BugsFighter

Hakunamatata Ransomware is new version of NMoreira Ransomware (NMoreira 2.0). Virus encrypts user files with RSA-2048 and AES-256 encryption algorithms and adds .hakunamatata suffix to affected files. After finishing infection process Hakunamatata creates file "Recovers files yako.html" on the desktop. Hackers offer users to contact them using Bitmessage system and pay the ransom. Amount of ransom is currently unknown, but likely it is somewhere between $300 and $1500. Decryption key is generated during encryption, and currently unknown. Therefore, there is no way to decrypt or restore files unless users has backup.

Spora Ransomware is advanced virus, that encrypts different types of files on Windows machines with RSA cryptography. Possibly, originates in Russia. Spora disables Windows Startup Repair, removes Shadow Volume copies, and modifies BootStatusPolicy, which makes it difficult to restore files using standard methods. In addition, private decryption key is also encrypted with AES cryptography, and currently the only way to return your files is restoring from backup (if you have it). Some of the features of Spora Ransomware are: it can work without internet connection, it doesn't modify file names or file extensions. Ransom must be paid in BitCoins and estimates between $79 and $280, depending on the options user chooses.

Secure Search Bar is malicious browser extension, that adds search bar to the top of browser windows in Google Chrome, Mozilla Firefox and Internet Explorer. If user tries to type query in search box, it redirects to securesurf.biz, which then leads to plusnetwork.com. It also generates random ads and redirects, when users surf internet. Secure Search Bar mostly comes as add-on, but sometimes it can be malicious program module or shortcut hijack.

Secure-surf.net is browser hijacker presumably originated in Russia. It hits Google Chrome, Mozilla Firefox and Internet Explorer browsers modifying homepage, search and newtab settings. It has minimalistic design, that can resemble Google or Bing search engines. It redirects searches to http://nova.rambler.ru/, which is sub-domain of famous Russian search engine and news portal. Secure-surf.net also infects browser shortcuts on the desktop.

Fanli90.cn is bothersome browser hijacker, that infects Google Chrome, Mozilla Firefox and Internet Explorer by modifying browser shortcuts. Main page of this website contains some short stories with thumbs up and thumbs down buttons on yellow and white background. From the domain zone we can suggest, that developers located in China. Purpose of Fanli90.cn is to show ads, pop-ups, banners, coupons.

MacWizz is adware program for Mac systems. It infects Safari, Google Chrome and Mozilla Firefox browsers. After infection virus starts showing advertisements like "Ads by MacWizz", "brought by MacWizz" or "Powered by MacWizz". These ads are not related to the contents of the websites, but often they are shown on shopping websites. MacWizz extension creates "virtual layer" in browser to generate pop-ups, coupons, banners and can implement ads on any website.

Search.queryrouter.com is unwanted search engine with minimalistic design, that resembles popular search engines. Actually, this website redirects search queries to Google. Search.queryrouter.com claims to collect user browser information for purposes to improve its services, however, as we can see on the example of other hijackers, this information is used for advertising purposes, or just sold to third parties.

All-czech.com is website, that is used to hijack browser settings in Google Chrome, Mozilla Firefox and Internet Explorer. From the name of the domain one may think it is aiming Czech Republic, but in fact this is just one of the random names hijackers use to mislead users. This search engine targets international audience and redirects user search queries to cse.google.com, which is Google Custom Search.