It’s not wrong if you label 2016 as the year of ransomware. The ransomware attacks are the dark side of modern technology revolution. Many first world countries like U.S and Canada has issued their citizens alerts about possible ransomware attacks this year. But, the question remains what necessary steps should be taken to address these ransomware attacks.
One of the most favorite and threatening ransomware of attackers now a days is “Cerber”, which already has a long list of victims who paid ransoms to reclaim their data. Recently a security firm “Malwarebytes Lab” published a report about Cerber ransomware which revealed that; the ransomware doesn’t load if it detects that the victim is from the certain blacklisted country or contains specific languages, file names or directories.
The security firm also disclosed that attackers are demanding 1 bitcoin worth $414, to release the encrypted files or data from the victim’s machine. Many first world county citizens has already paid huge sums of money to retrieve their valuable data, while others are thinking about paying these criminals what they are demanding.
How Cerber is encrypting the users data:
When first run, Cerber will check to see if the victim is from a particular country. If the computer appears to be from any of the following countries, it will terminate itself and not encrypt the computer.
Once it located the country; Cerber will install itself in the %AppData%{2ED2A2FE-872C-D4A0-17AC-E301404F1CBA} folder and name itself after a random Windows executable. For example, when we performed our analysis of the ransomware it named itself autochk.exe.
Cerber will then configure itself itself to start automatically when you login to windows, execute as your screensaver when your computer is idle, and set a task to execute itself once every minute. In this phase, when the ransomware is executed it will show a fake system alert and begin a restart process. Until this restart is allowed to occur, it will continue to display fake system alerts.
Those who are victimized by Cerber ransomware;
MySpyBot.com has developed a automated solution which can help you to recover your data without paying criminals a single penny.
Remove CERBER Ransomware in 2 simple steps:
Spybot’s process of automated removal of Cerber ransomware consists of 2 simple steps. It doesn’t require the user to have an in-depth knowledge of IT.
Step 1: Download and install the anti malware tool. Open the solution and have it check your PC for PUPs and other types of malicious software by clicking the Start Computer Scan button
Step 2: Rest assured the scan report will list all items that may harm your operating system. Select the detected entries and click Fix Threats to get the troubleshooting completed.
