Tutorials

JENNY is the name of a new file-locker discovered by MalwareHunterTeam. Malware of such is normally designed to restrict access to data and demand victims to pay a ransom in crypto. After successfully infiltrating the system, the virus encrypts important pieces of data and also assigns the .JENNY extension. This means a file like 1.pdf will change to 1.pdf.JENNY and reset its original icon to blank. After this part is done, the ransomware replaces desktop wallpapers and features a pop-up window right on the screen. Unlike other ransomware infections, JENNY developers do not provide any decryption instructions. Victims are left confused with absolutely no contact information to use for reaching the cybercriminals. The reason for that could be because this ransomware is still under development and is likely being tested. This means decryption with the help of developers is impossible and that a complete version of JENNY may be released some day in the future.

BlueSky Ransomware is a devastating file encryptor. It restricts access to data and requests victims to pay a fee for its return. While running encryption of system-stored data, the virus also assigns the .bluesky extension to each affected sample. For instance, a file named 1.pdf will change to 1.pdf.bluesky and reset its original icon. Since then, files will be no longer accessible. To make victims pay the ransom, cybercriminals layout identical decryption instructions in both # DECRYPT FILES BLUESKY #.html and # DECRYPT FILES BLUESKY #.txt text notes, which are created after encryption. Inside, extortionists say the only case when files can be recovered is if victims purchase a special decryption key and software. They also say that any third-party attempts to decrypt files without the help of cybercriminals may result in permanent damage to data. Victims are thereafter instructed to download Tor Browser and visit the provided web link. After following that, victims will be able to see the price for decryption and additional information such as how to create a wallet and purchase cryptocurrencies as well. The decryption price is set at 0.1 BTC ≈ $2,075 and is said to double in 7 days after the ransomware attack. Cybercriminals also offer to test decryption, as victims can send one blocked file and get it decrypted for free. Ransomware developers tend to do this in order to validate their trustworthiness and boost victims' confidence in paying the ransom.

FARGO is a typical file-encryptor that restricts access to data and keeps it locked until the ransom is paid. It was also determined to be a new variant of the TargetCompany family. During encryption, the virus highlights affected files by adding a new .FARGO extension. For instance, a file originally titled 1.pdf will change to 1.pdf and reset its icon to blank. After getting successfully done with file encryption, the ransomware creates a text file called FILE RECOVERY.txt that features decryption instructions. Cybercriminals say that the only path towards recovering data is to buy a special decryption tool. For this, victims are instructed to contact extortionists via their email address (mallox@stealthypost.net). It is also stated victims should include their personally-generated ID in the message. To demonstrate that their decryption software actually works, threat actors offer free decryption of some non-valuable files. After sending these files, extortionists promise to assign the price for decryption and give payment instructions. Unfortunately, we have to let you know that manual decryption without the help of ransomware developers is almost impossible.

When trying to use a network-shared printer, some users may become subject to facing error 0x0000011b with the following message Windows cannot connect to the printer. It may appear while adding a printer to the list of new devices or making a printout - both on Windows 10 and 11. Whatever it is, this issue can be manageable with the help of our instructions below. These instructions are quite generic to all guides you see on the web, which confirms their efficiency in resolving the error. Try each of them down below until one of them sorts outs the problem. The first and probably the easiest method is to run the basic Windows Troubleshooter feature. The operating system designed by Microsoft has several troubleshooting tools for various devices to help detect and rectify basic issues related to them. We also recommend you try this easy solution before moving on to other ones below.

We can't install this printer right now is usually a 740 error that may chase down users while trying to add a new printer to the device list. This is the kind of message users tend to receive when facing this issue: "That didn’t work. We can’t install this printer right now. Try again later, or contact your network administrator for help. Error: #740." The most common reasons for its appearance are usually insufficient administrative privileges, problematic printer drivers, and other technical difficulties such as temporarily malfunctioned printer servers. In this guide, we are going to show you a couple of methods that may potentially resolve the error and let you connect your printer without the same problem occurring. When connecting a printer and therefore trying to add it, Windows does all the job in the background without you seeing many details. In this method, we will try and run the printer installation wizard manually - through the Command Prompt console. This will help initiate installation with administrative privileges and potentially succeed in doing so.

Sheeva is a recently-discovered ransomware infection that targets Windows systems to encrypt potentially important data and demand payment from victims for its decryption. While executing the virus system on our machine, Sheeva encrypted mostly business-related files which involved accounting, finance, and database information. It also renamed each file according to this pattern id[victim's_ID].[Sheeva@onionmail.org].[original_filename].sheeva. For instance, a file named 1.xlsx was renamed to id[xmrJ9Lve].[Sheeva@onionmail.org].1.xlsx.sheeva and dropped its original icon. After this, the ransomware infection created a text file named sheeva.txt to feature decryption instructions. Cybercriminals say that victims will have to pay some amount of money (unspecified) in Bitcoins to retrieve unique decryption tools. For this, users are instructed to contact swindlers using either Sheeva@onionmail.org or Sheeva@cyberfear.com e-mail addresses and also include their personally-generated ID. It is also allowed to send two files (under 5 MB) and get them decrypted for free. Many cybercriminals use this trick to show their decryption abilities and also motivate victims into further collaboration with them. Since Sheeva Ransomware targets business-related data, it is reasonable to assume that its scope narrows down to corporate rather than home users. This means the further announced price for decryption may be quite high and shy many victims away from decryption. Unfortunately, unless there are serious bugs and underdevelopment inside a ransomware virus, manual decryption without the help of extortionists is almost impossible.

Alike other similar schemes, Geek Squad email scam is designed to trick users into reacting to fake subscription notifications and acting upon cybercriminals' requests. The letter attempts to make users believe they have been charged for the renewal of the annual Geek Total Protection or similar subscription ($499.99). However, because users did not pay for any subscriptions intentionally, cybercriminal actors expect victims to call the provided +1-808-666-6112 (or similar) telephone number. Note that the subsidiary Geek Squad of the authentic consumer electronics corporation Best Buy has nothing to do with such letters you might have received. If you did not do any payments yourself and double-checked your bank account for such deductions, it is more likely such email messages are fake and contain the above-mentioned text. After calling the number of fake Geek Squad representatives, users will be therefore guided by cybercriminals to provide sensitive details (credit card info, social security number, etc.), pay a "fee" to cancel the subscription, or even install some software allowing scammers to remote-access your PC. Whatever they say is most likely a scam designed to extract financial benefits from inexperienced and gullible users. Beware of these scam techniques and read our guide below to learn how one can protect himself better against them.

Checkmate is a new ransomware infection that encrypts large volumes of office data and demands victims to pay 15,000 USD for its decryption. The virus uses secure algorithms to encipher important pieces of data (e.g., documents, tables, databases, photos, etc.). During this process, all affected files get visually changed with the .checkmate extension. For instance, a file named 1.xlsx will change to 1.xlsx.checkmate and reset its original icon to blank. As a result, the data will become no longer accessible. Lastly, developers create a text note called !CHECKMATE_DECRYPTION_README.txt to explain how files can be decrypted. The text note states how many files have been encrypted and what can be done to reclaim them. As mentioned above, extortionists require victims to pay an equivalent of 15,000 USD in Bitcoin to their crypto wallet address. Additionally, swindlers also offer to try free decryption - by sending 3 encrypted files (no more than 15 MB each) through the Telegram Messenger. They will afterwards supply the victim with free decrypted samples and provide the wallet address for the ransom payment. After transferring money, cybercriminals promise to respond back with decryption tools to unlock access to data. Unfortunately, at the moment of writing this article, there are no third-party tools that could allow free decryption without the direct help of cybercriminals. Means of encryption used by ransomware are usually very strong, making independent tools oftentimes useless with regard to decryption.