Cybersecurity researchers have highlighted another excuse to not browse dodgy grownup web sites: a few of them are distributing viruses (opens in new tab) able to utterly destroying computer systems.

Just lately, specialists from Cyble found a few web sites, whose domains recommend they may function pornographic supplies. As quickly as somebody navigates to those websites, they’re prompted to obtain a file named “SexyPhotos.JPG.exe”. 

Whereas for the skilled net consumer this may set off each psychological alarm conceivable, people who find themselves not as well-versed may fall for the lure, notably as   Home windows hides file extensions by default.

Ransomware or wipers?

When triggered, the file drops 4 executable information – del.exe, open.exe, windll.exe and home windows.exe – in addition to one batch file referred to as avtstart.ba into the non permanent folder on the goal endpoint.

Every file has a singular position to play on this assault, however basically, that is all made to seem like a ransomware assault: the sufferer’s information are renamed and blocked, and a ransom observe is left behind, demanding $300 in Bitcoin or $600 if the cost doesn’t come inside three days.

However the larger drawback is that this isn’t a ransomware assault to start with, however somewhat a file-wiping malware assault, whose operators haven’t any intention of returning any information to the victims.

“Even when a decryptor is offered, renaming information to their authentic file title is unimaginable because the malware (opens in new tab) just isn’t storing them anyplace throughout the an infection,” Cyble defined.

There may be a technique the consequences of the wiper might be reversed, BleepingComputer has discovered. Apparently, the wiper doesn’t delete shadow copies, permitting customers to revive their working system to a earlier state. In different phrases, restoring the OS from an older backup could resolve the issue.

• These are one of the best endpoint safety providers round

Through BleepingComputer (opens in new tab)