Viruses

If your files became no longer accessible and now appear with the new .MEOW extension (then .PUTIN, .KREMLIN and .RUSSIA extensions), then you are most likely infected with Meow Ransomware (a.k.a. MeowCorp2022 Ransomware and ContiStolen Ransomware). This file-encryptor blocks access to practically all types of system-stored data using the ChaCha20 algorithm and demands victims to establish contact with its developers (presumably to pay for decryption). In addition, it was also determined that this ransomware works on code stolen from another popular file-encryptor named Conti-2 Ransomware. Information about contacting swindlers can be found inside a text note called readme.txt, which the virus drops into each folder with encrypted files.

Loplup is a file-encrypting virus that was determined to be part of the ZEPPELIN ransomware family. While restricting access to system-stored data, it renames attacked files by adding the custom .loplup.[victim's_ID] extension. This means a file previously called 1.pdf will change to something like 1.pdf.loplup.312-A1A-FD7. Note that the victim's ID is variable so it can be different in your case. Following successful encryption of data, Loplup creates a text file (!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT) that contains decryption guidelines.

FirstKill is a ransomware infection designed to encrypt users' data and blackmail victims into paying financial ransom for its recovery. It uses AES and RSA military-grade algorithms to run strong encryption and prevent victims from re-accessing their files. During this process, FirstKill also renames all targeted files with the .FirstKill extension and resets their original icons to blank. For instance, a previously untouched file like 1.pdf will change to 1.pdf.FirstKill and become no longer accessible. Following this, the virus creates a text note called CO_SIĘ_STAŁO.html which contains instructions for decrypting the data.

ChinaHelper is a ransomware virus designed to encrypt personal data and blackmail victims into paying the ransom. While restricting access to data with the help of AES-256 and RSA-2048 algorithms, the virus assigns the .cnh extension so that a file like 1.pdf turns into 1.pdf.cnh, for instance. The next thing ChinaHelper does is creating a text note called README.txt. There is also another variant spotted in a later distribution, which assigned .cnhelp or .charm extension to files and created the HOW_TO_RETURN_FILES.txt file instead.

Bom is the name of a ransomware infection. Malware within this category encrypts system-stored data and demands victims to pay money for its return. This ransomware variant is also a by-product of the VoidCrypt family. During encryption, the virus renames all targeted files according to this example - 1.png.[tormented.soul@tuta.io][MJ-KB3756421908].bom. Your renamed files may slightly vary (e.g., different string of characters), but the basis will remain the same. After successfully restricting access to data, the ransomware creates a text note called Scratch - to provide decryption guidelines.

DASHA Ransomware is a new variant of Eternity Ransomware. This malware is designed to encrypt system-stored data and demand money for its decryption. While restricting access to files (e.g., photos, videos, documents, databases, etc.), the virus alters file appearance with the .ecrp extension. For instance, a file previously named 1.pdf will therefore change to 1.pdf.ecrp and become no longer accessible. Once this process gets to a close and all targeted files are eventually renamed, DASHA replaces the desktop wallpapers and displays a pop-up window with ransom instructions.

You may experience Your computer is low on memory message on 2 different occasions. Number one is a legitimate alert presented by the Mac system when you are running out of RAM. The system will, therefore, ask you to close some apps to free up space. This is quite common, especially if you have lots of programs working in the background that upload the PC. Sometimes malware can secretly gobble up memory resources and result in significant productivity loss. The second reason is that your PC was infected with adware or browser hijackers that modified your browser settings. In this case, "Your computer is low on memory" popup is fabricated and forces users into clicking on the "Close" button. Whilst it may seem innocent, frauds usually hide invisible buttons that can initiate multiple other processes that allow extortionists to take control over your browser. On top of that, browser hijackers tend to alter your homepage and replace the default search engine. This is made to push irritating ads, banners, and coupons along browsing to damage your Mac with other infections. In this article, we have presented a list of solutions for both malware and memory issues.

Loki Locker is the name of a ransomware virus designed to extort money from victims by running strong encryption of data. It uses a combination of AES-256 and RSA-2048 algorithms and also alters the names of encrypted data according to this template - [][]original_file.Loki. For instance, a file previously named 1.pdf will change to [DecNow@TutaMail.Com][C279F237]1.pdf.Loki and become no longer accessible. It is worth noting that there are also some newer versions of Loki Locker, which rename data with .Rainman, .Adair, .Boresh, .PayForKey, or .Spyro extensions. Following the successful blockade of files, the virus creates two files (Restore-My-Files.txt and info.hta) with similar ransom-demanding instructions. In addition, Loki Locker also replaces the desktop wallpapers to display brief steps on what should be done.