. Locate the registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls. Find the value with the same name as the *.EXE file in the previous step. Note the file name, and remove the value from the registry.
    3. Reboot the system. At this stage Pandemiya is installed but no longer running. Delete both files noted earlier. This will remove the last traces of the Trojan. Your system is now clean.

Please Visit our Computer News Website and Blog

for latest computer repair and online news.

Local and Online Virus removal and computer repairs anytime, anywhere

Fort Lauderdale, Miami, Boca Raton, Boynton Beach and all South Florida

]]> Cryptowall Ransomware Spreading on the internet rapidly through advertisements https://www.ccrepairservices.com/blog/virus-and-malware-threats/cryptowall-ransomware-spreading-on-the-innet-rapidly-through-advertisements/ Sat, 07 Jun 2014 21:38:28 +0000 http://www.ccrepairservices.com/blog/?p=601 Cryptowall Lock Malware spyware spreading
Cryptowall Lock Malware

 

Ransomware is an emerging threat in the evolution of cybercriminals techniques to part you from your money. Typically, the malicious software either lock victim’s computer system or encrypt the documents and files on it, in order to extort money from the victims.

Though earlier we saw the samples of Ransomware tended to be simple with dogged determinations to extort money from victims. But with the exponential rise in the samples of Ransomware malwares, the recent ones are more subtle in design, including Cryptolocker, Icepole, PrisonLocker, CryptoDefense and its variants.

Now, the ransomware dubbed as Cryptowall, a latest variant of the infamous ransomware Cryptolocker is targeting users by forcing them to download the malicious software by through advertising on the high profile domains belonging to Disney, Facebook, The Guardian newspaper and others.

Cryptolocker is designed by the same malware developer who created the sophisticated CryptoDefense (Trojan.Cryptodefense) ransomware, appeared in the end of March, that holds the victims’ computer files hostage by wrapping them with strong RSA 2048 encryption until the victim pays a ransom fee to get them decrypted.

But unfortunately, the malware author failed to realize that he left the decryption keys left concealed on the user’s computer in a file folder with application data.

So, to overcome this, the developer created Cryptowall ransomware and alike the latest versions of CryptoDefense, the infected system’s files and documents encrypted by CryptoWall are impossible to decrypt.

The story broke, when researchers at Cisco revealed that cybercriminals have started targeting people with RIG Exploit Kits (EK) to distribute malicious Cryptowall ransomware malware.

The Rig Exploit Kit was first spotted by Kahu Security in April, which checks for an unpatched version of Flash, Internet Explorer, Java or the Silverlight multimedia program on the infected users and if found, the system is instantly exploited by the bad actors.

Researchers at Cisco have noticed high levels of traffic consistent with the new “RIG” exploit kit, thereby blocking requests to over 90 domains. On further investigation, the company observed that many of its Cloud Web Security (CWS) users were visiting on those malicious domains after clicking advertisements on high-profile domains such as “apps.facebook.com,” “awkwardfamilyphotos.com,” “theguardian.co.uk” and “go.com,” and many others.

cryptowall ransomware If clicked, the advertisements redirect victims to one of those malicious domains in order to malvertise users and once the system get infected with the RIG Exploit Kit, it will deliver the payload which includes the Cryptowall Ransomware malware.

Now, when this CryptoWall is installed in the infected system, it will start scanning the system Hard Drive for data files and encrypt them.

After encrypting the files on victim’s system, it will create files containing ransom instructions in every folder it had encrypted, demanding up to $500 USD. The service where users are instructed to pay the ransom amount is a hidden service that uses the Command-and-Control server hosted on TOR .onion domain.

The largest share of infections, some 42 percent, are in the United States, followed by England and Australia, but it believes that several groups and bad actors are involved in this attack chain.

IF INFECTED Visit Our Main Site OR call 754-234-5598

for latest computer repair and online news.

Local and Online Virus removal and computer repairs anytime, anywhere

Greased Lightbox

→←+–↻

Loading image

Click anywhere to cancel

Image unavailable

Greased Lightbox

→←+–↻

Loading image

Click anywhere to cancel

Image unavailable

Greased Lightbox

→←+–↻

Loading image

Click anywhere to cancel

Image unavailable

Greased Lightbox

→←+–↻

Loading image

Click anywhere to cancel

Image unavailable

Greased Lightbox

→←+–↻

Loading image

Click anywhere to cancel

Image unavailable

Greased Lightbox

→←+–↻

Loading image

Click anywhere to cancel

Image unavailable

Greased Lightbox

→←+–↻

Loading image

Click anywhere to cancel

Image unavailable

]]> First Android Phone Ransomware that Encrypts your SD card Files https://www.ccrepairservices.com/blog/virus-and-malware-threats/first-android-phone-ransomware-that-encrypts-your-sd-card-files/ Sat, 07 Jun 2014 21:10:05 +0000 http://www.ccrepairservices.com/blog/?p=593 We have seen cybercriminals targeting PCs with Ransomware malware that encrypts your files or lock down your computer and ask for a ransom amount to be paid in a specified duration of time to unlock it.
To deliver the Ransomware malwares to the mobile devices, cyber criminals have already started creating malicious software programs for android devices. Last month, we reported about a new Police Ransomware malware that locks up the devices until the victims pay a ransom to get the keys to unlock the phone. But, the malware just lock the mobile screen and a loophole in the its implementation allowed users to recover their device and data stored on SDcard.

Now, in an effort to overcome this, threat actors have adopted encryption in the development of mobile Ransomware malwares. Recently, the security firm ESET has discovered a new Android ransomware, dubbed as Android/Simplocker.A, that has ability to encrypt the files on the device SD card and then demand a ransom from the victim in order to decrypt those files.

Once installed, the malware scans the SD card for certain file types such as image, document or video with extensions – jpeg, jpg, png, bmp, gif, pdf, doc, docx, txt, avi, mkv, 3gp, mp4 and encrypts them using AES in a separate thread in the background. After encrypting the files, the malware displays the following ransom message, written in Russian, which clearly means that this threat is targeting Russian Android users.

“WARNING your phone is locked!
The device is locked for viewing and distributing child pornography , zoophilia and other perversions.
To unlock you need to pay 260 UAH.
1.) Locate the nearest payment kiosk.
2.) Select MoneXy
3.) Enter {REDACTED}.
4.) Make deposit of 260 Hryvnia, and then press pay. Do not forget to take a receipt!
After payment your device will be unlocked within 24 hours. In case of no PAYMENT YOU WILL LOSE ALL DATA ON your device!”

The Ransomware malware directs victim to pay the ransom amount i.e. 260 UAH, which is roughly equal to $21 US, through the MoneXy service, as this payment service is not easily traceable as the regular credit card.

mobile virus

To maintain anonymity the malware author is using the Command-and-Control server hosted on TOR .onion domain and the malware sends the information of the infected device such as IMEI number to its server. The researchers at ESET are still analysing the malware:

“Our analysis of the Android/Simplock.A sample revealed that we are most likely dealing with a proof-of-concept or a work in progress – for example, the implementation of the encryption doesn’t come close to “the infamous Cryptolocker” on Windows.”

The researchers have found that the malware is capable to encrypt the victim’s files, which could be lost if the decryption key is not retrieved from the malware author by paying the ransom amount, but on the other hand the researchers strongly advise users against paying fine, as their is no guarantee that the hacker will provide you decryption keys even after paying the amount.
Unfortunately, mobile antivirus products are only capable to detect such known/detected threats only and can’t detect similar the new threats. So, it is important for you to always keep the back-up of all your files either manually on the computer system or use cloud backup services like dropbox, google drive etc, in order to protect it from the emerging threats.

Please Visit our Computer News Website and Blog

for latest computer repair and online news.

Local and Online Virus removal and computer repairs anytime, anywhere

Fort Lauderdale, Miami, Boca Raton, Boynton Beach and all South Florida

 

]]> New Malware goes viral spreading through Facebook Messages https://www.ccrepairservices.com/blog/virus-and-malware-threats/new-malware-goes-viral-spreading-through-facebook-messages/ Fri, 16 May 2014 00:03:23 +0000 http://www.ccrepairservices.com/blog/?p=493 Facebook Malware threat

In yet another method for cyber criminals to utilize the world’s most popular social networks for their own nefarious purposes, it appears a trojan is circulating through Facebook, stealing accounts and (probably) taking creds.

Thanks to the vigilant mind of Malwarebytes User, Showbizz, we were able to take a look at this new threat and what it could mean for the rest of the net.

Here is how it works:

  1. User gets a Facebook instant message from a friend of their’s, which includes the words ‘lol’ and a file waiting to be downloaded.
  2. The user downloads the file because they can assume it can be trusted.  The filename matches the usual filename of a photo: ‘IMG_xxxx’.zip.
  3. Once downloaded, the user unzips the file and clicks on what they assume is an image file, still called IMG_xxxx.jar
  4. The JAR file executes, downloads malware and infects the system.
  5. The infected users Facebook account is compromised and then used to send more malware to the users friends.

Unlike previous versions of this scam, it is almost like the cyber criminals decided to make an amalgam of different infection tactics to obtain the normal goal.

The first is the use of instant messaging, we have seen plenty of malware use instant messaging in various forms to send malicious files to victims, including Skype, MSN, Yahoo, etc.

Please Visit our computer repair section page if infected

for latest computer repair and online news.

Local and Online Virus removal and computer repairs anytime, anywhere

 

]]> AOL hit by massive data breach, Urges users to change their passwords https://www.ccrepairservices.com/blog/computer-news/aol-hit-by-massive-data-breach/ Wed, 30 Apr 2014 16:31:03 +0000 http://www.ccrepairservices.com/blog/?p=446
Complete Computer Repair Latest Computer News Fort Lauderdale

AOL hit by massive data breach

The personal details of AOL’s millions of customers has been leaked in an attack on the company’s systems, resulting in thousands of accounts being hijacked to send spam.
Internet pioneer AOL has warned of a major breach that has affected a significant number of users, leaking email and postal addresses, contact information and password details to attackers unknown.

AOL launched in 1983 as the Control Video Corporation and produced a short-lived modem-based gaming download service for the Atari 2600 dubbed GameLine. The precursor to Valve’s Steam and similar digital distribution systems, GameLine was not a financial success; the company had better luck with the Link series of online portals for the Commodore 64, Apple II and Macintosh, and IBM compatibles. In 1989, America Online was born as a walled-garden internet service which included chat, email and several games – including the first-ever web-based interactive fiction series and the first automated play-by-email game.

While internet-savvy consumers soon dropped AOL’s walled-garden system for more open services from generic internet service providers, the company still boasts a considerable client base. Despite an ongoing slide in customers, the company boasts a near three-million user count in the US alone – and it’s these customers who have been exposed in a serious security breach.

‘We have determined that there was unauthorised access to information regarding a significant number of user accounts,’ the company admitted late last night, following an investigation into spam messages sent from registered AOL accounts. ‘This information included AOL users’ email addresses, postal addresses, address book contact information, encrypted passwords and encrypted answers to security questions that we ask when a user resets his or her password, as well as certain employee information. We believe that spammers have used this contact information to send spoofed emails that appeared to come from roughly two per cent of our email accounts.’

The company has not confirmed the nature of the ‘encryption’ used to store the passwords – which should, by industry best practice, be a salted one-way hash function, rather than reversible encryption – but does claim that it has ‘no indication’ that said encryption was broken; this despite the attackers gaining full access to the accounts from which spam is issuing, an indication that they have indeed been able to retrieve at least some passwords from the corpus.

Users affected by the breach – and, at this point, it looks to cover anyone with an AOL email address, active or otherwise – is advised to reset their password and change their security questions; if the same password is used anywhere else, that should be changed too.

Please visit ccrepairservices.com

for latest computer repair and online news.

Local and Online Virus removal and computer repairs anytime, anywhere

 

]]> New Zero Day Vulnerability Found In Internet Explorer All versions https://www.ccrepairservices.com/blog/computer-news/440/ Tue, 29 Apr 2014 02:39:38 +0000 http://www.ccrepairservices.com/blog/?p=440
A new zero-day vulnerability that resides in all versions of Internet Explorer has been spotted in the wild, Microsoft confirmed late Saturday.

The vulnerability, which could allow remote code execution, is being used in “limited, targeted attacks,” according to an advisory issued by Microsoft. While all versions of the web browser, IE 6 through 11, are affected by the vulnerability, attacks are currently targeting IE versions 9, 10 and 11, according to security firm FireEye, which first reported the flaw Friday.

The attack leverages a previously unknown “use after free” vulnerability — data corruption that occurs after memory has been released — and bypasses both Windows DEP (data execution prevention) and ASLR (address space layout randomization) protections, according to FireEye.

The vulnerability is currently being exploited by a group of hackers targeting financial and defense organization in the US, FireEye told CNET.

“The APT [advanced persistent threat] group responsible for this exploit has been the first group to have access to a select number of browser-based 0-day exploits (e.g. IE, Firefox, and Flash) in the past,” FireEye said. “They are extremely proficient at lateral movement and are difficult to track, as they typically do not reuse command and control infrastructure.”

FireEye said the flaw was significant because it affects more than a quarter of the total browser market.

“Collectively, in 2013, the vulnerable versions of IE accounted for 26.25% of the browser market,” FireEye said in its advisory.

An attack could be triggered by luring visitors to a specially crafted web page, Microsoft explained.

“The vulnerability exists in the way that Internet Explorer accesses an object in memory that has been deleted or has not been properly allocated,” Microsoft said. “The vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer.”

Microsoft said it is investigating the vulnerability and may issue an out-of-cycle security update to address the issue.

Please visit ccrepairservices.com

for latest computer repair and online news.

Local and Online Virus removal and computer repairs anytime, anywhere


]]>