BugsFighter

Matrix Ransomware is ransomware virus that encrypts user files with either symmetric or asymmetric cryptography. It adds .matrix extension to encrypted files. After finishing encryption process, Matrix creates a text file matrix-readme.rtf or Readme-Matrix.rtf. Virus places this files in every folder with affected files. This text file contains instruction to pay the ransom, where malefactors encourage users to contact them via e-mails: bluetablet9643@yandex.ru, matrix9643@yahoo.com or redtablet9643@yahoo.com.

MacAppExtensions (Adware.MAC.Linkury.C) is malware related to Search.tapufind.com hijacker, that we described in some of our earlier articles. It works in MacOS and targets Safari, Google Chrome and Mozilla Firefox browsers. The main symptom is, that your browsers search and homepage settings change to search.tapufind.com, and this setting cannot be modified until MacAppExtensions is removed. However, this virus not only hijacks the browser, but also gathers private information about its user (collects data related to browsing activity: geolocations, entered search queries, URLs of visited websites, IP addresses etc.).

Robotcaptcha.info is adverse domain, that may show unwanted pop-ups and ads in Google Chrome, Mozilla Firefox, Internet Explorer Safari or Edge browsers on Windows, Mac or Android operating systems. Landing pages from Robotcaptcha.info appear from nowhere and offer users to subscribe to notifications. This is feature in modern browsers, that help users get actual news in faster and convenient way. However, on the other side of this, when website is of advertising nature, users start receiving ads, pop-ups, tech support scam messages on their desktops. This is an element of social engineering, and clicking "Allow" button, actually, subscribes users to notifications. At the same time, Robotcaptcha.info initiates standard dialog box window with option to allow or block notifications from site you are visiting. If person clicks on the "Allow" button, users will start receiving unwanted pop-up ads from Robotcaptcha.info directly on the desktop even when browser is closed.

Cr1ptT0r Ransomware is new type of ransomware, that uses network disk array vulnerability to infect user's computers. This crypto ransomware encrypts data on network (cloud, NAS, Network Attached Storage) storage using a special encryption algorithm, and then requires a ransom of ~ 0.3 BTC to return files. Original title Cr1ptT0r is indicated in the ransom note and on the page on the OpenBazaar website. Developers call themselves a Cr1ptT0r team. The ELF ARM binary is used for Linux systems with a focus on embedded devices, but depending on the manufacturer it can be adapted for Windows. Virus creates 2 files: _FILES_ENCRYPTED_README.txt and _cr1ptt0r_support.txt. The Sodium crypto library and the asymmetric encryption algorithm "curve25519xsalsa20poly1305" (Curve25519, Salsa20, Poly1305) are used for encryption. The open 256-bit encryption key is located in the cr1ptt0r_logs.txt file, which also stores the list of encrypted files, and it is also added to the end of the encrypted files, just before the marker. Cr1ptT0r Ransomware uses the OpenBazaar site to "support" the affected and selling the decoder. There are no decryption tool available yet, however, using instructions in this article can help you recover encrypted files. Follow the guide below to remove Cr1ptT0r Ransomware and decrypt your files in Windows 10, 8/8.1, Windows 7.

This particular sample of Adobe Ransomware is, in fact, a continuation of STOP Ransomware family. This virus attacks files, that can be important for average user, like documents, photos, databases, music, enciphers them with AES encryption and adds .adobe (one "e" in the end), .adobee (two "e"s in the end) extensions to affected files. This creates a mess, because there are several different ransomware families using this extension after encryption. All these viruses use different algorithms, however .adobe files encrypted by STOP Ransomware can be deciphered using STOPDecrypter (provided below). Unlike previous versions, this one gives clear information about the cost of decryption, which is $980 (or $490 if it is paid within 72 hours). However, this is just a trick, to encourage people to pay the ransom. Often authors of the ransomware don't send any decryptor. We recommend you to remove executables of STOP Ransomware and use decryption tools available for .adobe files.

GandCrab v5.2 Ransomware was released just few hours before Europol, Romanian Police and Bitdefender released full-functional decryption tool for all previous versions of virus, up to GandCrab v5.1 Ransomware. Updated version of GandCrab adds .[5-6-7-8-9-10-random-letters] extension and ransom note file will get such name: [5-6-7-8-9-10-random-letters]-DECRYPT.txt and [random-letters]-DECRYPT.html. It is reported that many IT companies and managed service providers have been infected and affected by the GandCrab Ransomware. Some of the previous versions had decryptor from BitDefender, we will provide download link for this tool below. There is a possibility, that program will be updated to work with GandCrab v5.2 Ransomware. Meanwhile, we recommend you to use standard Windows functions, such as shadow copies, previous versions of files, restore point to attempt recovering your files. Using special file-recovery software often helps to restore many files, remover by the user earlier and not touched by the virus.

Putlocker is common name of file hosting websites and cloud storage, used for streaming of entertainment media. Due to piracy and security issues, Putlocker domains are blocked in most countries. However, there are over 50 mirrors of initial website, and they are using unethical marketing methods to deliver their content to users. Putlocker can be distributed by browser add-on, pop-ups and other types of unwanted advertising. Once shown to the user, Putlocker offers to subscribe to its notifications, and, if accepted, starts to display annoying notifications about movies, TV series directly on the desktop.

Dharma-ETH Ransomware is new generation of high-risk Crysis-Dharma-Cezar ransomware family, particularly, its Dharma variation. It was named after the extension it appends to encrypted files: .ETH. In fact, virus adds complex suffix, that consists of several parts: e-mail address, unique 8-digit identification number (completely random) and .ETH extension. In the end, affected files get complex suffix, that looks like this - .id-{8-digit-id}.[{email-address}].ETH. Ransom notes do not contain information about the amount users need to pay to return the files. There is also no information about encryption algorithms it uses. However, from the experience of previous infections of this type, we can say it, probably, uses AES or RSA-2048 encryption and will try to rip you off on a sum from $500 to $1500, that have to be paid in Monero, Dash or BTC (BitCoins).