iolo WW

Tutorials

Useful tutorials on various PC troubleshooting topics. Video tutorials.

How to remove Dharma-yoAD Ransomware and decrypt .yoAD files

0
Dharma is a ransomware family considered to be the biggest developer of ransomware infections. Lots of versions have been found attacking users with data encryption and ransom-demand messages. However, one of the recent versions spotted being active around is known as yoAD Ransomware. Alike similar viruses of this type, it assigns the new .yoAD extension with random ID and cybercriminals' e-mail to each piece of data stored on a compromised PC. For example, the original file like 1.mp4 will get a look of 1.mp4.id-C279F237.[yourfiles1@cock.li].yoAD, or similarly. Such changes make your files are no longer accessible as any attempts to initiate them will be denied. Then, once this process gets to a close, the virus steps in with the creation of text instructions. They are presented in the FILES ENCRYPTED.txt document right on your desktop. As extortionists claim, the only way to restore your data is by contacting them via e-mail. Then, they will supposedly give you a crypto-wallet to send money in Bitcoin. After this, you will be given the necessary tools to restore your data. Unfortunately, this method does not fit everybody because amounts asked by cybercriminals can be astronomically high and not easy to pay.

How to remove Mijnal Ransomware and decrypt .mijnal files

0
Crypto-Locker Mijnal is a ransomware-type infection that encodes personal data with AES+RSA algorithms. The application of such means that the assigned cipher is hard to break using traditional methods. In other words, it makes sure manual decryption does not take place after data is locked. Unfortunately, in most cases, it appears to be impossible indeed, but you should give it a try after reading this text. Alike other infections, Mijnal encrypts your data by changing a file extension to .mijnal. For example, a sample like "1.mp4" will be altered to "1.mp4.mijnal" and reset its original icon. After the encryption process gets to a close, the virus creates a text note called "README_LOCK.txt" that contains redemption instructions. The information presented inside is written in Russian, which means that developers mainly focus on the CIS regions. However, there are some English users that may be affected by it as well. If you are willing to decrypt your data as soon as possible, cybercriminals ask victims to open the attached link via the Tor browser and follow the instructions right there. Then, extortionists will more likely ask you to pay a certain amount in Bitcoin to gain access back to your data. Despite paying the ransom is usually the only method to overcome data encryption, we recommend against meeting any requests as it can be dangerous for your pocket and privacy as well.

How to fix Windows Update error 0x800704c7 in Windows 10

0
Error 0x800704c7 is a bottleneck emerging on Windows 10. It prevents users from installing the latest updates that come to the system. Whilst the issue may feel irritating and hard to solve, it is usually related to the presence of corrupted or missing files. Such a phenomenon happens when users download third-party software or manipulate settings on their own. Users encountering 0x800704c7 can see the message in Windows Update Center stating the code of the issue. Sometimes failed updates may result in BSOD (Blue Screen of Death) that shuts down and reboots your PC. Even if you do not know what could potentially cause the problem, we will help you figure it out in the article below. A list of step-by-step instructions will help you liberate from the reoccurring problem and install the necessary update eventually.

How to fix Windows Update error 0x80070490 in Windows 10

0
Error 0x80070490 is a problem stating a failure when trying to update your system. Being unable to keep your PC up-to-date due to such issues turns out to be quite spread around Windows users. Usually, these errors occur as a result of conflicts created by third-party software, lack of important elements, malware, and other things wrecking configuration settings. To solve this, we recommend you to follow the step-by-step guide presented below. A number of tested and efficient methods will help you say goodbye to this problem eventually.

How to remove Leitkcad Ransomware and decrypt .leitcad files

0
Leitkcad is a pure example of crypto-malware that runs encryption over personal data to garner a so-called ransom. The most vivid symptoms hinting at the Leitkcad's presence is the assignment of .leitkcad extension. In other words, it will be seen at the end of each file affected by malware. For example, a file like 1.mp4 will be changed to 1.mp4.leitkcad and reset its original icon. Then, once all of the files are changed, the virus moves to the next phase creating a note called help-leitkcad.txt. It contains information on the encryption as well as instructions to restore your data. Cybercriminals say that you should contact an operator and fill in your ID, personal key, and e-mail via the chat page. The link to it can be opened only by using the Tor browser, which has to be downloaded by victims. Then, after establishing contact with cybercriminals, you will receive further instructions on how to purchase the decryption software. Also, it is worth-noting that rebooting and altering encrypted files can lead to permanent loss. Extortionists set certain algorithms that help them detect your activity. This means that if you refuse to comply with any of the above warnings, your files will be deleted momentarily.

How to remove LuciferCrypt Ransomware and decrypt .LuciferCrypt files

0
A new cryptovirus known as LuciferCrypt stepped into the game a couple of days ago to encrypt personal data. As long as the study goes, it is already evident that this ransomware restricts access to data by assigning a long-string extension (.id=[].email=[].LuciferCrypt). A quick illustration of an infected sample would look like this 1.id=0ED53ADA.email=cracker.irnencrypt@aol.com.LuciferCrypt.mp4. After the encryption process is done, the virus continues its presence creating a text file called HowToRecoverFiles.txt. Within this document, extortionists are notifying victims about successful encryption. To revert it, victims should contact cyber criminals via e-mail and pay a fee to recover the files. Once done, your data will be decrypted automatically, without involving any manipulations. It is also said that the price directly depends on how fast you reply to the swindlers. Before doing that, you are also allowed to take advantage of free decryption. Developers offer to send up to 3 files (less than 4MB and non-archived), which should not contain valuable information.

How to remove Pump Ransomware and decrypt .pump files

0
After Pump Ransomware attacks your system, all data become chained by strong algorithms restricting access to it. The malware appends .pump extension to the files it encodes. For example, a file like 1.mp4 will acquire a new look of 1.mp4.pump and reset its original icon. The extension applied in the end means that your files are under encryption. Such modifications are usually accompanied by the creation of ransom instructions. In our case, the virus drops a text file called README.txt that will help you recover the files. The content presented inside is short, cybercriminals only attached their e-mail address to call victims into contacting them. Then, they will supposedly give further instructions on how to purchase the decryption software. No matter how far the price goes, complying with the requests of swindlers is risky - they may become foolish in their promises and leave you no tools even after making a payment.

How to remove MARS Ransomware and decrypt .mars or .vyb files

0
MARS Ransomware is a malicious program discovered by Michael Gillespie. The way it encrypts files is very similar to other infections of such type - by appending the new .mars or .vyb extension to highlight the affected data. Victims will see their files transform into something like this 1.mp4.mars or 1.mp4.vyb. As a result of these actions, files cannot be opened or manipulated by users in any way. To fix it and recover your data, cybercriminals offer to read instructions in a text note (!!!MARS_DECRYPT.TXT) created after encryption. It informs you that various data types stored on your PC have been encrypted with the virus. To revert it, people have to pay 500$ in BTC for the decryption key. Before doing so, extortionists strongly insist on sending up to 3 files for free decryption to make sure of their trustworthiness. After this, the cybercriminals team will reply back with the payment link towards purchasing their software. You can also contact developers via Telegram and buy the key right away without testing free decryption. Although such features provided by swindlers may instill trust in their intentions, it is recommended against agreeing on what they say, because there is no actual guarantee that they will return your data safe and undamaged.