BugsFighter

Mapsnow.co and Maps Now are, accordingly, unwanted search engine and browser add-on, that modifies and controls browser's settings in Safari, Google Chrome, Mozilla Firefox on Windows or Mac. Hijacker overrides default or user-installed values of search engine, home page and new tab with www.mapsnow.co website, that, in its turn, redirects search queries to search.yahoo.com. Developers of Maps Now application claim, that it provides quick and convenient access to maps and directions from the start page of your browser. However, in fact, it creates third party search page, with links to well-known online maps, such as Google Maps, Bing Maps and MapQuest. Sole purpose of this extension is to earn on advertising revenue from redirecting to other search engine, and probably, from promoting other websites and programs.

Dharma-Good Ransomware is typical representative of encryption viruses from Crysis-Dharma-Cezar ransomware family. This sample appends .good extension to affected files. Dharma-Good Ransomware adds complex extension, that consists of unique id, developer's e-mail and .good suffix. As a result, file named 1.doc will be converted to 1.doc.id-{8-digit-id}.[{email-address}].good. Dharma-Good Ransomware developers can extort from $500 to $15000 ransom in BTC (BitCoins) for decryption. Usually, it is quite big amount of money, because hackers pay the commission to Dharma Ransomware as Service (RaaS) owners. Using cryptocurrency makes it impossible to track the payee. Besides, victims of such viruses often get scammed, and malefactors don't send any keys even after paying the ransom. We do not recommend to pay any money to malefactors. Usually, after some period of time security specialists from antivirus companies or individual researchers break the algorithms and release decryption keys. Mention, that some files can be restored by using backups, shadow copies, previous versions of files or file-recovery software.

Goto-searchitnow.global.ssl.fastly.net is intermediary domain, used by search hijackers to redirect user's queries from well-known search engines to Searchitnow.info and vice versa. Goto-searchitnow.global.ssl.fastly.net can be seen in Safari, Google Chrome and Mozilla Firefox on Mac. Probably, it is used to drive traffic through faster cloud servers. If your searches are compromised like this, it means there is an adware module installed on your Mac. It can be presented by application, add-on, malicious device profile or just virus file and process.

Dharma-MERS Ransomware is another iteration of extremely dangerous Crysis-Dharma-Cezar ransomware family, that, in this case, adds .MERS extension to the end of the files it encrypts. Virus, actually, composes suffix using several parts: e-mail address, unique 8-digit identification number (randomly generated) and .MERS extension. So, finally, encoded files will receive following complex suffix - .id-{8-digit-id}.[{email-address}].MERS. As a rule, Dharma-type Ransomware extorts for $500 to $1500 ransom, that can be paid in Monero, Dash or BTC (BitCoins), and in return they promise to send decryption key. Using cryptocurrency makes it impossible to track the payee. We do not recommend to pay any money to malefactors. Usually, after some period of time security specialists from antivirus companies or individual researchers break the algorithms and release decryption keys. Mention, that some files can be restored by using backups, shadow copies, previous versions of files or file-recovery software.

Dharma-Qbix Ransomware is one of the subspecies of Crysis-Dharma-Cezar ransomware family, that appends .bkpx extension to the files it encrypts. Virus utilizes extension, that consists of several parts: e-mail adress, unique 8-digit ID (randomly generated) and .qbix suffix. As a rule, Dharma-Qbix Ransomware virus asks for $500 to $1500 ransom, that have to be paid in Monero, Dash or BTC (BitCoins), and in return they promise to send decryption key. However, malefactors often do not hold back promises and do not send any decryption keys, or just ignore e-mails from victims, who paid the ransom. It is not advised to send any funds to the hackers. Usually, after some period of time security specialists from antivirus companies and individual researchers break the algorithms and release decoding key. Its noteworthy, that some files can be restored by using backups, shadow copies, previous versions of files or file-recovery software and instructions given on this page.

Easy Speed Test Access or Search.easyspeedtestaccess.com is nasty browser hijacker and adware, that modifies search engine, homepage and new tab settings in Safari, Google Chrome and Mozilla Firefox. It can infect both Windows and Mac computers. Virus gets access to browsers data by installing extension, users themselves download it from phishing or advertising pages. Add-ons can be called: Easy Speed Test Access, Speed Test, Super Speed Tester, etc. After infiltration, hijacker sets search.easyspeedtestaccess.com as default search and opens it as homepage or new tab at every start. Page looks like typical third-party search engine, with toolbar, quick links to shopping sites and social networks and, in this case, to websites, that provide internet speed testing functionality. Search queries are redirected to search.yahoo.com.

GlobeImposter 2.0 Ransomware is the second generation of file-encrypting ransomware virus GlobeImposter. The name "GlobeImposter" was originnaly given to it by crypto-ransomware identification service called "ID-Ransomware", because of the assignment by the extortioners of the "proprietary" ransom note from the Globe Ransomware family. The purpose was to frighten the victims, to confuse the researchers, to discredit the decryption programs released for the Globe-family. Thus, all Globe-imitators, which are not decrypted by the decryption utilities released for Globe 1-2-3, received the conditional name GlobeImposter, and after that - GlobeImposter 2.0. Virus can be detected by various antivirus programs as Trojan.Encoder.7325, Trojan.Encoder.10737, Trojan.Encoder.11539, Ransom_FAKEPURGE.A or Ransom.GlobeImposter.