Researcher Cracks DecryptorMax-Ransomware

A German researcher has succeeded DecryptorMax-ransomware which recently appeared to crack, causing casualties free their files to recover. The DecryptorMax-ransomware encrypts ransomware like other kinds of files on the computer.

Then a warning that must be paid. Unlike other ransomware, as CryptoWall the ransom amount doubles after a certain time, DecryptorMax victims gives 24 hours of time, otherwise the decryption key will be deleted and encrypted files will never be decrypted.

Fabian Wosar Emsisoft Anti-Malware now discovered that it is possible to retrieve the decryption key by brute force. This allows victims do not have to pay the ransom. Wosar developed a tool called DecryptInfinite in order to retrieve the decryption key. This tool requires a non-encrypted version of one of the encrypted files. In the case of victims not talking about have eg they can download an unencrypted PNG file from the Internet.

Then, the email address should be specified that the ransomware in the warning to show the victim. This information uses the tool for brute Forcen the decryption key. Something that can take some time. When the key is found, the tool show. But prevention is better than cure. Internet users therefore be advised to be cautious with email attachments. DecryptorMax spreads through email attachments posing as vacancies, reports the forum Bleeping Computer.

Adware Disables Updates For Chrome And Firefox

Adware is limited not only to the display of advertisements, aggressive adware variant fact also brings the systems of users at risk, so warn researchers. Where most adware is only nests in the browser, the DynamicPricer-adware first switches off the automatic updates for Chrome and Firefox, and then install an older version of Chrome.

In this old Chrome version, which dates from February 2014, the adware displays all kinds of ads, reports anti-malware company Malwarebytes. The adware is installed via so-called software bundles, which besides the desired program to install all kinds of additional software. Recently warned researchers also adware already installed browsers on the computer trying to replace.

This trojan was hosted at cdn[dot]searchbook[dot]me. Which currently resides at an IP-address that has quite the history (198.232.127.32). If you know where to look you will be able to find other and more recent installers, but they are password protected zip files which will be unpacked by the bundle installer under “normal” circumstances.

VirusTotal Report

Infected Ads On YouPorn And Pornhub

After xHamster are also on the popular porn site Pornhub and YouPorn contaminated ads have appeared that tried to infect visitors with malware, says anti-malware company Malwarebytes. The websites get together 800 million visitors per month.

Pornhub is according to Alexa on the 64th spot of most visited websites on the internet. YouPorn is at the 161st place back. The ads came from the ExoClick ad network. The ads sent visitors without being noticed this through to a website with the Angler-exploitkit. This exploitkit uses known vulnerabilities include Adobe Flash Player and Internet Explorer to install malware. For whatever it's malware was not disclosed.

After Geek Mind, publisher Pornhub and YouPorn, discovered the ad network ads were off the infected ads. The company also states that all third-party advertising on "continuous basis" audit to malvertising, as mentioned infected ads preventable. Recently, it was also for the third time in a year hit by xHamster. This website receives nearly half a billion visitors monthly.

Malwarebytes Launches Free Anti-Malware Tool For Mac

Anti-virus firm Malwarebytes has launched a free tool for Mac users to malware, adware and potentially unwanted programs (PUPs) to remove it. In addition, the company also take Adware Medic of The Safe on Mac, as the virus fighter let know .

From examination of OPSWAT showed that 50% of Mac users have not installed virus scanner. According Malwarebytes this is because malware is not seen as a problem for Mac. Compared to Windows, there is much less Mac malware in circulation. These are often malware via pirated software and downloading software from untrusted sources is distributed. It is also adware and toolbars by some parties as the biggest threat are labeled for Mac users.

Something that is also reflected in the number of downloads of Adware Medic, a program to remove adware along. The software is in the first half of this year already downloaded 2.8 million times. Also from research from Google shows that adware on Windows and Mac is a problem. Nevertheless, users can also protect against here. So anti-virus company Avast suggested recently that a lot of adware and toolbars can be prevented if consumers better read and pay attention when installing software.

Thomas Reed Adware Medic, who is now at Malwarebytes will focus on the development of Mac products, says that Mac users need protection against adware, which assumes more and more the form of an epidemic. Malwarebytes Anti-Malware for Mac is available for free download and use. Later this year there are versions for SMEs and large enterprises.

Microsoft TechNet Used To Control Infected Computers

Cyber ​​Spies have Microsoft TechNet used to control infected computers. TechNet is a Microsoft portal where IT professionals can find all kinds of information and documentation for Microsoft products. There is also a forum there for questioning.

A group of cyber spies, according to the American security company FireEye from China operated TechNet used to control infected computers. Forum topics and sections were coded IP addresses hidden. The infected computers used to connect to TechNet and were able to identify the IP address which they then had to connect.

This would make it difficult for network administrators to detect an infection or the actual location to figure out the Command & Control server who opted infected computers. FireEye notes that TechNet itself has not been hacked, but there just was placed on a public information forum. The use of well-known websites such as Twitter , Evernote and Dropbox malware is already longer.

After FireEye Microsoft and the tactics of the attackers had discovered the IP addresses in the forum topics and sections were replaced by IP addresses of American companies. In addition, the board accounts were locked so that cyber spies could not change the custom IP addresses. In this way FireEye and Microsoft could identify the victims of the spying campaign.How many organizations victim of this group were infected and how they were let security know.